_raw: 2025-12-09 12:06:20.850 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1652 appname=svchost.exe


_raw: 2025-12-09 12:06:20.850 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1216 appname=svchost.exe


_raw: 2025-12-09 12:06:20.850 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-09 12:06:20.850 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 12:06:20.850 transport=TCP dest_ip=0.0.0.0 dest_port=9389 pid=2764 appname=Microsoft.ActiveDirectory.WebServices.exe


_raw: 2025-12-09 12:06:20.850 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 12:06:20.850 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 12:06:20.850 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=764 appname=svchost.exe


_raw: 2025-12-09 12:06:20.850 transport=TCP dest_ip=0.0.0.0 dest_port=3269 pid=624 appname=lsass.exe


_raw: 2025-12-09 12:06:20.850 transport=TCP dest_ip=0.0.0.0 dest_port=3268 pid=624 appname=lsass.exe


_raw: 2025-12-09 12:06:20.850 transport=TCP dest_ip=0.0.0.0 dest_port=636 pid=624 appname=lsass.exe


_raw: 2025-12-09 12:06:20.850 transport=TCP dest_ip=0.0.0.0 dest_port=593 pid=948 appname=svchost.exe


_raw: 2025-12-09 12:06:20.850 transport=TCP dest_ip=0.0.0.0 dest_port=464 pid=624 appname=lsass.exe


_raw: 2025-12-09 12:06:20.850 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 12:06:20.850 transport=TCP dest_ip=0.0.0.0 dest_port=389 pid=624 appname=lsass.exe


_raw: 2025-12-09 12:06:20.850 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-09 12:06:20.850 transport=TCP dest_ip=0.0.0.0 dest_port=88 pid=624 appname=lsass.exe


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=[::] dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=[::] dest_port=49671 pid=2376 appname=svchost.exe


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=[::] dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=[::] dest_port=49668 pid=2176 appname=svchost.exe


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=[::] dest_port=49667 pid=1692 appname=svchost.exe


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=[::] dest_port=49666 pid=1148 appname=svchost.exe


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=[::] dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=[::] dest_port=3389 pid=740 appname=svchost.exe


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=[::] dest_port=135 pid=956 appname=svchost.exe


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=1856 appname=streamfwd.exe


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2376 appname=svchost.exe


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2176 appname=svchost.exe


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1692 appname=svchost.exe


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1148 appname=svchost.exe


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=740 appname=svchost.exe


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 11:33:51.807 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=956 appname=svchost.exe


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=[::] dest_port=49673 pid=612 appname=services.exe


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=[::] dest_port=49671 pid=2056 appname=svchost.exe


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=[::] dest_port=49669 pid=2152 appname=spoolsv.exe


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=[::] dest_port=49668 pid=1308 appname=svchost.exe


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=[::] dest_port=49667 pid=1468 appname=svchost.exe


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=[::] dest_port=49666 pid=1060 appname=svchost.exe


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=[::] dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=[::] dest_port=49664 pid=620 appname=lsass.exe


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=[::] dest_port=3389 pid=1020 appname=svchost.exe


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=[::] dest_port=135 pid=848 appname=svchost.exe


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=5068 appname=streamfwd.exe


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=0.0.0.0 dest_port=49673 pid=612 appname=services.exe


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2056 appname=svchost.exe


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2152 appname=spoolsv.exe


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=1308 appname=svchost.exe


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1468 appname=svchost.exe


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1060 appname=svchost.exe


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=1020 appname=svchost.exe


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 11:33:44.152 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=848 appname=svchost.exe


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=[::] dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=[::] dest_port=49671 pid=2444 appname=svchost.exe


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=[::] dest_port=49669 pid=2504 appname=spoolsv.exe


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=[::] dest_port=49668 pid=1620 appname=svchost.exe


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=[::] dest_port=49667 pid=2184 appname=svchost.exe


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=[::] dest_port=49666 pid=1164 appname=svchost.exe


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=[::] dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=[::] dest_port=49664 pid=688 appname=lsass.exe


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=[::] dest_port=3389 pid=824 appname=svchost.exe


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=[::] dest_port=135 pid=920 appname=svchost.exe


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=2252 appname=streamfwd.exe


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2444 appname=svchost.exe


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2504 appname=spoolsv.exe


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=1620 appname=svchost.exe


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=2184 appname=svchost.exe


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1164 appname=svchost.exe


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=824 appname=svchost.exe


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 11:32:53.913 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=920 appname=svchost.exe


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=[::] dest_port=49693 pid=680 appname=services.exe


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=[::] dest_port=49692 pid=2468 appname=svchost.exe


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=[::] dest_port=49689 pid=2600 appname=spoolsv.exe


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=[::] dest_port=49670 pid=1944 appname=svchost.exe


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=[::] dest_port=49669 pid=2308 appname=svchost.exe


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=[::] dest_port=49668 pid=700 appname=lsass.exe


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=[::] dest_port=49666 pid=1240 appname=svchost.exe


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=[::] dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=[::] dest_port=49664 pid=700 appname=lsass.exe


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=[::] dest_port=3389 pid=676 appname=svchost.exe


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=[::] dest_port=135 pid=932 appname=svchost.exe


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=10.0.1.21 dest_port=139 pid=4 appname=System


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=0.0.0.0 dest_port=49693 pid=680 appname=services.exe


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=0.0.0.0 dest_port=49692 pid=2468 appname=svchost.exe


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=0.0.0.0 dest_port=49689 pid=2600 appname=spoolsv.exe


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=0.0.0.0 dest_port=49670 pid=1944 appname=svchost.exe


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2308 appname=svchost.exe


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1240 appname=svchost.exe


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=676 appname=svchost.exe


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 11:32:27.190 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=932 appname=svchost.exe


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=[::] dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=[::] dest_port=49671 pid=2464 appname=svchost.exe


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=[::] dest_port=49669 pid=2472 appname=spoolsv.exe


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=[::] dest_port=49668 pid=2144 appname=svchost.exe


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=[::] dest_port=49667 pid=1544 appname=svchost.exe


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=[::] dest_port=49666 pid=1180 appname=svchost.exe


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=[::] dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=[::] dest_port=3389 pid=956 appname=svchost.exe


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=[::] dest_port=135 pid=944 appname=svchost.exe


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=3736 appname=streamfwd.exe


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2464 appname=svchost.exe


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2472 appname=spoolsv.exe


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2144 appname=svchost.exe


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1544 appname=svchost.exe


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1180 appname=svchost.exe


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=956 appname=svchost.exe


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 11:31:30.014 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=944 appname=svchost.exe


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=[::] dest_port=49697 pid=696 appname=services.exe


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=[::] dest_port=49696 pid=2416 appname=svchost.exe


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=[::] dest_port=49671 pid=2636 appname=spoolsv.exe


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=[::] dest_port=49669 pid=2404 appname=svchost.exe


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=[::] dest_port=49668 pid=708 appname=lsass.exe


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=[::] dest_port=49667 pid=1792 appname=svchost.exe


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=[::] dest_port=49666 pid=1228 appname=svchost.exe


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=[::] dest_port=49665 pid=552 appname=wininit.exe


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=[::] dest_port=3389 pid=400 appname=svchost.exe


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=[::] dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=10.0.1.20 dest_port=139 pid=4 appname=System


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=0.0.0.0 dest_port=49697 pid=696 appname=services.exe


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=0.0.0.0 dest_port=49696 pid=2416 appname=svchost.exe


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2636 appname=spoolsv.exe


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2404 appname=svchost.exe


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1792 appname=svchost.exe


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1228 appname=svchost.exe


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=552 appname=wininit.exe


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=400 appname=svchost.exe


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 11:29:55.993 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=[::] dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=[::] dest_port=49671 pid=2384 appname=svchost.exe


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=[::] dest_port=49669 pid=2516 appname=spoolsv.exe


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=[::] dest_port=49668 pid=2164 appname=svchost.exe


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=[::] dest_port=49667 pid=1596 appname=svchost.exe


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=[::] dest_port=49666 pid=1144 appname=svchost.exe


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=[::] dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=[::] dest_port=3389 pid=940 appname=svchost.exe


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=[::] dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=2628 appname=streamfwd.exe


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2384 appname=svchost.exe


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2516 appname=spoolsv.exe


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2164 appname=svchost.exe


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1596 appname=svchost.exe


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1144 appname=svchost.exe


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=940 appname=svchost.exe


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 11:29:36.178 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=[::] dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=[::] dest_port=49671 pid=2416 appname=svchost.exe


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=[::] dest_port=49669 pid=2432 appname=spoolsv.exe


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=[::] dest_port=49668 pid=2080 appname=svchost.exe


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=[::] dest_port=49667 pid=1640 appname=svchost.exe


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=[::] dest_port=49666 pid=1176 appname=svchost.exe


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=[::] dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=[::] dest_port=49664 pid=688 appname=lsass.exe


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=[::] dest_port=3389 pid=432 appname=svchost.exe


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=[::] dest_port=135 pid=928 appname=svchost.exe


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=2608 appname=streamfwd.exe


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2416 appname=svchost.exe


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2432 appname=spoolsv.exe


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2080 appname=svchost.exe


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1640 appname=svchost.exe


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1176 appname=svchost.exe


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=432 appname=svchost.exe


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 11:27:29.979 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=928 appname=svchost.exe


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=[::] dest_port=49672 pid=660 appname=services.exe


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=[::] dest_port=49671 pid=2436 appname=svchost.exe


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=[::] dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=[::] dest_port=49668 pid=2200 appname=svchost.exe


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=[::] dest_port=49667 pid=1668 appname=svchost.exe


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=[::] dest_port=49666 pid=1136 appname=svchost.exe


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=[::] dest_port=49665 pid=516 appname=wininit.exe


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=[::] dest_port=49664 pid=668 appname=lsass.exe


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=[::] dest_port=3389 pid=744 appname=svchost.exe


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=[::] dest_port=135 pid=908 appname=svchost.exe


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=3676 appname=streamfwd.exe


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=660 appname=services.exe


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2436 appname=svchost.exe


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2200 appname=svchost.exe


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1668 appname=svchost.exe


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1136 appname=svchost.exe


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=516 appname=wininit.exe


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=744 appname=svchost.exe


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 11:26:52.499 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=908 appname=svchost.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::1] dest_port=53 pid=2536 appname=dns.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=64023 pid=3044 appname=dfsrs.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=60234 pid=2176 appname=svchost.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=59631 pid=616 appname=services.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=59611 pid=2900 appname=spoolsv.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=59610 pid=624 appname=lsass.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=49669 pid=624 appname=lsass.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=49668 pid=1908 appname=svchost.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=49667 pid=1652 appname=svchost.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=49666 pid=1216 appname=svchost.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=49664 pid=624 appname=lsass.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=9389 pid=2764 appname=Microsoft.ActiveDirectory.WebServices.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=3389 pid=764 appname=svchost.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=3269 pid=624 appname=lsass.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=3268 pid=624 appname=lsass.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=636 pid=624 appname=lsass.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=593 pid=948 appname=svchost.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=464 pid=624 appname=lsass.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=389 pid=624 appname=lsass.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=[::] dest_port=88 pid=624 appname=lsass.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=10.0.1.6 dest_port=139 pid=4 appname=System


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=0.0.0.0 dest_port=60234 pid=2176 appname=svchost.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=0.0.0.0 dest_port=59631 pid=616 appname=services.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=0.0.0.0 dest_port=59611 pid=2900 appname=spoolsv.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=1908 appname=svchost.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1652 appname=svchost.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1216 appname=svchost.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=0.0.0.0 dest_port=9389 pid=2764 appname=Microsoft.ActiveDirectory.WebServices.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=764 appname=svchost.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=0.0.0.0 dest_port=3269 pid=624 appname=lsass.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=0.0.0.0 dest_port=3268 pid=624 appname=lsass.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=0.0.0.0 dest_port=636 pid=624 appname=lsass.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=0.0.0.0 dest_port=593 pid=948 appname=svchost.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=0.0.0.0 dest_port=464 pid=624 appname=lsass.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=0.0.0.0 dest_port=389 pid=624 appname=lsass.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-09 11:06:22.070 transport=TCP dest_ip=0.0.0.0 dest_port=88 pid=624 appname=lsass.exe


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=[::] dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=[::] dest_port=49671 pid=2376 appname=svchost.exe


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=[::] dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=[::] dest_port=49668 pid=2176 appname=svchost.exe


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=[::] dest_port=49667 pid=1692 appname=svchost.exe


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=[::] dest_port=49666 pid=1148 appname=svchost.exe


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=[::] dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=[::] dest_port=3389 pid=740 appname=svchost.exe


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=[::] dest_port=135 pid=956 appname=svchost.exe


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=1856 appname=streamfwd.exe


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2376 appname=svchost.exe


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2176 appname=svchost.exe


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1692 appname=svchost.exe


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1148 appname=svchost.exe


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=740 appname=svchost.exe


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 10:33:51.361 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=956 appname=svchost.exe


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=[::] dest_port=49673 pid=612 appname=services.exe


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=[::] dest_port=49671 pid=2056 appname=svchost.exe


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=[::] dest_port=49669 pid=2152 appname=spoolsv.exe


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=[::] dest_port=49668 pid=1308 appname=svchost.exe


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=[::] dest_port=49667 pid=1468 appname=svchost.exe


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=[::] dest_port=49666 pid=1060 appname=svchost.exe


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=[::] dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=[::] dest_port=49664 pid=620 appname=lsass.exe


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=[::] dest_port=3389 pid=1020 appname=svchost.exe


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=[::] dest_port=135 pid=848 appname=svchost.exe


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=5068 appname=streamfwd.exe


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=0.0.0.0 dest_port=49673 pid=612 appname=services.exe


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2056 appname=svchost.exe


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2152 appname=spoolsv.exe


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=1308 appname=svchost.exe


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1468 appname=svchost.exe


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1060 appname=svchost.exe


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=1020 appname=svchost.exe


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 10:33:44.166 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=848 appname=svchost.exe


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=[::] dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=[::] dest_port=49671 pid=2444 appname=svchost.exe


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=[::] dest_port=49669 pid=2504 appname=spoolsv.exe


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=[::] dest_port=49668 pid=1620 appname=svchost.exe


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=[::] dest_port=49667 pid=2184 appname=svchost.exe


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=[::] dest_port=49666 pid=1164 appname=svchost.exe


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=[::] dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=[::] dest_port=49664 pid=688 appname=lsass.exe


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=[::] dest_port=3389 pid=824 appname=svchost.exe


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=[::] dest_port=135 pid=920 appname=svchost.exe


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=2252 appname=streamfwd.exe


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2444 appname=svchost.exe


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2504 appname=spoolsv.exe


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=1620 appname=svchost.exe


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=2184 appname=svchost.exe


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1164 appname=svchost.exe


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=824 appname=svchost.exe


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 10:32:54.033 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=920 appname=svchost.exe


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=[::] dest_port=49693 pid=680 appname=services.exe


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=[::] dest_port=49692 pid=2468 appname=svchost.exe


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=[::] dest_port=49689 pid=2600 appname=spoolsv.exe


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=[::] dest_port=49670 pid=1944 appname=svchost.exe


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=[::] dest_port=49669 pid=2308 appname=svchost.exe


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=[::] dest_port=49668 pid=700 appname=lsass.exe


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=[::] dest_port=49666 pid=1240 appname=svchost.exe


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=[::] dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=[::] dest_port=49664 pid=700 appname=lsass.exe


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=[::] dest_port=3389 pid=676 appname=svchost.exe


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=[::] dest_port=135 pid=932 appname=svchost.exe


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=10.0.1.21 dest_port=139 pid=4 appname=System


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=0.0.0.0 dest_port=49693 pid=680 appname=services.exe


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=0.0.0.0 dest_port=49692 pid=2468 appname=svchost.exe


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=0.0.0.0 dest_port=49689 pid=2600 appname=spoolsv.exe


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=0.0.0.0 dest_port=49670 pid=1944 appname=svchost.exe


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2308 appname=svchost.exe


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1240 appname=svchost.exe


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=676 appname=svchost.exe


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 10:32:25.808 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=932 appname=svchost.exe


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=[::] dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=[::] dest_port=49671 pid=2464 appname=svchost.exe


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=[::] dest_port=49669 pid=2472 appname=spoolsv.exe


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=[::] dest_port=49668 pid=2144 appname=svchost.exe


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=[::] dest_port=49667 pid=1544 appname=svchost.exe


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=[::] dest_port=49666 pid=1180 appname=svchost.exe


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=[::] dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=[::] dest_port=3389 pid=956 appname=svchost.exe


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=[::] dest_port=135 pid=944 appname=svchost.exe


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=3736 appname=streamfwd.exe


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2464 appname=svchost.exe


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2472 appname=spoolsv.exe


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2144 appname=svchost.exe


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1544 appname=svchost.exe


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1180 appname=svchost.exe


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=956 appname=svchost.exe


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 10:31:30.075 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=944 appname=svchost.exe


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=[::] dest_port=49697 pid=696 appname=services.exe


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=[::] dest_port=49696 pid=2416 appname=svchost.exe


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=[::] dest_port=49671 pid=2636 appname=spoolsv.exe


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=[::] dest_port=49669 pid=2404 appname=svchost.exe


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=[::] dest_port=49668 pid=708 appname=lsass.exe


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=[::] dest_port=49667 pid=1792 appname=svchost.exe


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=[::] dest_port=49666 pid=1228 appname=svchost.exe


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=[::] dest_port=49665 pid=552 appname=wininit.exe


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=[::] dest_port=3389 pid=400 appname=svchost.exe


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=[::] dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=10.0.1.20 dest_port=139 pid=4 appname=System


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=0.0.0.0 dest_port=49697 pid=696 appname=services.exe


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=0.0.0.0 dest_port=49696 pid=2416 appname=svchost.exe


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2636 appname=spoolsv.exe


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2404 appname=svchost.exe


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1792 appname=svchost.exe


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1228 appname=svchost.exe


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=552 appname=wininit.exe


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=400 appname=svchost.exe


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 10:29:56.288 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=[::] dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=[::] dest_port=49671 pid=2384 appname=svchost.exe


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=[::] dest_port=49669 pid=2516 appname=spoolsv.exe


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=[::] dest_port=49668 pid=2164 appname=svchost.exe


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=[::] dest_port=49667 pid=1596 appname=svchost.exe


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=[::] dest_port=49666 pid=1144 appname=svchost.exe


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=[::] dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=[::] dest_port=3389 pid=940 appname=svchost.exe


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=[::] dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=2628 appname=streamfwd.exe


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2384 appname=svchost.exe


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2516 appname=spoolsv.exe


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2164 appname=svchost.exe


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1596 appname=svchost.exe


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1144 appname=svchost.exe


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=940 appname=svchost.exe


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 10:29:36.177 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=[::] dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=[::] dest_port=49671 pid=2416 appname=svchost.exe


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=[::] dest_port=49669 pid=2432 appname=spoolsv.exe


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=[::] dest_port=49668 pid=2080 appname=svchost.exe


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=[::] dest_port=49667 pid=1640 appname=svchost.exe


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=[::] dest_port=49666 pid=1176 appname=svchost.exe


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=[::] dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=[::] dest_port=49664 pid=688 appname=lsass.exe


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=[::] dest_port=3389 pid=432 appname=svchost.exe


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=[::] dest_port=135 pid=928 appname=svchost.exe


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=2608 appname=streamfwd.exe


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2416 appname=svchost.exe


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2432 appname=spoolsv.exe


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2080 appname=svchost.exe


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1640 appname=svchost.exe


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1176 appname=svchost.exe


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=432 appname=svchost.exe


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 10:27:29.953 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=928 appname=svchost.exe


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=[::] dest_port=49672 pid=660 appname=services.exe


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=[::] dest_port=49671 pid=2436 appname=svchost.exe


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=[::] dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=[::] dest_port=49668 pid=2200 appname=svchost.exe


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=[::] dest_port=49667 pid=1668 appname=svchost.exe


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=[::] dest_port=49666 pid=1136 appname=svchost.exe


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=[::] dest_port=49665 pid=516 appname=wininit.exe


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=[::] dest_port=49664 pid=668 appname=lsass.exe


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=[::] dest_port=3389 pid=744 appname=svchost.exe


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=[::] dest_port=135 pid=908 appname=svchost.exe


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=3676 appname=streamfwd.exe


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=660 appname=services.exe


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2436 appname=svchost.exe


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2200 appname=svchost.exe


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1668 appname=svchost.exe


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1136 appname=svchost.exe


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=516 appname=wininit.exe


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=744 appname=svchost.exe


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 10:26:52.855 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=908 appname=svchost.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::1] dest_port=53 pid=2536 appname=dns.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=64023 pid=3044 appname=dfsrs.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=60234 pid=2176 appname=svchost.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=59631 pid=616 appname=services.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=59611 pid=2900 appname=spoolsv.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=59610 pid=624 appname=lsass.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=49669 pid=624 appname=lsass.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=49668 pid=1908 appname=svchost.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=49667 pid=1652 appname=svchost.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=49666 pid=1216 appname=svchost.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=49664 pid=624 appname=lsass.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=9389 pid=2764 appname=Microsoft.ActiveDirectory.WebServices.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=3389 pid=764 appname=svchost.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=3269 pid=624 appname=lsass.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=3268 pid=624 appname=lsass.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=636 pid=624 appname=lsass.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=593 pid=948 appname=svchost.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=464 pid=624 appname=lsass.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=389 pid=624 appname=lsass.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=[::] dest_port=88 pid=624 appname=lsass.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=10.0.1.6 dest_port=139 pid=4 appname=System


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=0.0.0.0 dest_port=60234 pid=2176 appname=svchost.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=0.0.0.0 dest_port=59631 pid=616 appname=services.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=0.0.0.0 dest_port=59611 pid=2900 appname=spoolsv.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=1908 appname=svchost.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1652 appname=svchost.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1216 appname=svchost.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=0.0.0.0 dest_port=9389 pid=2764 appname=Microsoft.ActiveDirectory.WebServices.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=764 appname=svchost.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=0.0.0.0 dest_port=3269 pid=624 appname=lsass.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=0.0.0.0 dest_port=3268 pid=624 appname=lsass.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=0.0.0.0 dest_port=636 pid=624 appname=lsass.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=0.0.0.0 dest_port=593 pid=948 appname=svchost.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=0.0.0.0 dest_port=464 pid=624 appname=lsass.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=0.0.0.0 dest_port=389 pid=624 appname=lsass.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-09 10:06:20.570 transport=TCP dest_ip=0.0.0.0 dest_port=88 pid=624 appname=lsass.exe


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=[::] dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=[::] dest_port=49671 pid=2376 appname=svchost.exe


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=[::] dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=[::] dest_port=49668 pid=2176 appname=svchost.exe


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=[::] dest_port=49667 pid=1692 appname=svchost.exe


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=[::] dest_port=49666 pid=1148 appname=svchost.exe


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=[::] dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=[::] dest_port=3389 pid=740 appname=svchost.exe


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=[::] dest_port=135 pid=956 appname=svchost.exe


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=1856 appname=streamfwd.exe


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2376 appname=svchost.exe


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2176 appname=svchost.exe


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1692 appname=svchost.exe


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1148 appname=svchost.exe


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=740 appname=svchost.exe


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 09:33:51.318 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=956 appname=svchost.exe


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=[::] dest_port=49673 pid=612 appname=services.exe


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=[::] dest_port=49671 pid=2056 appname=svchost.exe


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=[::] dest_port=49669 pid=2152 appname=spoolsv.exe


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=[::] dest_port=49668 pid=1308 appname=svchost.exe


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=[::] dest_port=49667 pid=1468 appname=svchost.exe


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=[::] dest_port=49666 pid=1060 appname=svchost.exe


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=[::] dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=[::] dest_port=49664 pid=620 appname=lsass.exe


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=[::] dest_port=3389 pid=1020 appname=svchost.exe


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=[::] dest_port=135 pid=848 appname=svchost.exe


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=5068 appname=streamfwd.exe


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=0.0.0.0 dest_port=49673 pid=612 appname=services.exe


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2056 appname=svchost.exe


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2152 appname=spoolsv.exe


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=1308 appname=svchost.exe


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1468 appname=svchost.exe


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1060 appname=svchost.exe


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=1020 appname=svchost.exe


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 09:33:43.874 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=848 appname=svchost.exe


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=[::] dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=[::] dest_port=49671 pid=2444 appname=svchost.exe


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=[::] dest_port=49669 pid=2504 appname=spoolsv.exe


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=[::] dest_port=49668 pid=1620 appname=svchost.exe


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=[::] dest_port=49667 pid=2184 appname=svchost.exe


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=[::] dest_port=49666 pid=1164 appname=svchost.exe


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=[::] dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=[::] dest_port=49664 pid=688 appname=lsass.exe


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=[::] dest_port=3389 pid=824 appname=svchost.exe


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=[::] dest_port=135 pid=920 appname=svchost.exe


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=2252 appname=streamfwd.exe


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2444 appname=svchost.exe


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2504 appname=spoolsv.exe


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=1620 appname=svchost.exe


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=2184 appname=svchost.exe


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1164 appname=svchost.exe


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=824 appname=svchost.exe


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 09:32:53.959 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=920 appname=svchost.exe


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=[::] dest_port=49693 pid=680 appname=services.exe


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=[::] dest_port=49692 pid=2468 appname=svchost.exe


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=[::] dest_port=49689 pid=2600 appname=spoolsv.exe


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=[::] dest_port=49670 pid=1944 appname=svchost.exe


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=[::] dest_port=49669 pid=2308 appname=svchost.exe


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=[::] dest_port=49668 pid=700 appname=lsass.exe


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=[::] dest_port=49666 pid=1240 appname=svchost.exe


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=[::] dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=[::] dest_port=49664 pid=700 appname=lsass.exe


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=[::] dest_port=3389 pid=676 appname=svchost.exe


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=[::] dest_port=135 pid=932 appname=svchost.exe


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=10.0.1.21 dest_port=139 pid=4 appname=System


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=0.0.0.0 dest_port=49693 pid=680 appname=services.exe


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=0.0.0.0 dest_port=49692 pid=2468 appname=svchost.exe


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=0.0.0.0 dest_port=49689 pid=2600 appname=spoolsv.exe


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=0.0.0.0 dest_port=49670 pid=1944 appname=svchost.exe


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2308 appname=svchost.exe


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1240 appname=svchost.exe


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=676 appname=svchost.exe


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 09:32:25.173 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=932 appname=svchost.exe


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=[::] dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=[::] dest_port=49671 pid=2464 appname=svchost.exe


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=[::] dest_port=49669 pid=2472 appname=spoolsv.exe


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=[::] dest_port=49668 pid=2144 appname=svchost.exe


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=[::] dest_port=49667 pid=1544 appname=svchost.exe


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=[::] dest_port=49666 pid=1180 appname=svchost.exe


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=[::] dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=[::] dest_port=3389 pid=956 appname=svchost.exe


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=[::] dest_port=135 pid=944 appname=svchost.exe


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=3736 appname=streamfwd.exe


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2464 appname=svchost.exe


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2472 appname=spoolsv.exe


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2144 appname=svchost.exe


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1544 appname=svchost.exe


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1180 appname=svchost.exe


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=956 appname=svchost.exe


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 09:31:30.114 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=944 appname=svchost.exe


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=[::] dest_port=49697 pid=696 appname=services.exe


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=[::] dest_port=49696 pid=2416 appname=svchost.exe


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=[::] dest_port=49671 pid=2636 appname=spoolsv.exe


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=[::] dest_port=49669 pid=2404 appname=svchost.exe


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=[::] dest_port=49668 pid=708 appname=lsass.exe


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=[::] dest_port=49667 pid=1792 appname=svchost.exe


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=[::] dest_port=49666 pid=1228 appname=svchost.exe


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=[::] dest_port=49665 pid=552 appname=wininit.exe


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=[::] dest_port=3389 pid=400 appname=svchost.exe


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=[::] dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=10.0.1.20 dest_port=139 pid=4 appname=System


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=0.0.0.0 dest_port=49697 pid=696 appname=services.exe


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=0.0.0.0 dest_port=49696 pid=2416 appname=svchost.exe


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2636 appname=spoolsv.exe


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2404 appname=svchost.exe


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1792 appname=svchost.exe


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1228 appname=svchost.exe


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=552 appname=wininit.exe


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=400 appname=svchost.exe


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 09:29:55.817 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=[::] dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=[::] dest_port=49671 pid=2384 appname=svchost.exe


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=[::] dest_port=49669 pid=2516 appname=spoolsv.exe


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=[::] dest_port=49668 pid=2164 appname=svchost.exe


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=[::] dest_port=49667 pid=1596 appname=svchost.exe


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=[::] dest_port=49666 pid=1144 appname=svchost.exe


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=[::] dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=[::] dest_port=3389 pid=940 appname=svchost.exe


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=[::] dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=2628 appname=streamfwd.exe


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2384 appname=svchost.exe


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2516 appname=spoolsv.exe


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2164 appname=svchost.exe


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1596 appname=svchost.exe


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1144 appname=svchost.exe


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=940 appname=svchost.exe


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 09:29:36.364 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=[::] dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=[::] dest_port=49671 pid=2416 appname=svchost.exe


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=[::] dest_port=49669 pid=2432 appname=spoolsv.exe


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=[::] dest_port=49668 pid=2080 appname=svchost.exe


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=[::] dest_port=49667 pid=1640 appname=svchost.exe


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=[::] dest_port=49666 pid=1176 appname=svchost.exe


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=[::] dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=[::] dest_port=49664 pid=688 appname=lsass.exe


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=[::] dest_port=3389 pid=432 appname=svchost.exe


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=[::] dest_port=135 pid=928 appname=svchost.exe


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=2608 appname=streamfwd.exe


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=680 appname=services.exe


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2416 appname=svchost.exe


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2432 appname=spoolsv.exe


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2080 appname=svchost.exe


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1640 appname=svchost.exe


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1176 appname=svchost.exe


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=536 appname=wininit.exe


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=432 appname=svchost.exe


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 09:27:29.899 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=928 appname=svchost.exe


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=[::] dest_port=49672 pid=660 appname=services.exe


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=[::] dest_port=49671 pid=2436 appname=svchost.exe


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=[::] dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=[::] dest_port=49668 pid=2200 appname=svchost.exe


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=[::] dest_port=49667 pid=1668 appname=svchost.exe


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=[::] dest_port=49666 pid=1136 appname=svchost.exe


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=[::] dest_port=49665 pid=516 appname=wininit.exe


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=[::] dest_port=49664 pid=668 appname=lsass.exe


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=[::] dest_port=3389 pid=744 appname=svchost.exe


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=[::] dest_port=135 pid=908 appname=svchost.exe


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=3676 appname=streamfwd.exe


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=660 appname=services.exe


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2436 appname=svchost.exe


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2200 appname=svchost.exe


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1668 appname=svchost.exe


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1136 appname=svchost.exe


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=516 appname=wininit.exe


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=744 appname=svchost.exe


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 09:26:53.019 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=908 appname=svchost.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::1] dest_port=53 pid=2536 appname=dns.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=64023 pid=3044 appname=dfsrs.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=60234 pid=2176 appname=svchost.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=59631 pid=616 appname=services.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=59611 pid=2900 appname=spoolsv.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=59610 pid=624 appname=lsass.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=49669 pid=624 appname=lsass.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=49668 pid=1908 appname=svchost.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=49667 pid=1652 appname=svchost.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=49666 pid=1216 appname=svchost.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=49664 pid=624 appname=lsass.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=9389 pid=2764 appname=Microsoft.ActiveDirectory.WebServices.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=3389 pid=764 appname=svchost.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=3269 pid=624 appname=lsass.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=3268 pid=624 appname=lsass.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=636 pid=624 appname=lsass.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=593 pid=948 appname=svchost.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=464 pid=624 appname=lsass.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=389 pid=624 appname=lsass.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=[::] dest_port=88 pid=624 appname=lsass.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=10.0.1.6 dest_port=139 pid=4 appname=System


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=0.0.0.0 dest_port=60234 pid=2176 appname=svchost.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=0.0.0.0 dest_port=59631 pid=616 appname=services.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=0.0.0.0 dest_port=59611 pid=2900 appname=spoolsv.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=1908 appname=svchost.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1652 appname=svchost.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1216 appname=svchost.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=0.0.0.0 dest_port=9389 pid=2764 appname=Microsoft.ActiveDirectory.WebServices.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=764 appname=svchost.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=0.0.0.0 dest_port=3269 pid=624 appname=lsass.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=0.0.0.0 dest_port=3268 pid=624 appname=lsass.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=0.0.0.0 dest_port=636 pid=624 appname=lsass.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=0.0.0.0 dest_port=593 pid=948 appname=svchost.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=0.0.0.0 dest_port=464 pid=624 appname=lsass.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=0.0.0.0 dest_port=389 pid=624 appname=lsass.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=948 appname=svchost.exe


_raw: 2025-12-09 09:06:20.849 transport=TCP dest_ip=0.0.0.0 dest_port=88 pid=624 appname=lsass.exe


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=[::] dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=[::] dest_port=49671 pid=2376 appname=svchost.exe


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=[::] dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=[::] dest_port=49668 pid=2176 appname=svchost.exe


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=[::] dest_port=49667 pid=1692 appname=svchost.exe


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=[::] dest_port=49666 pid=1148 appname=svchost.exe


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=[::] dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=[::] dest_port=49664 pid=708 appname=lsass.exe


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=[::] dest_port=3389 pid=740 appname=svchost.exe


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=[::] dest_port=135 pid=956 appname=svchost.exe


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=1856 appname=streamfwd.exe


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=0.0.0.0 dest_port=49672 pid=700 appname=services.exe


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2376 appname=svchost.exe


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2488 appname=spoolsv.exe


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=2176 appname=svchost.exe


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1692 appname=svchost.exe


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1148 appname=svchost.exe


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=556 appname=wininit.exe


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=0.0.0.0 dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=0.0.0.0 dest_port=3389 pid=740 appname=svchost.exe


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=0.0.0.0 dest_port=445 pid=4 appname=System


_raw: 2025-12-09 08:33:51.413 transport=TCP dest_ip=0.0.0.0 dest_port=135 pid=956 appname=svchost.exe


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=[::] dest_port=49673 pid=612 appname=services.exe


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=[::] dest_port=49671 pid=2056 appname=svchost.exe


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=[::] dest_port=49669 pid=2152 appname=spoolsv.exe


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=[::] dest_port=49668 pid=1308 appname=svchost.exe


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=[::] dest_port=49667 pid=1468 appname=svchost.exe


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=[::] dest_port=49666 pid=1060 appname=svchost.exe


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=[::] dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=[::] dest_port=49664 pid=620 appname=lsass.exe


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=[::] dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=[::] dest_port=5986 pid=4 appname=System


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=[::] dest_port=5985 pid=4 appname=System


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=[::] dest_port=3389 pid=1020 appname=svchost.exe


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=[::] dest_port=445 pid=4 appname=System


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=[::] dest_port=135 pid=848 appname=svchost.exe


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=127.0.0.1 dest_port=8889 pid=5068 appname=streamfwd.exe


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=0.0.0.0 dest_port=49673 pid=612 appname=services.exe


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=0.0.0.0 dest_port=49671 pid=2056 appname=svchost.exe


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=0.0.0.0 dest_port=49669 pid=2152 appname=spoolsv.exe


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=0.0.0.0 dest_port=49668 pid=1308 appname=svchost.exe


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=0.0.0.0 dest_port=49667 pid=1468 appname=svchost.exe


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=0.0.0.0 dest_port=49666 pid=1060 appname=svchost.exe


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=0.0.0.0 dest_port=49665 pid=480 appname=wininit.exe


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=0.0.0.0 dest_port=47001 pid=4 appname=System


_raw: 2025-12-09 08:33:43.701 transport=TCP dest_ip=0.0.0.0 dest_port=5986 pid=4 appname=System