_raw: 2025-12-04 19:06:21.120 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1652 appname=svchost.exe


_raw: 2025-12-04 19:06:21.120 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1216 appname=svchost.exe


_raw: 2025-12-04 19:06:21.120 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-04 19:06:21.120 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 19:06:21.120 transport=TCP dest_ip=0.0.0.0 dest_port=9389 pid=2764 appname=Microsoft.ActiveDirectory.WebServices.exe


_raw: 2025-12-04 19:06:21.120 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 19:06:21.120 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 19:06:21.120 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=764 appname=svchost.exe


_raw: 2025-12-04 19:06:21.120 transport=TCP dest_ip=0.0.0.0 dest_port=3269 pid=624 appname=lsass.exe


_raw: 2025-12-04 19:06:21.120 transport=TCP dest_ip=0.0.0.0 dest_port=3268 pid=624 appname=lsass.exe


_raw: 2025-12-04 19:06:21.120 transport=TCP dest_ip=0.0.0.0 dest_port=636 pid=624 appname=lsass.exe


_raw: 2025-12-04 19:06:21.120 transport=TCP dest_ip=0.0.0.0 dest_port=593 pid=948 appname=svchost.exe


_raw: 2025-12-04 19:06:21.120 transport=TCP dest_ip=0.0.0.0 dest_port=464 pid=624 appname=lsass.exe


_raw: 2025-12-04 19:06:21.120 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 19:06:21.120 transport=TCP dest_ip=0.0.0.0 dest_port=389 pid=624 appname=lsass.exe


_raw: 2025-12-04 19:06:21.120 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-04 19:06:21.120 transport=TCP dest_ip=0.0.0.0 dest_port=88 pid=624 appname=lsass.exe


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=[::] dest_port=49673 pid=612 appname=services.exe


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=[::] dest_port=49671 pid=2056 appname=svchost.exe


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=[::] dest_port=49669 pid=2152 appname=spoolsv.exe


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=[::] dest_port=49668 pid=1308 appname=svchost.exe


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=[::] dest_port=49667 pid=1468 appname=svchost.exe


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=[::] dest_port=49666 pid=1060 appname=svchost.exe


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=[::] dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=[::] dest_port=49664 pid=620 appname=lsass.exe


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=[::] dest_port=3389 pid=1020 appname=svchost.exe


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=[::] dest_port=135 pid=848 appname=svchost.exe


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=5068 appname=streamfwd.exe


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=0.0.0.0 dest_port=49673 pid=612 appname=services.exe


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2056 appname=svchost.exe


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2152 appname=spoolsv.exe


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=1308 appname=svchost.exe


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1468 appname=svchost.exe


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1060 appname=svchost.exe


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=1020 appname=svchost.exe


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 18:33:48.287 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=848 appname=svchost.exe


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=[::] dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=[::] dest_port=49671 pid=2376 appname=svchost.exe


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=[::] dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=[::] dest_port=49668 pid=2176 appname=svchost.exe


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=[::] dest_port=49667 pid=1692 appname=svchost.exe


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=[::] dest_port=49666 pid=1148 appname=svchost.exe


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=[::] dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=[::] dest_port=3389 pid=740 appname=svchost.exe


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=[::] dest_port=135 pid=956 appname=svchost.exe


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=1856 appname=streamfwd.exe


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2376 appname=svchost.exe


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2176 appname=svchost.exe


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1692 appname=svchost.exe


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1148 appname=svchost.exe


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=740 appname=svchost.exe


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 18:33:46.529 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=956 appname=svchost.exe


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=[::] dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=[::] dest_port=49671 pid=2444 appname=svchost.exe


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=[::] dest_port=49669 pid=2504 appname=spoolsv.exe


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=[::] dest_port=49668 pid=1620 appname=svchost.exe


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=[::] dest_port=49667 pid=2184 appname=svchost.exe


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=[::] dest_port=49666 pid=1164 appname=svchost.exe


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=[::] dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=[::] dest_port=49664 pid=688 appname=lsass.exe


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=[::] dest_port=3389 pid=824 appname=svchost.exe


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=[::] dest_port=135 pid=920 appname=svchost.exe


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=2252 appname=streamfwd.exe


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2444 appname=svchost.exe


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2504 appname=spoolsv.exe


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=1620 appname=svchost.exe


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=2184 appname=svchost.exe


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1164 appname=svchost.exe


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=824 appname=svchost.exe


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 18:32:49.102 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=920 appname=svchost.exe


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=[::] dest_port=49693 pid=680 appname=services.exe


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=[::] dest_port=49692 pid=2468 appname=svchost.exe


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=[::] dest_port=49689 pid=2600 appname=spoolsv.exe


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=[::] dest_port=49670 pid=1944 appname=svchost.exe


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=[::] dest_port=49669 pid=2308 appname=svchost.exe


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=[::] dest_port=49668 pid=700 appname=lsass.exe


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=[::] dest_port=49666 pid=1240 appname=svchost.exe


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=[::] dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=[::] dest_port=49664 pid=700 appname=lsass.exe


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=[::] dest_port=3389 pid=676 appname=svchost.exe


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=[::] dest_port=135 pid=932 appname=svchost.exe


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=10.0.1.21 dest_port=139 pid=4 appname=System


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=0.0.0.0 dest_port=49693 pid=680 appname=services.exe


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=0.0.0.0 dest_port=49692 pid=2468 appname=svchost.exe


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=0.0.0.0 dest_port=49689 pid=2600 appname=spoolsv.exe


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=0.0.0.0 dest_port=49670 pid=1944 appname=svchost.exe


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2308 appname=svchost.exe


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1240 appname=svchost.exe


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=676 appname=svchost.exe


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 18:32:19.667 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=932 appname=svchost.exe


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=[::] dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=[::] dest_port=49671 pid=2464 appname=svchost.exe


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=[::] dest_port=49669 pid=2472 appname=spoolsv.exe


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=[::] dest_port=49668 pid=2144 appname=svchost.exe


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=[::] dest_port=49667 pid=1544 appname=svchost.exe


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=[::] dest_port=49666 pid=1180 appname=svchost.exe


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=[::] dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=[::] dest_port=3389 pid=956 appname=svchost.exe


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=[::] dest_port=135 pid=944 appname=svchost.exe


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=3736 appname=streamfwd.exe


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2464 appname=svchost.exe


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2472 appname=spoolsv.exe


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2144 appname=svchost.exe


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1544 appname=svchost.exe


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1180 appname=svchost.exe


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=956 appname=svchost.exe


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 18:31:27.997 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=944 appname=svchost.exe


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=[::] dest_port=49697 pid=696 appname=services.exe


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=[::] dest_port=49696 pid=2416 appname=svchost.exe


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=[::] dest_port=49671 pid=2636 appname=spoolsv.exe


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=[::] dest_port=49669 pid=2404 appname=svchost.exe


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=[::] dest_port=49668 pid=708 appname=lsass.exe


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=[::] dest_port=49667 pid=1792 appname=svchost.exe


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=[::] dest_port=49666 pid=1228 appname=svchost.exe


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=[::] dest_port=49665 pid=552 appname=wininit.exe


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=[::] dest_port=3389 pid=400 appname=svchost.exe


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=[::] dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=10.0.1.20 dest_port=139 pid=4 appname=System


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=0.0.0.0 dest_port=49697 pid=696 appname=services.exe


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=0.0.0.0 dest_port=49696 pid=2416 appname=svchost.exe


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2636 appname=spoolsv.exe


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2404 appname=svchost.exe


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1792 appname=svchost.exe


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1228 appname=svchost.exe


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=552 appname=wininit.exe


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=400 appname=svchost.exe


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 18:29:56.266 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=[::] dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=[::] dest_port=49671 pid=2384 appname=svchost.exe


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=[::] dest_port=49669 pid=2516 appname=spoolsv.exe


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=[::] dest_port=49668 pid=2164 appname=svchost.exe


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=[::] dest_port=49667 pid=1596 appname=svchost.exe


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=[::] dest_port=49666 pid=1144 appname=svchost.exe


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=[::] dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=[::] dest_port=3389 pid=940 appname=svchost.exe


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=[::] dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=2628 appname=streamfwd.exe


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2384 appname=svchost.exe


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2516 appname=spoolsv.exe


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2164 appname=svchost.exe


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1596 appname=svchost.exe


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1144 appname=svchost.exe


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=940 appname=svchost.exe


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 18:29:35.380 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=[::] dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=[::] dest_port=49671 pid=2416 appname=svchost.exe


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=[::] dest_port=49669 pid=2432 appname=spoolsv.exe


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=[::] dest_port=49668 pid=2080 appname=svchost.exe


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=[::] dest_port=49667 pid=1640 appname=svchost.exe


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=[::] dest_port=49666 pid=1176 appname=svchost.exe


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=[::] dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=[::] dest_port=49664 pid=688 appname=lsass.exe


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=[::] dest_port=3389 pid=432 appname=svchost.exe


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=[::] dest_port=135 pid=928 appname=svchost.exe


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=2608 appname=streamfwd.exe


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2416 appname=svchost.exe


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2432 appname=spoolsv.exe


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2080 appname=svchost.exe


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1640 appname=svchost.exe


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1176 appname=svchost.exe


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=432 appname=svchost.exe


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 18:27:25.809 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=928 appname=svchost.exe


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=[::] dest_port=49672 pid=660 appname=services.exe


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=[::] dest_port=49671 pid=2436 appname=svchost.exe


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=[::] dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=[::] dest_port=49668 pid=2200 appname=svchost.exe


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=[::] dest_port=49667 pid=1668 appname=svchost.exe


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=[::] dest_port=49666 pid=1136 appname=svchost.exe


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=[::] dest_port=49665 pid=516 appname=wininit.exe


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=[::] dest_port=49664 pid=668 appname=lsass.exe


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=[::] dest_port=3389 pid=744 appname=svchost.exe


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=[::] dest_port=135 pid=908 appname=svchost.exe


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=3676 appname=streamfwd.exe


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=660 appname=services.exe


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2436 appname=svchost.exe


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2200 appname=svchost.exe


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1668 appname=svchost.exe


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1136 appname=svchost.exe


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=516 appname=wininit.exe


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=744 appname=svchost.exe


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 18:26:52.095 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=908 appname=svchost.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::1] dest_port=53 pid=2536 appname=dns.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=64023 pid=3044 appname=dfsrs.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=60234 pid=2176 appname=svchost.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=59631 pid=616 appname=services.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=59611 pid=2900 appname=spoolsv.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=59610 pid=624 appname=lsass.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=49669 pid=624 appname=lsass.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=49668 pid=1908 appname=svchost.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=49667 pid=1652 appname=svchost.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=49666 pid=1216 appname=svchost.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=49664 pid=624 appname=lsass.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=9389 pid=2764 appname=Microsoft.ActiveDirectory.WebServices.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=3389 pid=764 appname=svchost.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=3269 pid=624 appname=lsass.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=3268 pid=624 appname=lsass.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=636 pid=624 appname=lsass.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=593 pid=948 appname=svchost.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=464 pid=624 appname=lsass.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=389 pid=624 appname=lsass.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=[::] dest_port=88 pid=624 appname=lsass.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=10.0.1.6 dest_port=139 pid=4 appname=System


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=0.0.0.0 dest_port=60234 pid=2176 appname=svchost.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=0.0.0.0 dest_port=59631 pid=616 appname=services.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=0.0.0.0 dest_port=59611 pid=2900 appname=spoolsv.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=1908 appname=svchost.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1652 appname=svchost.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1216 appname=svchost.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=0.0.0.0 dest_port=9389 pid=2764 appname=Microsoft.ActiveDirectory.WebServices.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=764 appname=svchost.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=0.0.0.0 dest_port=3269 pid=624 appname=lsass.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=0.0.0.0 dest_port=3268 pid=624 appname=lsass.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=0.0.0.0 dest_port=636 pid=624 appname=lsass.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=0.0.0.0 dest_port=593 pid=948 appname=svchost.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=0.0.0.0 dest_port=464 pid=624 appname=lsass.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=0.0.0.0 dest_port=389 pid=624 appname=lsass.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-04 18:06:21.510 transport=TCP dest_ip=0.0.0.0 dest_port=88 pid=624 appname=lsass.exe


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=[::] dest_port=49673 pid=612 appname=services.exe


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=[::] dest_port=49671 pid=2056 appname=svchost.exe


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=[::] dest_port=49669 pid=2152 appname=spoolsv.exe


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=[::] dest_port=49668 pid=1308 appname=svchost.exe


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=[::] dest_port=49667 pid=1468 appname=svchost.exe


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=[::] dest_port=49666 pid=1060 appname=svchost.exe


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=[::] dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=[::] dest_port=49664 pid=620 appname=lsass.exe


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=[::] dest_port=3389 pid=1020 appname=svchost.exe


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=[::] dest_port=135 pid=848 appname=svchost.exe


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=5068 appname=streamfwd.exe


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=0.0.0.0 dest_port=49673 pid=612 appname=services.exe


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2056 appname=svchost.exe


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2152 appname=spoolsv.exe


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=1308 appname=svchost.exe


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1468 appname=svchost.exe


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1060 appname=svchost.exe


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=1020 appname=svchost.exe


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 17:33:49.031 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=848 appname=svchost.exe


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=[::] dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=[::] dest_port=49671 pid=2376 appname=svchost.exe


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=[::] dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=[::] dest_port=49668 pid=2176 appname=svchost.exe


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=[::] dest_port=49667 pid=1692 appname=svchost.exe


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=[::] dest_port=49666 pid=1148 appname=svchost.exe


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=[::] dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=[::] dest_port=3389 pid=740 appname=svchost.exe


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=[::] dest_port=135 pid=956 appname=svchost.exe


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=1856 appname=streamfwd.exe


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2376 appname=svchost.exe


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2176 appname=svchost.exe


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1692 appname=svchost.exe


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1148 appname=svchost.exe


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=740 appname=svchost.exe


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 17:33:46.628 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=956 appname=svchost.exe


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=[::] dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=[::] dest_port=49671 pid=2444 appname=svchost.exe


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=[::] dest_port=49669 pid=2504 appname=spoolsv.exe


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=[::] dest_port=49668 pid=1620 appname=svchost.exe


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=[::] dest_port=49667 pid=2184 appname=svchost.exe


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=[::] dest_port=49666 pid=1164 appname=svchost.exe


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=[::] dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=[::] dest_port=49664 pid=688 appname=lsass.exe


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=[::] dest_port=3389 pid=824 appname=svchost.exe


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=[::] dest_port=135 pid=920 appname=svchost.exe


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=2252 appname=streamfwd.exe


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2444 appname=svchost.exe


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2504 appname=spoolsv.exe


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=1620 appname=svchost.exe


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=2184 appname=svchost.exe


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1164 appname=svchost.exe


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=824 appname=svchost.exe


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 17:32:48.893 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=920 appname=svchost.exe


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=[::] dest_port=49693 pid=680 appname=services.exe


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=[::] dest_port=49692 pid=2468 appname=svchost.exe


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=[::] dest_port=49689 pid=2600 appname=spoolsv.exe


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=[::] dest_port=49670 pid=1944 appname=svchost.exe


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=[::] dest_port=49669 pid=2308 appname=svchost.exe


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=[::] dest_port=49668 pid=700 appname=lsass.exe


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=[::] dest_port=49666 pid=1240 appname=svchost.exe


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=[::] dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=[::] dest_port=49664 pid=700 appname=lsass.exe


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=[::] dest_port=3389 pid=676 appname=svchost.exe


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=[::] dest_port=135 pid=932 appname=svchost.exe


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=10.0.1.21 dest_port=139 pid=4 appname=System


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=0.0.0.0 dest_port=49693 pid=680 appname=services.exe


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=0.0.0.0 dest_port=49692 pid=2468 appname=svchost.exe


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=0.0.0.0 dest_port=49689 pid=2600 appname=spoolsv.exe


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=0.0.0.0 dest_port=49670 pid=1944 appname=svchost.exe


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2308 appname=svchost.exe


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1240 appname=svchost.exe


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=676 appname=svchost.exe


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 17:32:18.963 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=932 appname=svchost.exe


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=[::] dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=[::] dest_port=49671 pid=2464 appname=svchost.exe


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=[::] dest_port=49669 pid=2472 appname=spoolsv.exe


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=[::] dest_port=49668 pid=2144 appname=svchost.exe


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=[::] dest_port=49667 pid=1544 appname=svchost.exe


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=[::] dest_port=49666 pid=1180 appname=svchost.exe


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=[::] dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=[::] dest_port=3389 pid=956 appname=svchost.exe


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=[::] dest_port=135 pid=944 appname=svchost.exe


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=3736 appname=streamfwd.exe


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2464 appname=svchost.exe


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2472 appname=spoolsv.exe


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2144 appname=svchost.exe


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1544 appname=svchost.exe


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1180 appname=svchost.exe


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=956 appname=svchost.exe


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 17:31:28.455 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=944 appname=svchost.exe


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=[::] dest_port=49697 pid=696 appname=services.exe


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=[::] dest_port=49696 pid=2416 appname=svchost.exe


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=[::] dest_port=49671 pid=2636 appname=spoolsv.exe


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=[::] dest_port=49669 pid=2404 appname=svchost.exe


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=[::] dest_port=49668 pid=708 appname=lsass.exe


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=[::] dest_port=49667 pid=1792 appname=svchost.exe


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=[::] dest_port=49666 pid=1228 appname=svchost.exe


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=[::] dest_port=49665 pid=552 appname=wininit.exe


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=[::] dest_port=3389 pid=400 appname=svchost.exe


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=[::] dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=10.0.1.20 dest_port=139 pid=4 appname=System


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=0.0.0.0 dest_port=49697 pid=696 appname=services.exe


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=0.0.0.0 dest_port=49696 pid=2416 appname=svchost.exe


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2636 appname=spoolsv.exe


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2404 appname=svchost.exe


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1792 appname=svchost.exe


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1228 appname=svchost.exe


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=552 appname=wininit.exe


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=400 appname=svchost.exe


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 17:29:55.955 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=[::] dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=[::] dest_port=49671 pid=2384 appname=svchost.exe


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=[::] dest_port=49669 pid=2516 appname=spoolsv.exe


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=[::] dest_port=49668 pid=2164 appname=svchost.exe


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=[::] dest_port=49667 pid=1596 appname=svchost.exe


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=[::] dest_port=49666 pid=1144 appname=svchost.exe


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=[::] dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=[::] dest_port=3389 pid=940 appname=svchost.exe


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=[::] dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=2628 appname=streamfwd.exe


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2384 appname=svchost.exe


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2516 appname=spoolsv.exe


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2164 appname=svchost.exe


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1596 appname=svchost.exe


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1144 appname=svchost.exe


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=940 appname=svchost.exe


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 17:29:35.795 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=[::] dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=[::] dest_port=49671 pid=2416 appname=svchost.exe


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=[::] dest_port=49669 pid=2432 appname=spoolsv.exe


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=[::] dest_port=49668 pid=2080 appname=svchost.exe


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=[::] dest_port=49667 pid=1640 appname=svchost.exe


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=[::] dest_port=49666 pid=1176 appname=svchost.exe


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=[::] dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=[::] dest_port=49664 pid=688 appname=lsass.exe


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=[::] dest_port=3389 pid=432 appname=svchost.exe


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=[::] dest_port=135 pid=928 appname=svchost.exe


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=2608 appname=streamfwd.exe


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2416 appname=svchost.exe


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2432 appname=spoolsv.exe


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2080 appname=svchost.exe


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1640 appname=svchost.exe


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1176 appname=svchost.exe


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=432 appname=svchost.exe


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 17:27:25.776 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=928 appname=svchost.exe


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=[::] dest_port=49672 pid=660 appname=services.exe


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=[::] dest_port=49671 pid=2436 appname=svchost.exe


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=[::] dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=[::] dest_port=49668 pid=2200 appname=svchost.exe


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=[::] dest_port=49667 pid=1668 appname=svchost.exe


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=[::] dest_port=49666 pid=1136 appname=svchost.exe


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=[::] dest_port=49665 pid=516 appname=wininit.exe


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=[::] dest_port=49664 pid=668 appname=lsass.exe


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=[::] dest_port=3389 pid=744 appname=svchost.exe


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=[::] dest_port=135 pid=908 appname=svchost.exe


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=3676 appname=streamfwd.exe


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=660 appname=services.exe


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2436 appname=svchost.exe


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2200 appname=svchost.exe


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1668 appname=svchost.exe


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1136 appname=svchost.exe


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=516 appname=wininit.exe


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=744 appname=svchost.exe


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 17:26:52.070 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=908 appname=svchost.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::1] dest_port=53 pid=2536 appname=dns.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=64023 pid=3044 appname=dfsrs.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=60234 pid=2176 appname=svchost.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=59631 pid=616 appname=services.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=59611 pid=2900 appname=spoolsv.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=59610 pid=624 appname=lsass.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=49669 pid=624 appname=lsass.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=49668 pid=1908 appname=svchost.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=49667 pid=1652 appname=svchost.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=49666 pid=1216 appname=svchost.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=49664 pid=624 appname=lsass.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=9389 pid=2764 appname=Microsoft.ActiveDirectory.WebServices.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=3389 pid=764 appname=svchost.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=3269 pid=624 appname=lsass.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=3268 pid=624 appname=lsass.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=636 pid=624 appname=lsass.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=593 pid=948 appname=svchost.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=464 pid=624 appname=lsass.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=389 pid=624 appname=lsass.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=[::] dest_port=88 pid=624 appname=lsass.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=10.0.1.6 dest_port=139 pid=4 appname=System


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=0.0.0.0 dest_port=60234 pid=2176 appname=svchost.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=0.0.0.0 dest_port=59631 pid=616 appname=services.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=0.0.0.0 dest_port=59611 pid=2900 appname=spoolsv.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=1908 appname=svchost.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1652 appname=svchost.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1216 appname=svchost.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=0.0.0.0 dest_port=9389 pid=2764 appname=Microsoft.ActiveDirectory.WebServices.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=764 appname=svchost.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=0.0.0.0 dest_port=3269 pid=624 appname=lsass.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=0.0.0.0 dest_port=3268 pid=624 appname=lsass.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=0.0.0.0 dest_port=636 pid=624 appname=lsass.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=0.0.0.0 dest_port=593 pid=948 appname=svchost.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=0.0.0.0 dest_port=464 pid=624 appname=lsass.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=0.0.0.0 dest_port=389 pid=624 appname=lsass.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-04 17:06:23.487 transport=TCP dest_ip=0.0.0.0 dest_port=88 pid=624 appname=lsass.exe


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=[::] dest_port=49673 pid=612 appname=services.exe


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=[::] dest_port=49671 pid=2056 appname=svchost.exe


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=[::] dest_port=49669 pid=2152 appname=spoolsv.exe


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=[::] dest_port=49668 pid=1308 appname=svchost.exe


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=[::] dest_port=49667 pid=1468 appname=svchost.exe


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=[::] dest_port=49666 pid=1060 appname=svchost.exe


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=[::] dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=[::] dest_port=49664 pid=620 appname=lsass.exe


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=[::] dest_port=3389 pid=1020 appname=svchost.exe


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=[::] dest_port=135 pid=848 appname=svchost.exe


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=5068 appname=streamfwd.exe


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=0.0.0.0 dest_port=49673 pid=612 appname=services.exe


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2056 appname=svchost.exe


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2152 appname=spoolsv.exe


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=1308 appname=svchost.exe


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1468 appname=svchost.exe


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1060 appname=svchost.exe


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=1020 appname=svchost.exe


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 16:33:49.167 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=848 appname=svchost.exe


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=[::] dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=[::] dest_port=49671 pid=2376 appname=svchost.exe


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=[::] dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=[::] dest_port=49668 pid=2176 appname=svchost.exe


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=[::] dest_port=49667 pid=1692 appname=svchost.exe


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=[::] dest_port=49666 pid=1148 appname=svchost.exe


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=[::] dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=[::] dest_port=3389 pid=740 appname=svchost.exe


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=[::] dest_port=135 pid=956 appname=svchost.exe


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=1856 appname=streamfwd.exe


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2376 appname=svchost.exe


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2176 appname=svchost.exe


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1692 appname=svchost.exe


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1148 appname=svchost.exe


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=740 appname=svchost.exe


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 16:33:46.722 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=956 appname=svchost.exe


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=[::] dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=[::] dest_port=49671 pid=2444 appname=svchost.exe


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=[::] dest_port=49669 pid=2504 appname=spoolsv.exe


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=[::] dest_port=49668 pid=1620 appname=svchost.exe


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=[::] dest_port=49667 pid=2184 appname=svchost.exe


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=[::] dest_port=49666 pid=1164 appname=svchost.exe


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=[::] dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=[::] dest_port=49664 pid=688 appname=lsass.exe


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=[::] dest_port=3389 pid=824 appname=svchost.exe


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=[::] dest_port=135 pid=920 appname=svchost.exe


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=2252 appname=streamfwd.exe


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2444 appname=svchost.exe


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2504 appname=spoolsv.exe


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=1620 appname=svchost.exe


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=2184 appname=svchost.exe


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1164 appname=svchost.exe


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=824 appname=svchost.exe


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 16:32:49.453 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=920 appname=svchost.exe


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=[::] dest_port=49693 pid=680 appname=services.exe


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=[::] dest_port=49692 pid=2468 appname=svchost.exe


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=[::] dest_port=49689 pid=2600 appname=spoolsv.exe


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=[::] dest_port=49670 pid=1944 appname=svchost.exe


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=[::] dest_port=49669 pid=2308 appname=svchost.exe


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=[::] dest_port=49668 pid=700 appname=lsass.exe


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=[::] dest_port=49666 pid=1240 appname=svchost.exe


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=[::] dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=[::] dest_port=49664 pid=700 appname=lsass.exe


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=[::] dest_port=3389 pid=676 appname=svchost.exe


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=[::] dest_port=135 pid=932 appname=svchost.exe


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=10.0.1.21 dest_port=139 pid=4 appname=System


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=0.0.0.0 dest_port=49693 pid=680 appname=services.exe


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=0.0.0.0 dest_port=49692 pid=2468 appname=svchost.exe


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=0.0.0.0 dest_port=49689 pid=2600 appname=spoolsv.exe


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=0.0.0.0 dest_port=49670 pid=1944 appname=svchost.exe


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2308 appname=svchost.exe


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1240 appname=svchost.exe


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=676 appname=svchost.exe


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 16:32:20.137 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=932 appname=svchost.exe


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=[::] dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=[::] dest_port=49671 pid=2464 appname=svchost.exe


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=[::] dest_port=49669 pid=2472 appname=spoolsv.exe


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=[::] dest_port=49668 pid=2144 appname=svchost.exe


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=[::] dest_port=49667 pid=1544 appname=svchost.exe


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=[::] dest_port=49666 pid=1180 appname=svchost.exe


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=[::] dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=[::] dest_port=3389 pid=956 appname=svchost.exe


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=[::] dest_port=135 pid=944 appname=svchost.exe


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=3736 appname=streamfwd.exe


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2464 appname=svchost.exe


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2472 appname=spoolsv.exe


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2144 appname=svchost.exe


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1544 appname=svchost.exe


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1180 appname=svchost.exe


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=956 appname=svchost.exe


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 16:31:28.048 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=944 appname=svchost.exe


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=[::] dest_port=49697 pid=696 appname=services.exe


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=[::] dest_port=49696 pid=2416 appname=svchost.exe


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=[::] dest_port=49671 pid=2636 appname=spoolsv.exe


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=[::] dest_port=49669 pid=2404 appname=svchost.exe


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=[::] dest_port=49668 pid=708 appname=lsass.exe


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=[::] dest_port=49667 pid=1792 appname=svchost.exe


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=[::] dest_port=49666 pid=1228 appname=svchost.exe


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=[::] dest_port=49665 pid=552 appname=wininit.exe


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=[::] dest_port=3389 pid=400 appname=svchost.exe


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=[::] dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=10.0.1.20 dest_port=139 pid=4 appname=System


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=0.0.0.0 dest_port=49697 pid=696 appname=services.exe


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=0.0.0.0 dest_port=49696 pid=2416 appname=svchost.exe


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2636 appname=spoolsv.exe


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2404 appname=svchost.exe


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1792 appname=svchost.exe


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1228 appname=svchost.exe


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=552 appname=wininit.exe


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=400 appname=svchost.exe


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 16:29:55.808 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=[::] dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=[::] dest_port=49671 pid=2384 appname=svchost.exe


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=[::] dest_port=49669 pid=2516 appname=spoolsv.exe


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=[::] dest_port=49668 pid=2164 appname=svchost.exe


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=[::] dest_port=49667 pid=1596 appname=svchost.exe


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=[::] dest_port=49666 pid=1144 appname=svchost.exe


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=[::] dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=[::] dest_port=3389 pid=940 appname=svchost.exe


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=[::] dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=2628 appname=streamfwd.exe


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2384 appname=svchost.exe


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2516 appname=spoolsv.exe


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2164 appname=svchost.exe


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1596 appname=svchost.exe


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1144 appname=svchost.exe


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=940 appname=svchost.exe


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 16:29:35.782 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=[::] dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=[::] dest_port=49671 pid=2416 appname=svchost.exe


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=[::] dest_port=49669 pid=2432 appname=spoolsv.exe


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=[::] dest_port=49668 pid=2080 appname=svchost.exe


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=[::] dest_port=49667 pid=1640 appname=svchost.exe


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=[::] dest_port=49666 pid=1176 appname=svchost.exe


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=[::] dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=[::] dest_port=49664 pid=688 appname=lsass.exe


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=[::] dest_port=3389 pid=432 appname=svchost.exe


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=[::] dest_port=135 pid=928 appname=svchost.exe


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=2608 appname=streamfwd.exe


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2416 appname=svchost.exe


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2432 appname=spoolsv.exe


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2080 appname=svchost.exe


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1640 appname=svchost.exe


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1176 appname=svchost.exe


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=432 appname=svchost.exe


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 16:27:25.733 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=928 appname=svchost.exe


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=[::] dest_port=49672 pid=660 appname=services.exe


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=[::] dest_port=49671 pid=2436 appname=svchost.exe


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=[::] dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=[::] dest_port=49668 pid=2200 appname=svchost.exe


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=[::] dest_port=49667 pid=1668 appname=svchost.exe


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=[::] dest_port=49666 pid=1136 appname=svchost.exe


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=[::] dest_port=49665 pid=516 appname=wininit.exe


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=[::] dest_port=49664 pid=668 appname=lsass.exe


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=[::] dest_port=3389 pid=744 appname=svchost.exe


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=[::] dest_port=135 pid=908 appname=svchost.exe


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=3676 appname=streamfwd.exe


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=660 appname=services.exe


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2436 appname=svchost.exe


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2200 appname=svchost.exe


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1668 appname=svchost.exe


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1136 appname=svchost.exe


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=516 appname=wininit.exe


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=744 appname=svchost.exe


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 16:26:51.718 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=908 appname=svchost.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::1] dest_port=53 pid=2536 appname=dns.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=64023 pid=3044 appname=dfsrs.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=60234 pid=2176 appname=svchost.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=59631 pid=616 appname=services.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=59611 pid=2900 appname=spoolsv.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=59610 pid=624 appname=lsass.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=49669 pid=624 appname=lsass.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=49668 pid=1908 appname=svchost.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=49667 pid=1652 appname=svchost.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=49666 pid=1216 appname=svchost.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=49664 pid=624 appname=lsass.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=9389 pid=2764 appname=Microsoft.ActiveDirectory.WebServices.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=3389 pid=764 appname=svchost.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=3269 pid=624 appname=lsass.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=3268 pid=624 appname=lsass.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=636 pid=624 appname=lsass.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=593 pid=948 appname=svchost.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=464 pid=624 appname=lsass.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=389 pid=624 appname=lsass.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=[::] dest_port=88 pid=624 appname=lsass.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=10.0.1.6 dest_port=139 pid=4 appname=System


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=0.0.0.0 dest_port=60234 pid=2176 appname=svchost.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=0.0.0.0 dest_port=59631 pid=616 appname=services.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=0.0.0.0 dest_port=59611 pid=2900 appname=spoolsv.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=1908 appname=svchost.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1652 appname=svchost.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1216 appname=svchost.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=0.0.0.0 dest_port=9389 pid=2764 appname=Microsoft.ActiveDirectory.WebServices.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=764 appname=svchost.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=0.0.0.0 dest_port=3269 pid=624 appname=lsass.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=0.0.0.0 dest_port=3268 pid=624 appname=lsass.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=0.0.0.0 dest_port=636 pid=624 appname=lsass.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=0.0.0.0 dest_port=593 pid=948 appname=svchost.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=0.0.0.0 dest_port=464 pid=624 appname=lsass.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=0.0.0.0 dest_port=389 pid=624 appname=lsass.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-04 16:06:22.450 transport=TCP dest_ip=0.0.0.0 dest_port=88 pid=624 appname=lsass.exe


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=[::] dest_port=49673 pid=612 appname=services.exe


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=[::] dest_port=49671 pid=2056 appname=svchost.exe


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=[::] dest_port=49669 pid=2152 appname=spoolsv.exe


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=[::] dest_port=49668 pid=1308 appname=svchost.exe


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=[::] dest_port=49667 pid=1468 appname=svchost.exe


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=[::] dest_port=49666 pid=1060 appname=svchost.exe


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=[::] dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=[::] dest_port=49664 pid=620 appname=lsass.exe


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=[::] dest_port=3389 pid=1020 appname=svchost.exe


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=[::] dest_port=135 pid=848 appname=svchost.exe


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=5068 appname=streamfwd.exe


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=0.0.0.0 dest_port=49673 pid=612 appname=services.exe


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2056 appname=svchost.exe


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2152 appname=spoolsv.exe


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=1308 appname=svchost.exe


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1468 appname=svchost.exe


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1060 appname=svchost.exe


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=1020 appname=svchost.exe


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-04 15:33:48.621 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=848 appname=svchost.exe


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=[::] dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=[::] dest_port=49671 pid=2376 appname=svchost.exe


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=[::] dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=[::] dest_port=49668 pid=2176 appname=svchost.exe


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=[::] dest_port=49667 pid=1692 appname=svchost.exe


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=[::] dest_port=49666 pid=1148 appname=svchost.exe


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=[::] dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=[::] dest_port=3389 pid=740 appname=svchost.exe


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=[::] dest_port=135 pid=956 appname=svchost.exe


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=1856 appname=streamfwd.exe


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2376 appname=svchost.exe


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2176 appname=svchost.exe


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1692 appname=svchost.exe


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1148 appname=svchost.exe


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-04 15:33:46.684 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System