Edit tour

Windows Analysis Report
ACHAT DE 2 IMMEUBLES.pdf

Overview

General Information

Sample name:	ACHAT DE 2 IMMEUBLES.pdf
Analysis ID:	1554550
MD5:	208e977d2a735133acb0bd4e347deea5
SHA1:	997034e9e36d11984cdf4b5b0dfcd8dc50c61a23
SHA256:	890bbf43f2c9244ffdb71a12beab0a7db68be4d8e897a0197a32dc8d1172dd41
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

Changes security center settings (notifications, updates, antivirus, firewall)

Loading BitLocker PowerShell Module

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64_ra

Acrobat.exe (PID: 6348 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\ACHAT DE 2 IMMEUBLES.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7044 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6148 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1728 --field-trial-handle=1572,i,16750144883042128142,8722937577736343165,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 7500 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://agent.fleetdeck.io/AkKkGEnzwtzPvTHp9XURrp?win MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7756 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1980,i,11466266959600269699,13698241653752948834,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5716 --field-trial-handle=1980,i,11466266959600269699,13698241653752948834,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe (PID: 5404 cmdline: "C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe" MD5: 043ABB0F947E2219446A8FBC8E37049B)

svchost.exe (PID: 6916 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5868 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 5492 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 6268 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2900 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 6220 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 4780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 7300 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

powershell.exe (PID: 3916 cmdline: C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3652 cmdline: C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

fleetdeck_agent_svc.exe (PID: 2672 cmdline: "C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe" MD5: 0915F113042460AD625950FF06CAB044)

cleanup

Sigma Signatures

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow", CommandLine: C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1176, ProcessCommandLine: C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow", ProcessId: 3916, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 656, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6916, ProcessName: svchost.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T16:49:34.068040+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.16	49707	TCP
2024-11-12T16:50:11.925602+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.16	59359	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe

File created: C:\Users\user\AppData\Local\Temp\FleetDeck\FleetDeck Agent Installer.log

Jump to behavior

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:59359 version: TLS 1.2

Source:

Binary string: C:\agent\_work\66\s\build\ship\x86\wixca.pdb source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr

Source: global traffic	TCP traffic: 192.168.2.16:59362 -> 1.1.1.1:853
Source: global traffic	TCP traffic: 192.168.2.16:59376 -> 8.8.8.8:853
Source: global traffic	TCP traffic: 192.168.2.16:59391 -> 9.9.9.9:853

Source: global traffic

TCP traffic: 192.168.2.16:59357 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 18.173.205.127 18.173.205.127
Source: Joe Sandbox View	IP Address: 9.9.9.9 9.9.9.9
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.16:49707
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.16:59359

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.205.127
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.205.127
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.205.127
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.205.127
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.205.127
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.205.127
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.205.127
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.205.127
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.205.127
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.205.127
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.205.127
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.205.127
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.205.127
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FWbpFe63sLSlRyu&MD=XACCHnmc HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /AkKkGEnzwtzPvTHp9XURrp?win HTTP/1.1Host: agent.fleetdeck.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe HTTP/1.1Host: agentinstall.fleetdeck.ioConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FWbpFe63sLSlRyu&MD=XACCHnmc HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: agentinstall.fleetdeck.io
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: agentupdate.fleetdeck.io

Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FA4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/r1.crl
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011DB2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FDE000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FB6000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FE2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2108575127.0000000001148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/r1.crl0
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FEC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/wr2/oQ6nyr8F0m0.crl
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011F8C000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FDE000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FB6000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FE2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2108575127.0000000001148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/wr2/oQ6nyr8F0m0.crl0
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011F76000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FA4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crt
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011DC0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011E85000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crt0
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011CD2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011E90000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011E85000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalG3TLSECCSHA3842020CA1-2.crt0
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FA4000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011F92000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011F8C000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011E85000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011F92000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crthttp://crl3.digicert.com/DigiCertGlobalRootG2.cr
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011DD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011CD2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011E85000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2108575127.0000000001148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0B
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011DD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crthttp://crl3.digicert.com/DigiCertGlobalRootG3.cr
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.00000000120D0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.00000000120D0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.00000000120D0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: powershell.exe, 00000014.00000002.1573627869.000001B5447B4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1773346754.000001E2E08DF000.00000004.00000020.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2108575127.0000000001148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: svchost.exe, 00000002.00000002.2124834771.0000029D3F902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microso
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FEC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.pki.goog/gsr1/gsr1.crl
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011DB2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FDE000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FB6000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FE2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2108575127.0000000001148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pki.goog/gsr1/gsr1.crl0;
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.00000000120D0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.00000000120D0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: svchost.exe, 00000002.00000002.2118362297.0000029D3F80D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011F76000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FA4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crl
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011DC0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011E85000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crl0H
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FA4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crlhttp://crl4.digicert.com/DigiCertG
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011CD2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011E90000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011E85000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalG3TLSECCSHA3842020CA1-2.crl0H
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FA4000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011F92000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011F8C000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011E85000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0=
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011DD0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2108575127.0000000001148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011CD2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011E85000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl0=
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.00000000120D0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.00000000120D0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011F76000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FA4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crl
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011DC0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011E85000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crl0
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011CD2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011E90000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011E85000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalG3TLSECCSHA3842020CA1-2.crl0
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.00000000120D0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.00000000120D0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: 77EC63BDA74BD0D0E0426DC8F80085060.3.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000002.00000002.2124834771.0000029D3F902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/
Source: qmgr.db.2.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.2.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.2.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.2.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000002.00000002.2114342797.0000029D3A2A9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2120901003.0000029D3F85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1921190658.0000029D3F652000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2116548862.0000029D3AB02000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2124834771.0000029D3F8E2000.00000004.00000020.00020000.00000000.sdmp, edb.log.2.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adm5fg7myczym5ugfpmw2lireirq_2024.11.8.0/
Source: qmgr.db.2.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.2.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000002.00000002.2124834771.0000029D3F902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/n.ie1&0
Source: svchost.exe, 00000002.00000002.2122627012.0000029D3F896000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80IO:ID:
Source: qmgr.db.2.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011DB2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FDE000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FB6000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FE2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2108575127.0000000001148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/r1.crt0
Source: fleetdeck_agent_svc.exe, 00000019.00000003.2072693436.00000000120F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/r1.crtGlobalSign
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011C82000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FA4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/wr2.crt
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011F8C000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FDE000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FB6000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FE2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2108575127.0000000001148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/wr2.crt0
Source: powershell.exe, 00000014.00000002.1566127656.000001B53C70B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1758133648.000001E2D8909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011C82000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000003.2072693436.00000000120F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://o.pki.goog/wr2
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011F8C000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FDE000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FB6000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FE2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2108575127.0000000001148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://o.pki.goog/wr20%
Source: fleetdeck_agent_svc.exe, 00000019.00000003.2072693436.00000000120F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://o.pki.goog/wr2Google
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.00000000120D0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011C82000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011F8C000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011CD2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011E85000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2108575127.0000000001148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.00000000120D0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://ocsp.digicert.com0K
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011CD2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011DC0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011E90000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011E85000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0Q
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.00000000120D0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011C82000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comDigiCert
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011C82000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FF2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FA4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.pki.goog/gsr1
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011DB2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FDE000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FB6000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FE2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2108575127.0000000001148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.pki.goog/gsr10)
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011C82000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FF2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FA4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.pki.goog/gsr1http://pki.goog/gsr1/gsr1.crt
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.00000000120D0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.00000000120D0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://ocsp.sectigo.com0G
Source: powershell.exe, 00000016.00000002.1647091230.000001E2C8A53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011C82000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FF2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FA4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pki.goog/gsr1/gsr1.crt
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011DB2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FDE000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FB6000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FE2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2108575127.0000000001148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pki.goog/gsr1/gsr1.crt02
Source: powershell.exe, 00000014.00000002.1527175907.000001B52C84A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1647091230.000001E2C8A53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000014.00000002.1527175907.000001B52C691000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1647091230.000001E2C8891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000014.00000002.1527175907.000001B52C84A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1647091230.000001E2C8A53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: http://wixtoolset.org
Source: powershell.exe, 00000016.00000002.1647091230.000001E2C8A53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: svchost.exe, 00000005.00000002.1367854740.000001A430213000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011CD2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011DC0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011E90000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011E85000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2108575127.0000000001148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: powershell.exe, 00000014.00000002.1577475862.000001B544B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: 2D85F72862B55C4EADD9E66E06947F3D0.3.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: ACHAT DE 2 IMMEUBLES.pdf	String found in binary or memory: https://agent.fleetdeck.io/AkKkGEnzwtzPvTHp9XURrp?win)
Source: FleetDeck Agent Service.log.25.dr	String found in binary or memory: https://agentupdate.fleetdeck.io/latest.json
Source: fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011F76000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://agentupdate.fleetdeck.io/latest.jsonGet
Source: powershell.exe, 00000014.00000002.1527175907.000001B52C691000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1647091230.000001E2C8891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000016.00000002.1647091230.000001E2C8A53000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1775827576.000001E2E0C16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: svchost.exe, 00000005.00000003.1367394368.000001A430257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: 3fcfad2f-1955-4c6e-9738-9bd72cdb9587.tmp.4.dr, 64cfd53e-e575-463b-84c2-00137460116d.tmp.4.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: powershell.exe, 00000016.00000002.1758133648.000001E2D8909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000016.00000002.1758133648.000001E2D8909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000016.00000002.1758133648.000001E2D8909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svchost.exe, 00000005.00000003.1367394368.000001A430257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000005.00000003.1367343416.000001A43025A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1367375799.000001A430243000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1367224029.000001A430262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1368068715.000001A430272000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1367135253.000001A43026E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000005.00000003.1367394368.000001A430257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000005.00000003.1367202905.000001A430267000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000005.00000003.1367090186.000001A430274000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000005.00000003.1367394368.000001A430257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000005.00000003.1367343416.000001A43025A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1367224029.000001A430262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1367974191.000001A43023F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000005.00000003.1367394368.000001A430257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000005.00000003.1367202905.000001A430267000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1367914005.000001A43022B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000005.00000003.1367394368.000001A430257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000005.00000003.1367394368.000001A430257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000005.00000003.1367394368.000001A430257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000005.00000002.1368047251.000001A430265000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1367224029.000001A430262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000005.00000002.1367974191.000001A43023F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000005.00000003.1367394368.000001A430257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000005.00000003.1367224029.000001A430262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000005.00000003.1367070785.000001A430233000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000005.00000002.1367974191.000001A43023F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000005.00000003.1367224029.000001A430262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000005.00000003.1367375799.000001A430243000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1367291917.000001A43025E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 00000005.00000003.1367413574.000001A430230000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1367974191.000001A43023F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000005.00000003.1367394368.000001A430257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000005.00000003.1367375799.000001A430243000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000005.00000003.1367202905.000001A430267000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1367914005.000001A43022B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: qmgr.db.2.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000002.00000003.1202996533.0000029D3F6B2000.00000004.00000800.00020000.00000000.sdmp, edb.log.2.dr, qmgr.db.2.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: powershell.exe, 00000016.00000002.1647091230.000001E2C8A53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000016.00000002.1776057303.000001E2E14F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.co
Source: powershell.exe, 00000014.00000002.1566127656.000001B53C70B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1758133648.000001E2D8909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.00000000120D0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: svchost.exe, 00000005.00000003.1367375799.000001A430243000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000005.00000003.1367375799.000001A430243000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1367998473.000001A430249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000005.00000003.1367375799.000001A430243000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1367998473.000001A430249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000005.00000003.1367311180.000001A43025D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000005.00000002.1367914005.000001A43022B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000005.00000003.1367394368.000001A430257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000005.00000003.1367394368.000001A430257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 59435 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59359 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59361 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59435
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59434
Source: unknown	Network traffic detected: HTTP traffic on port 59422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59392
Source: unknown	Network traffic detected: HTTP traffic on port 59403 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59390
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59409 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59437
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59359
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59436
Source: unknown	Network traffic detected: HTTP traffic on port 59373 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59387 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59402
Source: unknown	Network traffic detected: HTTP traffic on port 59423 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59361
Source: unknown	Network traffic detected: HTTP traffic on port 59437 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59409
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59404
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59403
Source: unknown	Network traffic detected: HTTP traffic on port 59372 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59405
Source: unknown	Network traffic detected: HTTP traffic on port 59420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59374
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59373
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59375
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59372
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59375 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59389
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59422
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59388
Source: unknown	Network traffic detected: HTTP traffic on port 59421 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59421
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59423
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59387
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59420
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59389 -> 443

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:59359 version: TLS 1.2

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_eascx3qe.lg4.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFEC68239E3		20_2_00007FFEC68239E3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFEC69551E0		20_2_00007FFEC69551E0

Source: 40c916d1-c184-48d5-8142-44640afd265f.tmp.13.dr

Static PE information: No import functions for PE file found

Source: 40c916d1-c184-48d5-8142-44640afd265f.tmp.13.dr

Static PE information: Data appended to the last section found

Source: classification engine

Classification label: mal52.evad.winPDF@48/75@7/21

Source: ACHAT DE 2 IMMEUBLES.pdf	Initial sample: https://agent.fleetdeck.io/AkKkGEnzwtzPvTHp9XURrp?win
Source: ACHAT DE 2 IMMEUBLES.pdf	Initial sample: https://agent.fleetdeck.io/akkkgenzwtzpvthp9xurrp?win

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2628:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3920:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4780:120:WilError_03

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-12 10-49-26-603.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\ACHAT DE 2 IMMEUBLES.pdf"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1728 --field-trial-handle=1572,i,16750144883042128142,8722937577736343165,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://agent.fleetdeck.io/AkKkGEnzwtzPvTHp9XURrp?win
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1980,i,11466266959600269699,13698241653752948834,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5716 --field-trial-handle=1980,i,11466266959600269699,13698241653752948834,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe "C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe "C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://agent.fleetdeck.io/AkKkGEnzwtzPvTHp9XURrp?win	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1728 --field-trial-handle=1572,i,16750144883042128142,8722937577736343165,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1980,i,11466266959600269699,13698241653752948834,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5716 --field-trial-handle=1980,i,11466266959600269699,13698241653752948834,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe "C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe"	Jump to behavior

Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll

Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56ad4c5d-b908-4f85-8ff1-7940c29b3bcf}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:

Source: ACHAT DE 2 IMMEUBLES.pdf	Initial sample: PDF keyword /JS count = 0
Source: ACHAT DE 2 IMMEUBLES.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: ACHAT DE 2 IMMEUBLES.pdf

Initial sample: PDF keyword /Page count = 11

Source: ACHAT DE 2 IMMEUBLES.pdf

Initial sample: PDF keyword stream count = 42

Source: ACHAT DE 2 IMMEUBLES.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: ACHAT DE 2 IMMEUBLES.pdf

Initial sample: PDF keyword obj count = 132

Source: 40c916d1-c184-48d5-8142-44640afd265f.tmp.13.dr

Static PE information: real checksum: 0x3e7da7 should be: 0x5ea2

Source: 40c916d1-c184-48d5-8142-44640afd265f.tmp.13.dr	Static PE information: section name: .symtab
Source: Unconfirmed 543027.crdownload.13.dr	Static PE information: section name: .symtab
Source: chromecache_200.14.dr	Static PE information: section name: .symtab

Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Code function: 17_2_11C303C0 push es; ret	17_2_11C3053E
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Code function: 17_2_11C30996 push es; ret	17_2_11C309BA
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Code function: 17_2_11C2FF1F push es; ret	17_2_11C2FF22
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Code function: 17_2_11C305FC push es; ret	17_2_11C30776
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Code function: 17_2_361BFC70 push cs; retf	17_2_361BFC71
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Code function: 17_2_362FFACC push cs; retf	17_2_362FFACD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFEC65946D6 push 8B48FFEEh; iretd	20_2_00007FFEC65946DC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFEC6823348 push FFFFFFD2h; ret	20_2_00007FFEC682334C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFEC6821BAB push esp; iretd	20_2_00007FFEC6821BAC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFEC68268EC pushfd ; ret	20_2_00007FFEC68268F1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFEC6823534 pushad ; retf	20_2_00007FFEC6823535
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFEC6821A11 push ecx; ret	20_2_00007FFEC6821A12
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFEC6820A00 push esp; retf	20_2_00007FFEC6820A01
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFEC6951445 push cs; iretd	20_2_00007FFEC695144F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFEC6CA3CD6 push ebx; retf	20_2_00007FFEC6CA3CEA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00007FFEC64239B1 push ecx; iretd	22_2_00007FFEC64239B4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00007FFEC69348FC pushad ; iretd	22_2_00007FFEC69348FD
Source: C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	Code function: 25_2_00A5F6AC push eax; rep ret	25_2_00A5F6AD
Source: C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	Code function: 25_2_00A5FE04 pushad ; ret	25_2_00A5FE05
Source: C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	Code function: 25_2_00A5FD9C push 8011C3F0h; ret	25_2_00A5FDA1
Source: C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	Code function: 25_2_00A5FD98 push eax; ret	25_2_00A5FD99
Source: C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	Code function: 25_2_11C2DF20 push ebx; ret	25_2_11C2DF39

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: PDF document	LLM: Page contains button: 'Download' Source: 'PDF document'
Source: PDF document	LLM: PDF document contains prominent button: 'download'

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe (copy)	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 543027.crdownload	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\40c916d1-c184-48d5-8142-44640afd265f.tmp	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 200	Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 200
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 200			Jump to dropped file

Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe

File created: C:\Users\user\AppData\Local\Temp\FleetDeck\FleetDeck Agent Installer.log

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8637	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1226	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2219
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7502

Source: C:\Windows\System32\svchost.exe TID: 6888	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1956	Thread sleep count: 8637 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1956	Thread sleep count: 1226 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2060	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1788	Thread sleep count: 2219 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1788	Thread sleep count: 7502 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4348	Thread sleep time: -4611686018427385s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 20_2_00007FFEC61F2C30 GetSystemInfo,

20_2_00007FFEC61F2C30

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 00000016.00000002.1647091230.000001E2C8A53000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: svchost.exe, 00000007.00000002.2105031087.0000022969A24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: svchost.exe, 00000007.00000002.2109059970.0000022969A81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000016.00000002.1647091230.000001E2C8A53000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: svchost.exe, 00000007.00000002.2106815396.0000022969A52000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000esi
Source: svchost.exe, 00000007.00000002.2106815396.0000022969A52000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D: @
Source: svchost.exe, 00000002.00000002.2120379064.0000029D3F853000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2111037670.0000029D3A22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000007.00000002.2102673444.0000022969A02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: svchost.exe, 00000007.00000002.2110745399.0000022969B02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000016.00000002.1647091230.000001E2C8A53000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1847394620.000000000132E000.00000004.00000020.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2108575127.0000000001148000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\sysnative\windowspowershell\v1.0\powershell.exe -command "new-netfirewallrule -displayname 'fleetdeck agent service' -name 'fleetdeck agent service' -direction inbound -program 'c:\program files (x86)\fleetdeck agent\fleetdeck_agent_svc.exe' -action allow"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\sysnative\windowspowershell\v1.0\powershell.exe -command "new-netfirewallrule -displayname 'fleetdeck agent service' -name 'fleetdeck agent service command' -direction inbound -program 'c:\program files (x86)\fleetdeck agent\fleetdeck_agent_svc.exe' -action allow"

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	Queries volume information: C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.3208.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\NetSecurity\Microsoft.Windows.Firewall.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.3208.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\NetSecurity\Microsoft.Windows.Firewall.Commands.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0312~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation

Source: C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Source: svchost.exe, 00000008.00000002.2111451652.000002261F902000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000008.00000002.2111451652.000002261F902000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	1 Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	21 Masquerading	OS Credential Dumping	41 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	24 System Information Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner
C:\Users\user\Downloads\Unconfirmed 543027.crdownload	8%	ReversingLabs
C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe (copy)	8%	ReversingLabs
Chrome Cache Entry: 200	8%	ReversingLabs

Source	Detection	Scanner	Label
http://ocsp.sectigo.com0G	0%	Avira URL Cloud	safe
https://agentupdate.fleetdeck.io/latest.json	0%	Avira URL Cloud	safe
https://agent.fleetdeck.io/AkKkGEnzwtzPvTHp9XURrp?win)	0%	Avira URL Cloud	safe
https://agent.fleetdeck.io/AkKkGEnzwtzPvTHp9XURrp?win	0%	Avira URL Cloud	safe
https://agentinstall.fleetdeck.io/fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	0%	Avira URL Cloud	safe
https://agentupdate.fleetdeck.io/latest.jsonGet	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
agentinstall.fleetdeck.io	18.66.112.116	true	false	unknown
agentupdate.fleetdeck.io	18.239.18.47	true	false	unknown
www.google.com	142.250.186.164	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://agent.fleetdeck.io/AkKkGEnzwtzPvTHp9XURrp?win	false	Avira URL Cloud: safe	unknown
https://agentinstall.fleetdeck.io/fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://pki.goog/gsr1/gsr1.crt	fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011C82000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FF2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FA4000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.pki.goog/gsr1/gsr1.crl0;	fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011DB2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FDE000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FB6000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FE2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2108575127.0000000001148000.00000004.00000020.00020000.00000000.sdmp	false		high
http://i.pki.goog/r1.crtGlobalSign	fleetdeck_agent_svc.exe, 00000019.00000003.2072693436.00000000120F0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.00000000120D0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	false		high
http://ocsp.sectigo.com0	fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.00000000120D0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	false		high
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 00000005.00000003.1367202905.000001A430267000.00000004.00000020.00020000.00000000.sdmp	false		high
https://go.microsoft.co	powershell.exe, 00000016.00000002.1776057303.000001E2E14F3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000005.00000003.1367394368.000001A430257000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 00000005.00000003.1367375799.000001A430243000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.pki.goog/gsr1/gsr1.crl	fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FEC000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.00000000120D0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	false		high
https://contoso.com/License	powershell.exe, 00000016.00000002.1758133648.000001E2D8909000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 00000005.00000003.1367394368.000001A430257000.00000004.00000020.00020000.00000000.sdmp	false		high
http://c.pki.goog/r/r1.crl	fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FA4000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.00000000120D0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	false		high
http://o.pki.goog/wr2Google	fleetdeck_agent_svc.exe, 00000019.00000003.2072693436.00000000120F0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 00000005.00000003.1367394368.000001A430257000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 00000005.00000003.1367343416.000001A43025A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1367375799.000001A430243000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1367224029.000001A430262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1368068715.000001A430272000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1367135253.000001A43026E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000005.00000002.1367914005.000001A43022B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://o.pki.goog/wr20%	fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011F8C000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FDE000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FB6000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FE2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2108575127.0000000001148000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 00000005.00000002.1367974191.000001A43023F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://wixtoolset.org	fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	false		high
http://crl.microso	svchost.exe, 00000002.00000002.2124834771.0000029D3F902000.00000004.00000020.00020000.00000000.sdmp	false		high
http://o.pki.goog/wr2	fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011C82000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000003.2072693436.00000000120F0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://c.pki.goog/r/r1.crl0	fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011DB2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FDE000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FB6000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FE2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2108575127.0000000001148000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000016.00000002.1758133648.000001E2D8909000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000014.00000002.1566127656.000001B53C70B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1758133648.000001E2D8909000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000014.00000002.1527175907.000001B52C691000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1647091230.000001E2C8891000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.bingmapsportal.com	svchost.exe, 00000005.00000002.1367854740.000001A430213000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000005.00000003.1367343416.000001A43025A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1367224029.000001A430262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1367974191.000001A43023F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000005.00000003.1367202905.000001A430267000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1367914005.000001A43022B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://agent.fleetdeck.io/AkKkGEnzwtzPvTHp9XURrp?win)	ACHAT DE 2 IMMEUBLES.pdf	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.00000000120D0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	false		high
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 00000005.00000003.1367394368.000001A430257000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.cloudflare-dns.com	3fcfad2f-1955-4c6e-9738-9bd72cdb9587.tmp.4.dr, 64cfd53e-e575-463b-84c2-00137460116d.tmp.4.dr	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000014.00000002.1566127656.000001B53C70B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1758133648.000001E2D8909000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.3.dr	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000016.00000002.1647091230.000001E2C8A53000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1775827576.000001E2E0C16000.00000004.00000020.00020000.00000000.sdmp	false		high
http://c.pki.goog/wr2/oQ6nyr8F0m0.crl	fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FEC000.00000004.00001000.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.00000000120D0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 00000005.00000003.1367311180.000001A43025D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000016.00000002.1647091230.000001E2C8A53000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000014.00000002.1527175907.000001B52C84A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1647091230.000001E2C8A53000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000016.00000002.1647091230.000001E2C8A53000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 00000005.00000003.1367090186.000001A430274000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 00000005.00000003.1367202905.000001A430267000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1367914005.000001A43022B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 00000005.00000002.1368047251.000001A430265000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1367224029.000001A430262000.00000004.00000020.00020000.00000000.sdmp	false		high
http://i.pki.goog/r1.crt0	fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011DB2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FDE000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FB6000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FE2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2108575127.0000000001148000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000016.00000002.1758133648.000001E2D8909000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000005.00000003.1367375799.000001A430243000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1367998473.000001A430249000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=	svchost.exe, 00000005.00000003.1367375799.000001A430243000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.1367291917.000001A43025E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000002.00000002.2118362297.0000029D3F80D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000005.00000003.1367224029.000001A430262000.00000004.00000020.00020000.00000000.sdmp	false		high
https://agentupdate.fleetdeck.io/latest.jsonGet	fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011F76000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.	powershell.exe, 00000014.00000002.1577475862.000001B544B51000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pki.goog/gsr1/gsr1.crt02	fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011DB2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FDE000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FB6000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FE2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2108575127.0000000001148000.00000004.00000020.00020000.00000000.sdmp	false		high
https://agentupdate.fleetdeck.io/latest.json	FleetDeck Agent Service.log.25.dr	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 00000005.00000003.1367375799.000001A430243000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1367998473.000001A430249000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/	svchost.exe, 00000005.00000003.1367375799.000001A430243000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000005.00000003.1367394368.000001A430257000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/	svchost.exe, 00000005.00000003.1367394368.000001A430257000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 00000005.00000003.1367394368.000001A430257000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000016.00000002.1647091230.000001E2C8A53000.00000004.00000800.00020000.00000000.sdmp	false		high
http://i.pki.goog/wr2.crt0	fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011F8C000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FDE000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FB6000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FE2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2108575127.0000000001148000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000005.00000002.1367974191.000001A43023F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.t	svchost.exe, 00000005.00000003.1367413574.000001A430230000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.1367974191.000001A43023F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.2.dr	false		high
http://i.pki.goog/wr2.crt	fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011C82000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FA4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000005.00000003.1367394368.000001A430257000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000014.00000002.1527175907.000001B52C84A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1647091230.000001E2C8A53000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000002.00000003.1202996533.0000029D3F6B2000.00000004.00000800.00020000.00000000.sdmp, edb.log.2.dr, qmgr.db.2.dr	false		high
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 00000005.00000003.1367394368.000001A430257000.00000004.00000020.00020000.00000000.sdmp	false		high
http://c.pki.goog/wr2/oQ6nyr8F0m0.crl0	fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011F8C000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FDE000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FB6000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2116710774.0000000011FE2000.00000004.00001000.00020000.00000000.sdmp, fleetdeck_agent_svc.exe, 00000019.00000002.2108575127.0000000001148000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=	svchost.exe, 00000005.00000003.1367394368.000001A430257000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000014.00000002.1527175907.000001B52C691000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1647091230.000001E2C8891000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 00000005.00000003.1367224029.000001A430262000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0G	fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.00000000120D0000.00000004.00001000.00020000.00000000.sdmp, fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, 00000011.00000002.1852034867.0000000011E62000.00000004.00001000.00020000.00000000.sdmp, Unconfirmed 543027.crdownload.13.dr, 3566946875.msi.17.dr, chromecache_200.14.dr	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 00000005.00000003.1367394368.000001A430257000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000005.00000003.1367070785.000001A430233000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
18.66.112.116	agentinstall.fleetdeck.io	United States	3	MIT-GATEWAYSUS	false
99.86.102.129	unknown	United States	16509	AMAZON-02US	false
99.86.102.13	unknown	United States	16509	AMAZON-02US	false
18.154.219.78	unknown	United States	16509	AMAZON-02US	false
18.239.18.47	agentupdate.fleetdeck.io	United States	16509	AMAZON-02US	false
8.8.8.8	unknown	United States	15169	GOOGLEUS	false
18.173.205.127	unknown	United States	3	MIT-GATEWAYSUS	false
18.155.173.66	unknown	United States	16509	AMAZON-02US	false
9.9.9.9	unknown	United States	19281	QUAD9-AS-1US	false
99.86.102.89	unknown	United States	16509	AMAZON-02US	false
18.154.219.68	unknown	United States	16509	AMAZON-02US	false
18.154.219.118	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
18.155.173.111	unknown	United States	16509	AMAZON-02US	false
18.155.173.31	unknown	United States	16509	AMAZON-02US	false
18.154.219.19	unknown	United States	16509	AMAZON-02US	false
99.86.102.19	unknown	United States	16509	AMAZON-02US	false
18.155.173.98	unknown	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.16
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554550
Start date and time:	2024-11-12 16:48:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ACHAT DE 2 IMMEUBLES.pdf
Detection:	MAL
Classification:	mal52.evad.winPDF@48/75@7/21
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .pdf

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 184.28.88.176, 184.28.90.27, 52.202.204.11, 23.22.254.206, 52.5.13.197, 54.227.187.23, 162.159.61.3, 172.64.41.3, 172.217.16.131, 142.250.186.142, 74.125.71.84, 34.104.35.123, 2.19.245.44, 88.221.168.141, 2.19.126.149, 2.19.126.143, 23.32.188.153, 95.101.148.135, 142.250.185.227
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, clients2.google.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, update.googleapis.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, accounts.google.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, agent.fleetdeck.io, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, edgedl.me.gvt1.com, armmf.adobe.com, clients.l.google.com, geo2.adobe.com
Execution Graph export aborted for target fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe, PID 5404 because there are no executed function
Execution Graph export aborted for target fleetdeck_agent_svc.exe, PID 2672 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: ACHAT DE 2 IMMEUBLES.pdf

Simulations

Behavior and APIs

Time	Type	Description
10:49:23	API Interceptor	2x Sleep call for process: svchost.exe modified
10:49:37	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
10:49:52	API Interceptor	58x Sleep call for process: powershell.exe modified
10:50:30	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

LLM Input / Output

Input	Output
URL: PDF document Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "Tlchargez le module Fleetdeck", "prominent_button_name": "Download", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: PDF document Model: claude-3-haiku-20240307	```json { "brands": [ "Adobe" ] }
	```json { "brands": [ "Adobe" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
9.9.9.9	allpdfpro.msi	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, XWorm	Browse
	http://assets.website-files.com/65e885e17261602dcdc10dce/663166d899226eaa1af23d4b_kilexi.pdf	Get hash	malicious	Unknown	Browse
	All-in-one Calculation Tool.xlsm	Get hash	malicious	Unknown	Browse
	https://agent.fleetdeck.io/RJhGzP5jyL7Wdj5mXz3b8B?win	Get hash	malicious	Unknown	Browse
	https://agentinstall.fleetdeck.io/fleetdeck-agent-WP1buGiXuuz5gPKfbD5LmX.exe	Get hash	malicious	Unknown	Browse
	AFFAIRE JUDICIAIRE MAILLARD.pdf	Get hash	malicious	Unknown	Browse
18.66.112.116	L1ld - Linkvertise Downloader_PE2-ku1.exe	Get hash	malicious	Unknown	Browse
239.255.255.250	https://t.ly/X0-7Q	Get hash	malicious	Unknown	Browse
	https://www.google.com/url?q=https%3A%2F%2Ftrimmer.to%2FPlfGc&sa=D&sntz=1&usg=AOvVaw1DTVuO2H6PM4yLoWCUd_D9	Get hash	malicious	HTMLPhisher	Browse
	View Pdf Doc_1c854e0875fca437af9ba7046d2f6712.htm	Get hash	malicious	Unknown	Browse
	https://t.ly/Bv1rG	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	scan3762399_arleen@wcctxlaw.com.pdf	Get hash	malicious	Unknown	Browse
	specifications and technical requirements.pdf	Get hash	malicious	HTMLPhisher	Browse
	Daan Berkers Benefits Bonus And Payroll Sign&Review yszlra.pdf	Get hash	malicious	Unknown	Browse
	https://shop.teamtti.store/security/resetpassword.aspx?token=KLO7V1DTDI8XU3KP7GIM4NQLCZKQ9IYSIZTYR9CW4L6KWAXRO9DRJEK74C56QXT4UPP4JW77EWRTQFZBC2BAFHIEPV3PEGFH2CZGV2H2BGMXW1RZN33YVTYNHKPY2S27&mode=new	Get hash	malicious	Unknown	Browse
	https://sites.google.com/worth.com/rfp/home	Get hash	malicious	Unknown	Browse
	http://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion	Get hash	malicious	Unknown	Browse
18.173.205.127	https://protect-us.mimecast.com/s/18vfCQWNWqS1V8BlCPhEHGoqRR	Get hash	malicious	Unknown	Browse
	https://url.avanan.click/v2/r01/___https://www.google.com.sg/zwq?v=7WZIz&fru;why=7WZIz&fru;xf=y&fru;jxwh=7WZIz&fru;xtzwhj=&fru;hi=7WZIz&fru;zfhy=&fru;zwq=frudxdgtqiqntsfuufwjq.htrd.n___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpkZGUwNjUwMWZkNDExNDYwNzZjMDZiMzcyYTg5ZmU1NDo3OjE4NDg6ZGQ5NzQ2M2JkZmJmZTM2MDBmOTU2MjU4MWJhNWIyZDA0ODAzMGI4MzllZGM2ZjkzYmIwZjc2YWQ5ZmQ2MDFhNTpoOlQ6VA#ZWphbWVzQGVuY2luYWNhcGl0YWwuY29t	Get hash	malicious	HTMLPhisher	Browse
	http://bdvonline-personasv.pages.dev/	Get hash	malicious	HTMLPhisher	Browse
	http://bdvonline-personasv.pages.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://f120987.pages.dev/	Get hash	malicious	HTMLPhisher	Browse
	http://secureprotocol1.pages.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://url.avanan.click/v2/r01/___https://www.google.com.sg/zwq?v=7WZIz&why=7WZIz&xf=y&jxwh=7WZIz&xtzwhj=&hi=7WZIz&zfhy=&zwq=frudxdjAjsynslgfxj.htr.fzd.oflfd___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzo5MTJhYWJjZjBjZWQ3YTE3MzliOWViMjI2OTgzNmFjODo3OmFiMTk6M2MwNmNjYzRlYzBhY2Q2MTg4MWQ5YTMxZDNlZTRiZmFmOTNhMjg1NDIzMDkzM2QyMzQ2MzYzY2Q5NzJhMDgxYTpoOlQ6VA#cnlhbkBsaW5jb2xubWFpbmVmY3UuY29t	Get hash	malicious	Unknown	Browse
	ethaertharety.ps1	Get hash	malicious	Unknown	Browse
	hJABTqngKoJnTgLh.ps1	Get hash	malicious	Unknown	Browse
	CHDLSHtWbSRCfzJMtDO.ps1	Get hash	malicious	Unknown	Browse
18.155.173.66	https://bafkreidhlacoadxbpu3r6cirnmkww3kghdzjx5xccwcixr5q4i4k6qtj64.ipfs.dweb.link/#b.kricheli@ikg-wien.at	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
agentupdate.fleetdeck.io	https://agent.fleetdeck.io/RJhGzP5jyL7Wdj5mXz3b8B?win	Get hash	malicious	Unknown	Browse	108.157.194.99
	https://agentinstall.fleetdeck.io/fleetdeck-agent-WP1buGiXuuz5gPKfbD5LmX.exe	Get hash	malicious	Unknown	Browse	18.172.112.93
	AFFAIRE JUDICIAIRE MAILLARD.pdf	Get hash	malicious	Unknown	Browse	18.172.112.93
agentinstall.fleetdeck.io	Full Litigation File.pdf	Get hash	malicious	Unknown	Browse	3.160.150.68
	https://agent.fleetdeck.io/RJhGzP5jyL7Wdj5mXz3b8B?win	Get hash	malicious	Unknown	Browse	3.160.150.68
	https://agentinstall.fleetdeck.io/fleetdeck-agent-WP1buGiXuuz5gPKfbD5LmX.exe	Get hash	malicious	Unknown	Browse	65.9.86.76
	AFFAIRE JUDICIAIRE MAILLARD.pdf	Get hash	malicious	Unknown	Browse	65.9.86.99
bg.microsoft.map.fastly.net	https://t.ly/X0-7Q	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://t.ly/Bv1rG	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	199.232.214.172
	scan3762399_arleen@wcctxlaw.com.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	specifications and technical requirements.pdf	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	Daan Berkers Benefits Bonus And Payroll Sign&Review yszlra.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://shop.teamtti.store/security/resetpassword.aspx?token=KLO7V1DTDI8XU3KP7GIM4NQLCZKQ9IYSIZTYR9CW4L6KWAXRO9DRJEK74C56QXT4UPP4JW77EWRTQFZBC2BAFHIEPV3PEGFH2CZGV2H2BGMXW1RZN33YVTYNHKPY2S27&mode=new	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://account-service.fr/PSTPNL/postal1	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://funpresc.pe.gov.br/976823/secure-redirect/index.html#Francois.barbeau+staples.ca%20%20https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse	199.232.214.172
	E7X-XIZ5.eml	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://webconference.protected-forms.com/XaGFyNXNiVFNRd1VaOFBwaER2WW5KM1V1S1NLSzZZZDhjN3NKVC9oV2lCRlNRWmVpbVlYY0JzbS81VUd0czRzOHNRWWNGSndpSCtxMm15d3h6SnFIS0VpR2NHcHh2MWo5Nm1wM3lROHdlakpZdnVWYUpHZDJ2LzVyV1ljWjZuK2pHcTByTjRWRm1IRnpPSnVmUFI0TVk2dHN5L1Yxdko0Y01WeHZYck1iM2tvc3l4YVdqSlZabWl2Y0ZwLzQtLVZvU05jS1M1U0FEQjZZeHUtLUw3WXM4dkFWa2t2YTRLMXJEYTRIbGc9PQ==?cid=2270944670	Get hash	malicious	KnowBe4	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MIT-GATEWAYSUS	https://shop.teamtti.store/security/resetpassword.aspx?token=KLO7V1DTDI8XU3KP7GIM4NQLCZKQ9IYSIZTYR9CW4L6KWAXRO9DRJEK74C56QXT4UPP4JW77EWRTQFZBC2BAFHIEPV3PEGFH2CZGV2H2BGMXW1RZN33YVTYNHKPY2S27&mode=new	Get hash	malicious	Unknown	Browse	18.66.122.106
	https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse	18.66.102.51
	https://funpresc.pe.gov.br/976823/secure-redirect/index.html#Francois.barbeau+staples.ca%20%20https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse	18.66.102.51
	http://track.reviewmgr.com/ls/click?upn=u001.W5y-2Fhe84rCuLxXDO470nfuKD2Iz98QeQpE-2BkxRR0H-2BqB5cDKklujIJ5FLru7QrAASOSa17vR-2FSCLVAx4lWyy5Q-3D-3DkaP7_Yp4ydSxZWNatis3HtI6bBrJjg57JYwT6kbyY2f89Z-2FBhxNJZyCBl9w6yXNV0YfiKUAGjaILaAN0mF43Ydvv3aAXjCPBMrYvHXhqj-2F90M8IWSluK-2FDr0h4-2FIbAXpExZIWOjtRSKBCrpvm-2BHKZd6Q2itOPvvv8Wh8uHJq1rbQgzA8HMkQB3GP7mtgLvWqf-2F2SUC5eKSSwLqPZnnofRHoc7cSU1xfupfl4il6cb3-2BSKrTYe1odI0Jq1F3XJEtoagDhZ-2B0poPJjuweCyekPO2Y39xfy8FdwLLvVUma4NgVhDhlM-3D	Get hash	malicious	Unknown	Browse	18.173.205.2
	2024101221359RemitanceAdvice..pdf	Get hash	malicious	HTMLPhisher	Browse	18.66.112.58
	https://customization-connect-7617.my.salesforce.com/sfc/p/d3000000Byor/a/d300000000RR/ML8ajzoJU6aJIvGQZGZ6S9rRHpaD1XaytKzcNGEf56g	Get hash	malicious	HTMLPhisher	Browse	18.66.112.35
	https://certify-compte.fr/CETEL	Get hash	malicious	Unknown	Browse	18.66.121.135
	https://secure_sharing0documentpreview.wesendit.com/dl/UXseZ6Oj8WT8cWxHq/bXVoYW1hZC5hZGkubXVxcmlAc2ltZWRhcmJ5LmNvbQ	Get hash	malicious	Unknown	Browse	18.66.102.51
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.161.170.14
	https://protect-us.mimecast.com/s/18vfCQWNWqS1V8BlCPhEHGoqRR	Get hash	malicious	Unknown	Browse	18.66.102.85
AMAZON-02US	linux_x64_agent_no_crypt.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	https://www.google.com/url?q=https%3A%2F%2Ftrimmer.to%2FPlfGc&sa=D&sntz=1&usg=AOvVaw1DTVuO2H6PM4yLoWCUd_D9	Get hash	malicious	HTMLPhisher	Browse	3.75.10.80
	https://t.ly/Bv1rG	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.5
	Swift MT1O3 Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	Order.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse	13.225.78.35
	https://funpresc.pe.gov.br/976823/secure-redirect/index.html#Francois.barbeau+staples.ca%20%20https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse	13.225.78.35
	https://cx.surveysensum.com/d6xqqwvx	Get hash	malicious	HTMLPhisher	Browse	3.5.146.47
	http://track.reviewmgr.com/ls/click?upn=u001.W5y-2Fhe84rCuLxXDO470nfuKD2Iz98QeQpE-2BkxRR0H-2BqB5cDKklujIJ5FLru7QrAASOSa17vR-2FSCLVAx4lWyy5Q-3D-3DkaP7_Yp4ydSxZWNatis3HtI6bBrJjg57JYwT6kbyY2f89Z-2FBhxNJZyCBl9w6yXNV0YfiKUAGjaILaAN0mF43Ydvv3aAXjCPBMrYvHXhqj-2F90M8IWSluK-2FDr0h4-2FIbAXpExZIWOjtRSKBCrpvm-2BHKZd6Q2itOPvvv8Wh8uHJq1rbQgzA8HMkQB3GP7mtgLvWqf-2F2SUC5eKSSwLqPZnnofRHoc7cSU1xfupfl4il6cb3-2BSKrTYe1odI0Jq1F3XJEtoagDhZ-2B0poPJjuweCyekPO2Y39xfy8FdwLLvVUma4NgVhDhlM-3D	Get hash	malicious	Unknown	Browse	13.224.189.101
	https://t.ly/SjDNX	Get hash	malicious	Python Stealer, Braodo	Browse	185.166.143.50
AMAZON-02US	linux_x64_agent_no_crypt.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	https://www.google.com/url?q=https%3A%2F%2Ftrimmer.to%2FPlfGc&sa=D&sntz=1&usg=AOvVaw1DTVuO2H6PM4yLoWCUd_D9	Get hash	malicious	HTMLPhisher	Browse	3.75.10.80
	https://t.ly/Bv1rG	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.5
	Swift MT1O3 Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	Order.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse	13.225.78.35
	https://funpresc.pe.gov.br/976823/secure-redirect/index.html#Francois.barbeau+staples.ca%20%20https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse	13.225.78.35
	https://cx.surveysensum.com/d6xqqwvx	Get hash	malicious	HTMLPhisher	Browse	3.5.146.47
	http://track.reviewmgr.com/ls/click?upn=u001.W5y-2Fhe84rCuLxXDO470nfuKD2Iz98QeQpE-2BkxRR0H-2BqB5cDKklujIJ5FLru7QrAASOSa17vR-2FSCLVAx4lWyy5Q-3D-3DkaP7_Yp4ydSxZWNatis3HtI6bBrJjg57JYwT6kbyY2f89Z-2FBhxNJZyCBl9w6yXNV0YfiKUAGjaILaAN0mF43Ydvv3aAXjCPBMrYvHXhqj-2F90M8IWSluK-2FDr0h4-2FIbAXpExZIWOjtRSKBCrpvm-2BHKZd6Q2itOPvvv8Wh8uHJq1rbQgzA8HMkQB3GP7mtgLvWqf-2F2SUC5eKSSwLqPZnnofRHoc7cSU1xfupfl4il6cb3-2BSKrTYe1odI0Jq1F3XJEtoagDhZ-2B0poPJjuweCyekPO2Y39xfy8FdwLLvVUma4NgVhDhlM-3D	Get hash	malicious	Unknown	Browse	13.224.189.101
	https://t.ly/SjDNX	Get hash	malicious	Python Stealer, Braodo	Browse	185.166.143.50
AMAZON-02US	linux_x64_agent_no_crypt.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	https://www.google.com/url?q=https%3A%2F%2Ftrimmer.to%2FPlfGc&sa=D&sntz=1&usg=AOvVaw1DTVuO2H6PM4yLoWCUd_D9	Get hash	malicious	HTMLPhisher	Browse	3.75.10.80
	https://t.ly/Bv1rG	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.5
	Swift MT1O3 Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	Order.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse	13.225.78.35
	https://funpresc.pe.gov.br/976823/secure-redirect/index.html#Francois.barbeau+staples.ca%20%20https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse	13.225.78.35
	https://cx.surveysensum.com/d6xqqwvx	Get hash	malicious	HTMLPhisher	Browse	3.5.146.47
	http://track.reviewmgr.com/ls/click?upn=u001.W5y-2Fhe84rCuLxXDO470nfuKD2Iz98QeQpE-2BkxRR0H-2BqB5cDKklujIJ5FLru7QrAASOSa17vR-2FSCLVAx4lWyy5Q-3D-3DkaP7_Yp4ydSxZWNatis3HtI6bBrJjg57JYwT6kbyY2f89Z-2FBhxNJZyCBl9w6yXNV0YfiKUAGjaILaAN0mF43Ydvv3aAXjCPBMrYvHXhqj-2F90M8IWSluK-2FDr0h4-2FIbAXpExZIWOjtRSKBCrpvm-2BHKZd6Q2itOPvvv8Wh8uHJq1rbQgzA8HMkQB3GP7mtgLvWqf-2F2SUC5eKSSwLqPZnnofRHoc7cSU1xfupfl4il6cb3-2BSKrTYe1odI0Jq1F3XJEtoagDhZ-2B0poPJjuweCyekPO2Y39xfy8FdwLLvVUma4NgVhDhlM-3D	Get hash	malicious	Unknown	Browse	13.224.189.101
	https://t.ly/SjDNX	Get hash	malicious	Python Stealer, Braodo	Browse	185.166.143.50

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://t.ly/X0-7Q	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200
	View Pdf Doc_1c854e0875fca437af9ba7046d2f6712.htm	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200
	https://t.ly/Bv1rG	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	20.109.210.53 172.202.163.200
	Daan Berkers Benefits Bonus And Payroll Sign&Review yszlra.pdf	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200
	https://shop.teamtti.store/security/resetpassword.aspx?token=KLO7V1DTDI8XU3KP7GIM4NQLCZKQ9IYSIZTYR9CW4L6KWAXRO9DRJEK74C56QXT4UPP4JW77EWRTQFZBC2BAFHIEPV3PEGFH2CZGV2H2BGMXW1RZN33YVTYNHKPY2S27&mode=new	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.109.210.53 172.202.163.200
	https://account-service.fr/PSTPNL/postal1	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200
	https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse	20.109.210.53 172.202.163.200
	https://funpresc.pe.gov.br/976823/secure-redirect/index.html#Francois.barbeau+staples.ca%20%20https://mazans.com/WEB-ID-5672849687924/zerobot?email=Francois.barbeau@staples.ca	Get hash	malicious	Captcha Phish	Browse	20.109.210.53 172.202.163.200
	E7X-XIZ5.eml	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8168146122341279
Encrypted:	false
SSDEEP:	3072:yJjAgNE4Pj5vHcjTcyBP9UjaaQ/ka4qWK3LpbL:QAgN8nj/ka4YLpbL
MD5:	F741707EA55D5E66EB519AF076EE06E0
SHA1:	F72B09D5247530E41DFC4889274A6A2146764CF8
SHA-256:	C83A5EF5C5AC0941048D5FD7893F7CC81A42C267DD31DA5D58EDB97C5757C675
SHA-512:	4945E893811EB90FAFDAD4C342A35347CC10CDE7ED25860B1A4FF42BB599F9073B97FD4975A16BD2310EF53735B9196D4133777B4549648B830020002D58737F
Malicious:	false
Preview:	..6.........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................d6d6.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xdf235e6a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7864830315263002
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/6vDfi5Wy10MctJ+t9ka4XQ0/Ykr3g16L2UPkLk+kyt4eCu3uZB:razaovh7uka4Es2U1RFNp3pvHzrHBHz
MD5:	DA0612F6D43722990D84F1C49BFD897A
SHA1:	DBC3B9A7AD26F04B28F79AF3B97D7835E8DF9C34
SHA-256:	B233F0F4489CB9C357321544B0BE5A1E20F6C0485FA1425EB3E6BB4D8774EF2E
SHA-512:	9E30816BF1BE32E2FE706865E7F4988138C932771F22546BAC20D3EC4A597990DA162B99CA76C713CF8EBDFFECA54BBDEF38D517218F6F2566C731D6955C449B
Malicious:	false
Preview:	.#^j... ...............X\...;...{......................0.z...... ...{...1...\|..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................@Wv..1...\|);.....................1...\|)..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08165617798288673
Encrypted:	false
SSDEEP:	3:rsmUYeFzAboMsjv/Ss/IGYZX/b/yA6lAllSdLvl+/rS56/:AmUzFzOJsYz/7OAQN0e
MD5:	3FFB353F669138A0B2E632BF16937F29
SHA1:	6526AEB48D3BDFB00870CB94B609D32A784C8D95
SHA-256:	1C13471B466A873D7DECED140EBF63388A01977979115DC844FBB2021094B0CF
SHA-512:	E79AB678F7CD3CBF69C41D4E97F671BDACD24AB2F3DFDF095FDB3A76E5AF6D42D35A5EE5F5ACC9A33FA1F783D0B73789B4E48126ABF91960150204572382FF2A
Malicious:	false
Preview:	.......................................;...{...1...\|).. ...{........... ...{... ...{..#.#.. ...{.\|.....................1...\|).........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.17977888357478
Encrypted:	false
SSDEEP:	6:HUJyi+q2PRN2nKuAl9OmbnIFUt8YUqZmw+YUGVkwORN2nKuAl9OmbjLJ:++vaHAahFUt8k/+EV5JHAaSJ
MD5:	B9D846E6668E6160CD9A33937F86B431
SHA1:	28A808BDAC4F5CFB9AA5899F8D35CA55B534597A
SHA-256:	88D3B13D7B7CD154FD5445698F1A06470E161E11B99C2EA7085EFE007F0C93EB
SHA-512:	63A5F5026ACFDEB17EE8CC516E9CDCEF076028AD39E68EC5D645921B24148B24DC35496BCBB0AF1A98B5B0957C5ADF867E883CB0083D59240581A967911ECFFF
Malicious:	false
Preview:	2024/11/12-10:49:25.148 1b7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/12-10:49:25.150 1b7c Recovering log #3.2024/11/12-10:49:25.150 1b7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.17977888357478
Encrypted:	false
SSDEEP:	6:HUJyi+q2PRN2nKuAl9OmbnIFUt8YUqZmw+YUGVkwORN2nKuAl9OmbjLJ:++vaHAahFUt8k/+EV5JHAaSJ
MD5:	B9D846E6668E6160CD9A33937F86B431
SHA1:	28A808BDAC4F5CFB9AA5899F8D35CA55B534597A
SHA-256:	88D3B13D7B7CD154FD5445698F1A06470E161E11B99C2EA7085EFE007F0C93EB
SHA-512:	63A5F5026ACFDEB17EE8CC516E9CDCEF076028AD39E68EC5D645921B24148B24DC35496BCBB0AF1A98B5B0957C5ADF867E883CB0083D59240581A967911ECFFF
Malicious:	false
Preview:	2024/11/12-10:49:25.148 1b7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/12-10:49:25.150 1b7c Recovering log #3.2024/11/12-10:49:25.150 1b7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.172570929115302
Encrypted:	false
SSDEEP:	6:HUdiOq2PRN2nKuAl9Ombzo2jMGIFUt8YUdgaZmw+YUdgmkwORN2nKuAl9Ombzo23:ovaHAa8uFUt8h/+75JHAa8RJ
MD5:	85976308D666FB86C7BE34148DD479AE
SHA1:	0E17C8DCC2F42947FDBC933008517AD909F36A38
SHA-256:	4C001F06278EB7D874F86B9195A693DBEFD990F3C7494A355DB14FD9F2B13546
SHA-512:	F69DA9EAE05A00F4C233281B15571030D5EAE286A5BFE6B7F230F9941E0126FF308FBF30FD9D5F9608595A0BDBD6552E9D3A3B1F5770810CA5F9E119FEAC31FF
Malicious:	false
Preview:	2024/11/12-10:49:25.046 18f4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/11/12-10:49:25.050 18f4 Recovering log #3.2024/11/12-10:49:25.050 18f4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.172570929115302
Encrypted:	false
SSDEEP:	6:HUdiOq2PRN2nKuAl9Ombzo2jMGIFUt8YUdgaZmw+YUdgmkwORN2nKuAl9Ombzo23:ovaHAa8uFUt8h/+75JHAa8RJ
MD5:	85976308D666FB86C7BE34148DD479AE
SHA1:	0E17C8DCC2F42947FDBC933008517AD909F36A38
SHA-256:	4C001F06278EB7D874F86B9195A693DBEFD990F3C7494A355DB14FD9F2B13546
SHA-512:	F69DA9EAE05A00F4C233281B15571030D5EAE286A5BFE6B7F230F9941E0126FF308FBF30FD9D5F9608595A0BDBD6552E9D3A3B1F5770810CA5F9E119FEAC31FF
Malicious:	false
Preview:	2024/11/12-10:49:25.046 18f4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/11/12-10:49:25.050 18f4 Recovering log #3.2024/11/12-10:49:25.050 18f4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3fcfad2f-1955-4c6e-9738-9bd72cdb9587.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.953858338552356
Encrypted:	false
SSDEEP:	12:YHO8sq/WLksBdOg2H9caq3QYiubrP7E4T3y:YXsRJdMHM3QYhbz7nby
MD5:	4C313FE514B5F4E7E89329630909F8DC
SHA1:	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
SHA-256:	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
SHA-512:	1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\64cfd53e-e575-463b-84c2-00137460116d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	403
Entropy (8bit):	4.992096327471009
Encrypted:	false
SSDEEP:	12:YHO8sq8SrsBdOg2Hpi2caq3QYiubrP7E4T3y:YXsuMdMHpiJ3QYhbz7nby
MD5:	F831058309F92ACC9E465E848198CCDF
SHA1:	73532AB53997BC3A2CA3E695A5CABC689D8A5B22
SHA-256:	D4C1D33C50CA331D748EE3C75DC979D1BFDDE07E4472F55302E7720BC9622DFF
SHA-512:	B20883DED98E5262C6173D19419E6B2AF2A93D50F7592D44E656D628727277BCCE06DB111327028965A02AC06C73A82989080A5D766258D944BB6BFEE877DED9
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13375986570836662","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":234859},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.953858338552356
Encrypted:	false
SSDEEP:	12:YHO8sq/WLksBdOg2H9caq3QYiubrP7E4T3y:YXsRJdMHM3QYhbz7nby
MD5:	4C313FE514B5F4E7E89329630909F8DC
SHA1:	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
SHA-256:	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
SHA-512:	1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF42f933.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.953858338552356
Encrypted:	false
SSDEEP:	12:YHO8sq/WLksBdOg2H9caq3QYiubrP7E4T3y:YXsRJdMHM3QYhbz7nby
MD5:	4C313FE514B5F4E7E89329630909F8DC
SHA1:	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
SHA-256:	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
SHA-512:	1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.234204044419307
Encrypted:	false
SSDEEP:	96:OLSw0bSwIAnrRqLX2rSq1OUxu/0OZ0xRBTxekN8xef8oec:OLT0bTIeYa51Ogu/0OZARBT8kN88f8oD
MD5:	07AC80AA0397C82B946AA927E8EA50D1
SHA1:	5C7A8575E214F182D7ED6FD6A63DBD37CDBFB7B3
SHA-256:	0196B2AD2289A69A4EF067436C2A2C194AB076781AAE4C9F0157690F8C6C6455
SHA-512:	DE3B1A9A631C70CF2043A4B7D154249B729EBBD0E6D1D716FA9F608673825164474C875CCAE2CF81C6E2D12787CF4525350D1E184E4C8F52C643BAC6F473E37D
Malicious:	false
Preview:	*...#................version.1..namespace-e...o................next-map-id.1.Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/.0y.S_r................next-map-id.2.Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/.16.X:r................next-map-id.3.Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/.2.P.@o................next-map-id.4.Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/.346.+^...............Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/....^...............Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/..?&a...............Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/_...a...............Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/...o................next-map-id.5.Pnamespace-07af9ee9_2076_4f12_94b5_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.220985080047748
Encrypted:	false
SSDEEP:	6:HUdq2PRN2nKuAl9OmbzNMxIFUt8YUvZmw+YUbDkwORN2nKuAl9OmbzNMFLJ:svaHAa8jFUt8h/+RD5JHAa84J
MD5:	FFDC50733438CDD23A6198BE30CC3846
SHA1:	BACE4D10329BE42F3C70F7ACB2086554D5514E1A
SHA-256:	54293A01A8A6130CFF76A8D4547EB691B30F78472521867D34F7EB240CF05619
SHA-512:	3D6D70AB84052B1DF749E24BDA8459AD1C39C3D53EEE837876BED8E1B3CBB2C55A7CCE318B34FCC7520DE685A715CF95DC685F260C44C88F027052DE4CE989BA
Malicious:	false
Preview:	2024/11/12-10:49:25.176 18f4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/11/12-10:49:25.177 18f4 Recovering log #3.2024/11/12-10:49:25.179 18f4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.220985080047748
Encrypted:	false
SSDEEP:	6:HUdq2PRN2nKuAl9OmbzNMxIFUt8YUvZmw+YUbDkwORN2nKuAl9OmbzNMFLJ:svaHAa8jFUt8h/+RD5JHAa84J
MD5:	FFDC50733438CDD23A6198BE30CC3846
SHA1:	BACE4D10329BE42F3C70F7ACB2086554D5514E1A
SHA-256:	54293A01A8A6130CFF76A8D4547EB691B30F78472521867D34F7EB240CF05619
SHA-512:	3D6D70AB84052B1DF749E24BDA8459AD1C39C3D53EEE837876BED8E1B3CBB2C55A7CCE318B34FCC7520DE685A715CF95DC685F260C44C88F027052DE4CE989BA
Malicious:	false
Preview:	2024/11/12-10:49:25.176 18f4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/11/12-10:49:25.177 18f4 Recovering log #3.2024/11/12-10:49:25.179 18f4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241112154928Z-171.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	3.952600166254118
Encrypted:	false
SSDEEP:	1536:iBfV2FRUY/yIkyCoPPe4v44FoiMSfsbR0kw:C9tYhPPe4v44FiSfu6
MD5:	0FBB408DFA4ECC684FE21216B76221AE
SHA1:	051395CFDD0C4A6B99C4F218542619EDDFB3A159
SHA-256:	E6D224D742ADC3DA8C95DF1B24DACE4522B42B1C23B792090CC35304235C5122
SHA-512:	8691886FA8E1F8AD9FBC77A6D7FC9407BD0E64A33EE5F9E0C3ED243AAE65FCA6AD6E8082C235A5C2043D00526FD89ADE244E0DA33CBE5952511B92C7110AB203
Malicious:	false
Preview:	BMV.......6...(...k...h..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................@I................../:............................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.291927920232006
Encrypted:	false
SSDEEP:	192:vedRBvVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:veBci5H5FY+EUUUTTcHqFzqFP
MD5:	A4D5FECEFE05F21D6F81ACF4D9A788CF
SHA1:	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C
SHA-256:	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
SHA-512:	FF106C6B9E1EA4B1F3E3AB01FAEA21BA24A885E63DDF0C36EB0A8C3C89A9430FE676039C076C50D7C46DC4E809F6A7E35A4BFED64D9033FEBD6121AC547AA5E9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	16928
Entropy (8bit):	1.213010580135891
Encrypted:	false
SSDEEP:	24:7+tsWGnqLi+zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm6:7MEqLmFTIF3XmHjBoGGR+jMz+LhU
MD5:	ED96A6290265CE47C3BE6EEE053C4F42
SHA1:	F2B0AB470769F7A0BF37FB085CDDD687528DF0B7
SHA-256:	72E0437BE64505DA7B4FC0417D1C221972613B711841067E12DAB434C39DFDA5
SHA-512:	9F9A2327E7CB953AA4EFD579ED9CF784BC5541A853F92BFDD035BB314194E09C717BD854FF1195F276E98A1587FB1245F1825DB26F335C5C49734CA78E1C600C
Malicious:	false
Preview:	.... .c.....t.bJ........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7282048283587708
Encrypted:	false
SSDEEP:	3:kkFklc+/tfllXlE/HT8koltNNX8RolJuRdxLlGB9lQRYwpDdt:kKF+/eT85dNMa8RdWBwRd
MD5:	DB38EAF5CDD5E9A720B621780539CE53
SHA1:	1B006F423A5C2B21399492B4C7CFF5AEB1D3AD1E
SHA-256:	719699E915DF0CDB34905E0310540118DDC182E5A9D859555F57C7ED31A11CCA
SHA-512:	416B3DABFD13DE03D9C7F8F834F6C6967821E02A4188D927F9E92E1D5F1B2DBBDDF802A68340C7182215EA16EC6ED090870D385FAD65EE639196E28168FFADDE
Malicious:	false
Preview:	p...... ........o2hz.5..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2441017925653752
Encrypted:	false
SSDEEP:	6:kKvwL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:XwiDImsLNkPlE99SNxAhUe/3
MD5:	AD8E6E14F8DD5F7C1A3F46E9D3A751FD
SHA1:	D459313A2F5EC6E526C3C3223427ADAC4E3F5977
SHA-256:	D2CC645FC676A372F336783390CE8C763827E1E59D58BB6B9CE42F7781C1A876
SHA-512:	C287C5EC0EA0642F02EDAEDD07F2ECFAC60D9770143DCE3ACCF494DEAE05E97E0EAC0440A34AE698C54618AD4689AFBF2BAE7991F77F4100042CCEA4013DA7E9
Malicious:	false
Preview:	p...... ........w...5..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.377176480294431
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcHYs7HJQ5IRR4UhUR0Yk8oAvJM3g98kUwPeUkwRe9:YvXKXA7HeWRuUhUgPGMbLUkee9
MD5:	B8A58FC11920CB88E98298DDC7D426F7
SHA1:	17DB083574FA439F18B25876552F64DC29244927
SHA-256:	818D283788D679C2E973B8E540B9F47C6B75B6FBD4CE6175874ADC808D47F831
SHA-512:	21588AD1CAA7A4C847C797075F29A15476BB260997D2ED30C2F1757901454915698BC44BD057927E4B8D98085D28EBD9B6EB1BCA00A4AFE171308830435C1B28
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"09b78569-3d5b-4c59-8f07-e3966f068ba1","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1731600691538,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.326756457631171
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcHYs7HJQ5IRR4UhUR0Yk8oAvJfBoTfXpnrPeUkwRe9:YvXKXA7HeWRuUhUgPGWTfXcUkee9
MD5:	A0DE6AD05AA3995E9F67366925F39455
SHA1:	38B462C10E7EDE31BB83E7E8A10B9D45C0326CE5
SHA-256:	97FE40060F819B793851B61DC7EFE21406628950FBF4E4C075FB65DA10C6052C
SHA-512:	10EA05CED4540030408FC01276D18687605DC3AD2C8564D9A688E306F32F594CFE3E3CB4CB77DC1888EFF69B5443CEA97E1E961A2B0A80C2400D89F5C609B535
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"09b78569-3d5b-4c59-8f07-e3966f068ba1","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1731600691538,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3054626718580495
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcHYs7HJQ5IRR4UhUR0Yk8oAvJfBD2G6UpnrPeUkwRe9:YvXKXA7HeWRuUhUgPGR22cUkee9
MD5:	A671007A653464BE81C45461FF943677
SHA1:	A48C3DF0AC3C36DEDA5F052E6CAE3513270E4C79
SHA-256:	56FBC75B5337A7E9CF173310DEEF79AFBE5D3E62DCA0EBDA32AA4CD9569E7C12
SHA-512:	62B911A0434419B4E8E0353D85FA7D03903ED1FCABB4CB4ABD31DB46D7FF84D95C69BC203A414EF67476E79F7ADB1A175076C9956485278B05AEABF049D54BA5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"09b78569-3d5b-4c59-8f07-e3966f068ba1","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1731600691538,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.36604133899954
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcHYs7HJQ5IRR4UhUR0Yk8oAvJfPmwrPeUkwRe9:YvXKXA7HeWRuUhUgPGH56Ukee9
MD5:	DD7853C06665D6C888034FEF9E84C798
SHA1:	920B9640EB8940ED5D556721D93E6F02407C9162
SHA-256:	711B3D293CBE8EF0B347A861FD86778A8B9921309B1E0E49F9C25EE8BAF22454
SHA-512:	2BFF1118B164DEA1A74213417D54C3AACE2588D5B432AD2DCCE811662434C55340F6B3958F95F131C54F9374DCAC4BB9616EA2B2E05394E536A71DAF13FF221A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"09b78569-3d5b-4c59-8f07-e3966f068ba1","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1731600691538,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.692997012174197
Encrypted:	false
SSDEEP:	24:Yv6XA/UgUpLgE9cQx8LennAvzBvkn0RCmK8czOCCSR:YvJUgUhgy6SAFv5Ah8cv/R
MD5:	6A9B0ED9A98B23511FF47D9CB08F59E3
SHA1:	A0C9A0A1F35E4981762DAB4A6B947716725F6D76
SHA-256:	B90888CC287FBC1922DD92469044FC0ABF70CE9A083A1C9FB8FE75D809E463E5
SHA-512:	D77D479432B1361EB076E4669B87B7FB279859F6388D8D4173137292C5E41CC5F5C2EFB559A38CAB7DF9B4DA72E50804F3C4DDA40407D1B9C7C8E5ACE1EB6CB0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"09b78569-3d5b-4c59-8f07-e3966f068ba1","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1731600691538,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1122
Entropy (8bit):	5.685453405986572
Encrypted:	false
SSDEEP:	24:Yv6XA/UgOVLgEwcp06ybnAvz7xHn0RCmK8czOCYHfl8zdBc:YvJUgOFgSNycJUAh8cvYHL
MD5:	7C28BA11192375061880C5E1969C5B13
SHA1:	ED1EB311E24050AB0F035F895F5E90B933B86C62
SHA-256:	A5297694AA85D11C16E8FD78A8919299823A1C3F40D7C82688BCD65025C000AB
SHA-512:	31384DC7C917CC1B87C01144499DD39AB70864D5A10A05C04ED29ED318FCADB4BC96CD610DE618E8BB475F4F45BD091783E6D579BF3942DC0E25872BC049571E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"09b78569-3d5b-4c59-8f07-e3966f068ba1","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1731600691538,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_0","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"1aad653c-ef44-43f7-be1c-3a2ba2cf2cfc","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuIFBERiBmb3JtcyAmIGFncmVlbWVudHMuIn0sInRjY

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.318709153894709
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcHYs7HJQ5IRR4UhUR0Yk8oAvJfQ1rPeUkwRe9:YvXKXA7HeWRuUhUgPGY16Ukee9
MD5:	24B0365A1E9E4431FA0C3CC606A7BE04
SHA1:	068EDC18C4D75A5A2FD0767E7CCFCC79DCBB7F37
SHA-256:	6D04370E5ABDEEC003841628D9E2A6891C66083181B3F16F8AA7609F7B2CBD0B
SHA-512:	A5392DA75749FB52C58F61EBEE650A35F7EE4D3DD3BED0CC7F8A9413DD514721B4AF70CABC6A3D82B7429586D50D252B6D19535A55DD7BA8ED3CEDACFA419E54
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"09b78569-3d5b-4c59-8f07-e3966f068ba1","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1731600691538,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1102
Entropy (8bit):	5.675116999595142
Encrypted:	false
SSDEEP:	24:Yv6XA/Ugb2LgErcXWl7y0nAvzIBcSJCBViVc:YvJUgbogH47yfkB5kVR
MD5:	53A345D0937F2A2F8C57128DDD454923
SHA1:	2B34B349D442FBC958B049220D9CC5FCE217EB17
SHA-256:	432357CFE98AE4D299B386BDD1DEAE7A949A28662D6AF768DA9828DA5E344F8D
SHA-512:	33219DBD68139354543E7718E0C0C54367A278F92C340BA55EF3A6CE7FC1306D2436FAD2AE5D733D7414AE122301163C535C120C2948B29FC0A83B4B200ED94A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"09b78569-3d5b-4c59-8f07-e3966f068ba1","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1731600691538,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_1","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"533ab5eb-b236-4889-89a5-ac002261d71e","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkVkaXRQREZSZHJBcHBGdWxsIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTRweCIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTJweCIsImZvbnRfc3R5bGUiOiItMSJ9LCJ0aXRsZSI6bnVsbCwiZGVzY3JpcHRpb24iOiJFZGl0IHRleHQsIGltYWdlcywgcGFnZXMsIGFuZCBtb3JlLiJ9LCJ0Y2F0SWQiOm51bGx9","da

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	5.702040256330531
Encrypted:	false
SSDEEP:	24:Yv6XA/UgXKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5c:YvJUgXEgqprtrS5OZjSlwTmAfSKG
MD5:	E34C67D6DA3AE5E17129F0CABCA0D2E7
SHA1:	8782E5027733351923FA5549075167E1636AC8E1
SHA-256:	AAB1FD021DD8DA72C20C089636A99D68C77F93EE68D271C75A729451EDED2B8F
SHA-512:	8A59DE15808846E6B4BA50EE6C644FD009FBF4D072F200ADF37ABA11DE6B15EB9D35DF00804B55F42EAFC2DCC1BA8E86152BDB433274D418783782B5130A7F33
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"09b78569-3d5b-4c59-8f07-e3966f068ba1","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1731600691538,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.322326430447189
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcHYs7HJQ5IRR4UhUR0Yk8oAvJfYdPeUkwRe9:YvXKXA7HeWRuUhUgPGg8Ukee9
MD5:	141E963089E6843EA12C6C6465ED20BB
SHA1:	6BA0F5B963BF00C7BEF0147D916A47088B8E8580
SHA-256:	AD441ADEC55D16AE7A4F27954FDCBFB3B0EC8FA27A7FEA716F925E9DD40A055F
SHA-512:	E813EB213D465B4FB4E7D94C79D48B6C19BFF2897BD39039ED6D26841C75D6097EA8B9EA4074C6A8A42563F8930FE8DF914E363AD912AD327BDB46D94B75A3DE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"09b78569-3d5b-4c59-8f07-e3966f068ba1","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1731600691538,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.308769874228639
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcHYs7HJQ5IRR4UhUR0Yk8oAvJf+dPeUkwRe9:YvXKXA7HeWRuUhUgPG28Ukee9
MD5:	743FBD6880E8A1565A68510DE2DBF1B2
SHA1:	6C64D4D72BD796E756FBBBA67BFD2E4354C17000
SHA-256:	E105A279637564A08B5BAAAD6238EE0E3017616BA6EBDF0D54A0B6900D2F9036
SHA-512:	AABBA9145FD6BD60B3DA01CDAFB48AA8DE4BFA40015B2709487C9AEFC5F56AD1D6DBA6005A7239D0816EAAAE9C7BD2FA2FFA43894E721A6274EEE043C00299C3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"09b78569-3d5b-4c59-8f07-e3966f068ba1","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1731600691538,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.305720081863683
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcHYs7HJQ5IRR4UhUR0Yk8oAvJfbPtdPeUkwRe9:YvXKXA7HeWRuUhUgPGDV8Ukee9
MD5:	8D0CC861D3FA2164BAFDF0E810E71A7B
SHA1:	F8F76DC6258DF6C468A970027BF506ECD1F719B3
SHA-256:	9C94D08F79FA3914E91A1036401CED929E80ACFFF9EC8944C7D509392B636553
SHA-512:	D0C89602A826DEA8A3496DE94A4257931506D0C2B33B68B2CC3E3791C5CCFDDFE384F6FF6074C3CBBF115D469220386D90472A5E2F8EB7959E48C620B60B4798
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"09b78569-3d5b-4c59-8f07-e3966f068ba1","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1731600691538,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.3090960527047
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcHYs7HJQ5IRR4UhUR0Yk8oAvJf21rPeUkwRe9:YvXKXA7HeWRuUhUgPG+16Ukee9
MD5:	A76EFF18D509075BF4A335603A5591A1
SHA1:	8A24DBF8BD046F5F13FC7FDD5C89A3F10A69C135
SHA-256:	820A5A633E625BCC12286B6F3D70361D41D63464549F20D9130AAD4AD25F53B1
SHA-512:	B9CF0F533F807A4B22F6101113C0658EF2FD69F118777C60F4DE4E786FF7D22A0016C977A566C6BD0F7B80B7C44E4E1B409CECB2C63B4B3BC71CC5681A88C8AD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"09b78569-3d5b-4c59-8f07-e3966f068ba1","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1731600691538,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66694399817957
Encrypted:	false
SSDEEP:	24:Yv6XA/UgQamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSR:YvJUgWBgkDMUJUAh8cvMR
MD5:	132099653282456400E44B3A453EE2D9
SHA1:	A023EEB87D5F81B194888A144D80EC6FD17F84B5
SHA-256:	83D772AAD872CA1FC4CD437AF7639356D5E8CBEB1F1CB02CC7DE4A1FC139EFBE
SHA-512:	27232E89AF76128D2BE8A1BC84FB7A8ACE5F775DC8A0067FC341F4BB0C6962C5BA4096ACEADDDB26CDDD71CCCC4B3E62DA33C526D471598CA9B675FF3D4AA372
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"09b78569-3d5b-4c59-8f07-e3966f068ba1","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1731600691538,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.285844760118029
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHcHYs7HJQ5IRR4UhUR0Yk8oAvJfshHHrPeUkwRe9:YvXKXA7HeWRuUhUgPGUUUkee9
MD5:	C2A4A1C2FCBF9FC62DC29D53E40706E7
SHA1:	DC3773E692F2FB91D32B0D3E1B1EF7D4CF6183DD
SHA-256:	091D5C840DE43E40891F616AD31ADE98196F0653B0E8A2CC6FD8BB1290B9A593
SHA-512:	465FA6FF9C7C866D7B4AA139092021E90D2D8E47F0678C6F48F421AEE7B340A2DF283E008730131468F0FFD4449090A11A098F834D3427234FD8A327434C270D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"09b78569-3d5b-4c59-8f07-e3966f068ba1","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1731600691538,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.375096937511591
Encrypted:	false
SSDEEP:	12:YvXKXA7HeWRuUhUgPGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWY:Yv6XA/Ug/168CgEXX5kcIfANhR
MD5:	46220A56ADCA123A4F9A872A546E4FFE
SHA1:	9A0A5586463EB6DE6A231101DC2967A9E56631FC
SHA-256:	B9C960D6762FC7ECB068A093F72530969E5540D64F15F01B0C0BA051AD27FB32
SHA-512:	3E081FFAD9F9882DC59EB80A112DAC024797BEEB1C18C0369AA4763E97868757F87F6951CC6ADC3C5094D382355CAC9B7EF432A666A49F8A3BE565522B1FF3AC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"09b78569-3d5b-4c59-8f07-e3966f068ba1","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1731600691538,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1731426571572}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2817
Entropy (8bit):	5.141441814823445
Encrypted:	false
SSDEEP:	48:YhfU2DJaHLO8A0KGkJ0VOuV9vPTGir9/j:2fbMLxA0KXJ0VbzvPTf/j
MD5:	B725938C48C76986B0A9AE04B02DB4E6
SHA1:	EA0721083C7F452D041192F0A68C0ACEA0E30CC1
SHA-256:	64365215AA2A1C75CEE4BFFDD3FA5D7B20F05F56DE4BCB5D3B782C6BEC4A212A
SHA-512:	0870E4BE811150A94709C6472E281F7A920F088ADE833141C5B92C6989F13AB0D15CC334761555F16706997E13B0FE56025C8DF84125A6471F65A32B838320A0
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"ed2d1e50e22bad57521670b77b6958bf","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1122,"ts":1731426570000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"84b0afec639c4f1541934d2702130892","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1731426570000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"721dd51378524101805c9bb98ebf70d4","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1731426570000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"68c0a9ef0a62f7c5345d243bbb82f804","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1731426570000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"ef97b29501a0d8ebb10aa2bbb0e0fcfa","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1102,"ts":1731426570000},{"id":"Edit_InApp_Aug2020","info":{"dg":"ee3b75b41b64a113c9da5208a1c97487","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9877423821363064
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs67Y9QmQ6QeYRxIcLESiAiegRxF:TVl2GL7ms67YXtrRcI8u
MD5:	3E93462E6EB28FAA1AA74061848C0967
SHA1:	C238F52AE36E79B65D76B723EA9C3ECAE94FF425
SHA-256:	B5F5122932E9149646B69342CCF122B3B1BD971F4B1AA1F33BB729FE1A887057
SHA-512:	99305CEFD7297F601F350DF9AF427F477C381EE36257E104AC8C25D212BC22EC689DE77C116FF43E8EB276AB60E06068485C5630601024E64BA7A184B98D844B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3432368263473031
Encrypted:	false
SSDEEP:	24:7+tZASY9QmQ6QeYRx7cLESiAi0mY9QuWqLBx/XYKQvGJF7urszK:7MZlYXtrWcI8KYoqll2GL7mszK
MD5:	76FDF38F4A3355E4A843C1832B6DBFEA
SHA1:	0AD68B513AE3936554E5169D1577275AB5167934
SHA-256:	962F7DB9B3E9E0717614A0F93F737A82BF4B6F840A43284AFCA13C350CE2D0C4
SHA-512:	D5F49874BE0085337D3F5049917F2DA342F18E293D0771292C807E553FA29796642B0992E8066CD612F7024B76BEB775F577BD7A62A3EEB9314840C8103119D1
Malicious:	false
Preview:	.... .c......I.j......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgGPizTek07pg3hlPcwH/Mo204tdOYyu:6a6TZ44ADEqizTX07C3h0wcOK
MD5:	D78DAC984AB5D8168A79B7DD6F1C5638
SHA1:	EE17B7082B12FB34241843BEC91CA91178E7E509
SHA-256:	12AAAA210930337E9F7D4366B50855C4D838767DD1194C8A123CFF4C5971BAB5
SHA-512:	E5E06A3622E5A46D70D195B6932B4E9BEE366A059FE1EC081F04D02BF1321B6CBD7820E7F0D68331466A460E26727CB69F591118C113CBC3DE687061E202BC9B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Temp\3566946875.msi

Download File

Process:	C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: FleetDeck Agent, Author: FleetDeck Inc, Keywords: Installer, Comments: This installer database contains the logic and data required to install FleetDeck Agent., Template: Intel;1033, Revision Number: {35EF1994-7396-43D2-98D9-F43E60065D5C}, Create Time/Date: Wed Apr 20 18:55:02 2022, Last Saved Time/Date: Wed Apr 20 18:55:02 2022, Number of Pages: 500, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
Category:	dropped
Size (bytes):	2236416
Entropy (8bit):	7.940343765557896
Encrypted:	false
SSDEEP:	49152:YIv98QsI6PnpqMlONbXZbzXtm7nSLcD+1GwDGrk7aEhP7bj6cnUIA2:fvyQInTgNbXZnkwcK50k7Ltj6zO
MD5:	04381CF1F12960AE2D748820670C4337
SHA1:	69A4CF6EF4871644FC7EEAAE4720E0D8275A215C
SHA-256:	E82143029872C041297EC16187E17BB835504D8EE0E7BAAE9CDB413CD8480421
SHA-512:	B115A10A60321B691BB60C7D257CE528B7B294CEC07EEC9E2BD0FD623F4762020C7CE3CBC51483DC35AF3A1E552E5CA8E83F9E509CAA9FD43F0C4F30719135A5
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FleetDeck\FleetDeck Agent Installer.log

Download File

Process:	C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	93
Entropy (8bit):	4.811168925892289
Encrypted:	false
SSDEEP:	3:tRrUgfCygBFGYiRhRIWESuRvXfzncbv:HUaCygBFZDrRvYL
MD5:	78E08990F42292EC49B40255D47E7C3F
SHA1:	549F571F47567E691DBAF146FC4F1FD72C7FE26E
SHA-256:	29F9F60F0D7716308FDABC5DD749E8EFC84A05D880D478632CF077ABD19E6059
SHA-512:	55A7F424CD13B13DF0270AE44D7C9ADFE84DB264459C9F1DB8B28EB323F6872B734B0237ED5AFA6AB52A6421AA689C9432F4CFBAFBCC7287B631B13083B2A0BE
Malicious:	false
Preview:	2024/11/12 15:50:27 Installed Agent with deployment ID: 4eeec85a-3a74-48b6-812c-793a13d49781.

C:\Users\user\AppData\Local\Temp\MSI1ef26.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.505069684106714
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8qKPlvdNOcflH:Qw946cPbiOxDlbYnuRKtKPYcflH
MD5:	C9490750839F3AB4C7A5D74F0352B76F
SHA1:	5DB57EC6CF1EFC551E1A6C47D877AC6728B17B68
SHA-256:	699B2C0458759409980E0D0F889B269EFA9C73FB685C6D774162BC9FEB2B37FA
SHA-512:	CDDCE9F7743FB4C3E124B8FF20D33C29D40E3677DA848B9E2D34B887C0B3E4C6E454A2A700F9D018861DFB35B912B1ED37916CD5764E705FABA9E6DFD3FE9CEB
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.2./.1.1./.2.0.2.4. . .1.0.:.4.9.:.3.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-12 10-49-26-603.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.353642815103214
Encrypted:	false
SSDEEP:	384:tbxtsuP+XEWJJQbnR8L31M7HeltV+KYm3wsa2KjF4ODkr/O8r2IUHUHMWwEyZRN2:aPL
MD5:	91F06491552FC977E9E8AF47786EE7C1
SHA1:	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
SHA-256:	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
SHA-512:	A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
Malicious:	false
Preview:	SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.356300723377981
Encrypted:	false
SSDEEP:	384:kj5uR35/qB4i2N65T4Q116OY07qr+LtcBdK6h2BLfr9L1eXeOl79tmtI1EaVZgIs:zna
MD5:	7C37B62E994A31C579EC588ECC1F282E
SHA1:	052ECD304A562CB7CD8B8A9480918215CD5A362E
SHA-256:	90762600CE542B367A49FAB082B7694B791572A61CFD8442A46F1A5CDDA2FA41
SHA-512:	05AC0D81D99F12F38CC4E63A8C6D8703D780BFE6F579C57BA8CC8EF98DBB22F0F34305235B154D69E02C76D630EB21D8A45CC11743C3DC72BA3BEA6A4F737EBB
Malicious:	false
Preview:	SessionID=cce4b9b3-4e0d-4cd1-9c89-ab7d72d237b0.1731426566616 Timestamp=2024-11-12T10:49:26:616-0500 ThreadID=7052 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=cce4b9b3-4e0d-4cd1-9c89-ab7d72d237b0.1731426566616 Timestamp=2024-11-12T10:49:26:618-0500 ThreadID=7052 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=cce4b9b3-4e0d-4cd1-9c89-ab7d72d237b0.1731426566616 Timestamp=2024-11-12T10:49:26:618-0500 ThreadID=7052 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=cce4b9b3-4e0d-4cd1-9c89-ab7d72d237b0.1731426566616 Timestamp=2024-11-12T10:49:26:618-0500 ThreadID=7052 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=cce4b9b3-4e0d-4cd1-9c89-ab7d72d237b0.1731426566616 Timestamp=2024-11-12T10:49:26:618-0500 ThreadID=7052 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.419935403930374
Encrypted:	false
SSDEEP:	192:0cbgIhPcbocbAIlncb2cbwI/RcbNcbQIVvcb8cboI1zcbJ:fhWlA/TVS1o
MD5:	DAAE16A564338256CDFD115BB967664B
SHA1:	14F0215D027BF8359A673055FEB6136023B9980C
SHA-256:	60A31E0B39FC6C7C6B01E4C7D6247EDAC57A554A68FF0BBB3D8A68CC4B3A2AAF
SHA-512:	9EA028C90690F20FAB448722B01FA94B34D293E407F14495E7E401799D6D12AAE5F4BF1E462E4D178B79BB33B4DFC80CDD077F45306B0E396EF3C7C75A4AE5C1
Malicious:	false
Preview:	06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : *************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***********************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\033a6058-2a33-4f6b-8f35-0f070c8c983c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWLaGZ4ZwYIGNPS:RB3mlind9i4ufFXpAXkrfUs0kWLaGZ48
MD5:	1D64D25345DD73F100517644279994E6
SHA1:	DE807F82098D469302955DCBE1A963CD6E887737
SHA-256:	0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
SHA-512:	C0A37437F84B4895A7566E278046CFD50558AD84120CA0BD2EAD2259CA7A30BD67F0BDC4C043D73257773C607259A64B6F6AE4987C8B43BB47241F3C78EB9416
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\67d9f3de-2d1a-46ac-8751-d8b37cec46a4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7ouWLaGZ7wYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVuWLaGZ7wZGk3mlind9i4ufFXpAXkru
MD5:	13F55292D0735B9ABD4259B225D210FC
SHA1:	810CC5D545BFA11D2825F6E1DFA69176794DA7EC
SHA-256:	8C3FFEA68963D108599E8C5AE20DE6E9C473BF33197A03A9A7DDCD0F25A6C7F6
SHA-512:	4F54EDA9EB61172A5243DAA718CFF42A0BF079CC0FA7BE3553CC8B79772763B49F530DD6B54A9D595C4F46B8416ADF7D5C8DAD58FC43A5C651258E669DC375DA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\6e7a1a27-8aaa-436f-b48a-9d3e6fd2ac0e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\72344b21-24f5-40d3-88e1-371b746cd576.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 12 14:49:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.976408270707615
Encrypted:	false
SSDEEP:	48:83yd4T8XwMHtidAKZdA1FehwiZUklqehKlxy+3:83hOw2rxy
MD5:	404E26AEC27ED7239443193F4DF6301C
SHA1:	F4E876EABD00281F5DAC22DD1C39CC67E6D1EBF7
SHA-256:	673215C416A965C60C636DC62491E9CE9A16FEB9BF43C06A77F28CA1CCF3290A
SHA-512:	25C97A95343D4E2A52F5175D8D5533114B4C0D6961EB7932CB0C3495F7B82958E7FFB18CE5CB13D76C7371C5855D4CF12F15A691ACAE1A2D781BCC1A1B020774
Malicious:	false
Preview:	L..................F.@.. ...$+.,....u..x.5..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IlY"~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY0~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY0~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY0~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VlY2~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........dP.\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 12 14:49:34 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9923873830872894
Encrypted:	false
SSDEEP:	48:8HTyd4T8XwMHtidAKZdA1seh/iZUkAQkqehZlxy+2:8zhOwQ9Q4xy
MD5:	DCA6A7BFF59D32A7DA5AA13765703EE2
SHA1:	1E87788D103B5EA29C15A09285A871D38C51238E
SHA-256:	0E14F65FD9CAC7CD68DF286A6D8609277124FF855FDAA4E56864CD6B1435E4E5
SHA-512:	C007530DE221E7612CA4AFB378D84C1D047D05DC4DDB281204099E1B46F4FEAB644EEB1B9F616385936C70D3B64B860A05CBB8178219EC57B08F34243B213C7B
Malicious:	false
Preview:	L..................F.@.. ...$+.,....zX.x.5..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IlY"~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY0~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY0~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY0~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VlY2~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........dP.\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.002732687405429
Encrypted:	false
SSDEEP:	48:83d4T8XwAHtidAKZdA14meh7sFiZUkmgqeh7sPlxy+BX:8uOwYnfxy
MD5:	63A200119A5B3AD3673425E83098DFA0
SHA1:	035B38A3AB70FA8571CCD133BFE73BDC15E6126D
SHA-256:	93DD0C020D60DD7C0EC34DB8C5D9CAAA69049F54253352477C094A5CE01006CB
SHA-512:	D2C4613CED4A25F42201F8281681414BB42CD5D3FDF29415D01F9B1DF853B3AF9479838C1F8E0D1FC4DD2A80E09A1780AE911C85C8B5D36133608DE731359A97
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IlY"~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY0~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY0~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY0~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........dP.\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 12 14:49:34 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9917194954955986
Encrypted:	false
SSDEEP:	48:8Wyd4T8XwMHtidAKZdA1TehDiZUkwqehNlxy+R:8WhOwLVxy
MD5:	D941B8F1A34A9C30A7689805137EA2DA
SHA1:	E7B814F6DA372F521C67D76D672C4086515D5F6C
SHA-256:	3750EB69F33175D9CC07466870AFB205CD6D2C47B2DDC64F1BA9D8E5A2623124
SHA-512:	B40B784814936156AD76781A8D1DFA5FA3A5803F47EB836927A3953C93E19CD76E8329E501BA612C5F1F6899CDDD9C41EED6E9EE86ECA098B0EAA742CF3BC5A7
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......x.5..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IlY"~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY0~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY0~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY0~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VlY2~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........dP.\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 12 14:49:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9789499301828957
Encrypted:	false
SSDEEP:	48:8iyd4T8XwMHtidAKZdA1dehBiZUk1W1qehblxy+C:8ihOwr9hxy
MD5:	91B85011F64359659F239DFB447CD33F
SHA1:	A292E0212374059F29C29967F24BEE985600E4A5
SHA-256:	836585DDA11F537640E4DB99F88A4130C1F6A2DDC0CE2F0B3AEE776DAC9ADBD1
SHA-512:	A95EB5346B6A850F7A83A380E655F50EF4BEFE7181FC677DB989BE9E0258C07E014869399607134A5E98CF83CE6F19C0FC359DBF8EE52027A1AB5CB2422E7F9C
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......x.5..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IlY"~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY0~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY0~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY0~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VlY2~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........dP.\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 12 14:49:34 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.985553270459291
Encrypted:	false
SSDEEP:	48:8zyd4T8XwMHtidAKZdA1duTeehOuTbbiZUk5OjqehOuTbFlxy+yT+:8zhOwvTfTbxWOvTbfxy7T
MD5:	65114AE7A71C2C608976C77EDA4D81B5
SHA1:	91CA73F4DAB32AD7755A5A30004CB4F9DEB8B818
SHA-256:	C28A9A16773D4A1623B40780651B6AE209B107AECC37D8A0741F738F9BB0502F
SHA-512:	9DF26146C112B9022303A615CCE151B1E54C5CADDBC822A7F1169CA6E0D51404877BCE875A826F874AF6C91C295CE4C5E94228AA563606FDB3A14EF1A371D836
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....D.x.5..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IlY"~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY0~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY0~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY0~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VlY2~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........dP.\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Downloads\40c916d1-c184-48d5-8142-44640afd265f.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	16860
Entropy (8bit):	5.920233701519612
Encrypted:	false
SSDEEP:	384:+llnSGnyDHk0R2rOmxVN4LspQN2GWxF1Nugu3Gv:+oH7R/KpDHF1/z
MD5:	FF6045D3ED6F52F576C25A13FEB945F5
SHA1:	F7FBE6C09357FB6C2EC98FDCCD63CA87918A52BF
SHA-256:	7702688DADCB507CF5B42EB6DE84D574463171888C691EEC182C12BA7FF8980C
SHA-512:	71DFE0C47D51BD5C72AD0BB8EBC65E10C5DDBCC265FE358CE8524E169A733EBE3F43DECCF4A36B68C3CB9587350690CCE3E75AFF9D00D3939F71B8B3C0390CC8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........=...................#..................@.......................... A......}>...@...................................>.......@...............>.8*....>.:................................................... ................................text...`........................... ..`.rdata..............................@..@.data....1&.......#.................@....idata........>.......<.............@....reloc..:.....>.......<.............@..B.symtab.......?.......=................B.rsrc.........@.......=.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\Unconfirmed 543027.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4081208
Entropy (8bit):	7.421421330971419
Encrypted:	false
SSDEEP:	98304:sdPsh/HLvyQInTgNbXZnkwcK50k7Ltj6zOny:s9sBW0ZXtkzK5tZe
MD5:	043ABB0F947E2219446A8FBC8E37049B
SHA1:	DCB579040FA9CA0DC5CAD8384EEFD44843C64BBD
SHA-256:	9E7275E75B3AF20EA579A8DD8E9A74EA6F30F141D58A1222F0EE87B335B90A69
SHA-512:	8CDE3A6C00FC2BA141CC160C0401822A8826D9BCFA18585ED5429A5A14D301D189BB5A17F6AD8BEC3369E6728CA15694F6FF9E132F27A114D4A12EFB496388CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........=...................#..................@.......................... A......}>...@...................................>.......@...............>.8*....>.:................................................... ................................text...`........................... ..`.rdata..............................@..@.data....1&.......#.................@....idata........>.......<.............@....reloc..:.....>.......<.............@..B.symtab.......?.......=................B.rsrc.........@.......=.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4081208
Entropy (8bit):	7.421421330971419
Encrypted:	false
SSDEEP:	98304:sdPsh/HLvyQInTgNbXZnkwcK50k7Ltj6zOny:s9sBW0ZXtkzK5tZe
MD5:	043ABB0F947E2219446A8FBC8E37049B
SHA1:	DCB579040FA9CA0DC5CAD8384EEFD44843C64BBD
SHA-256:	9E7275E75B3AF20EA579A8DD8E9A74EA6F30F141D58A1222F0EE87B335B90A69
SHA-512:	8CDE3A6C00FC2BA141CC160C0401822A8826D9BCFA18585ED5429A5A14D301D189BB5A17F6AD8BEC3369E6728CA15694F6FF9E132F27A114D4A12EFB496388CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........=...................#..................@.......................... A......}>...@...................................>.......@...............>.8*....>.:................................................... ................................text...`........................... ..`.rdata..............................@..@.data....1&.......#.................@....idata........>.......<.............@....reloc..:.....>.......<.............@..B.symtab.......?.......=................B.rsrc.........@.......=.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	4926
Entropy (8bit):	3.246736027046273
Encrypted:	false
SSDEEP:	48:FaqdF78F7B+AAHdKoqKFxcxkFiF7KaqdF7e+AAHdKoqKFxcxkFO:cEOB+AAsoJjykePEe+AAsoJjykY
MD5:	3C376554038586224D09956B07A61C38
SHA1:	C6CF5A0E849E2A69F9B934F9E59B98BECFF472DE
SHA-256:	000D1BCCC4BA6D96ECD483B15CE22B756C7B491F478384143E5FC25889CBDA48
SHA-512:	51DF99CEAEAFB19AFB9F3F6FCAC4056CD374A019EE353C298513A3A1941217922AFEA70A9CC66400310E480D64C74FBD073CF2151AF1B2207AB049C25C49F988
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. F.r.i. .. O.c.t. .. 0.6. .. 2.0.2.3. .1.1.:.3.5.:.2.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	20980
Entropy (8bit):	5.618747941892891
Encrypted:	false
SSDEEP:	384:O5WdBrkaeN+JApvqXhr7Fve+RnR5Qw0YjJZr5m3xWYs4SHGPq9TE:O2rfJAYXhrNe+RRqjwJWB3/8Y
MD5:	1F6A7B76CF1FF6CC3582ECDD49D31C8E
SHA1:	3FD83285EDAA970BA2DB8FADBF78DAF4F0BD98F7
SHA-256:	7B7307C2E3E0BAE365CF959DF467A74D015DB71C71359E805B444A895E519D58
SHA-512:	5581631F8D2814CA863A4AD2CC563A1FBFA5137801045123C9E3859F99A4744201D337955665E7C338AB595F7E51A058FAFE9EBC5F2F1BB9DADCCFC905C29423
Malicious:	false
Preview:	@...e...........#.......\.............y...>..........@..........H...............o..b~.D.poM...J..... .Microsoft.PowerShell.ConsoleHostD...............4..7..D.#V.....~.......System.Management.Automation0.................Vn.F..kLsw..........System..4...............<."..Ke@...j..........System.Core.4.................%...K... ...........System.Xml..L.................gQ?O.....x5.d.....#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4...............&.QiA0aN.:... .G........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...D....................+.H..!...e........System.Configuration.Ins

C:\Windows\Temp\FleetDeck\FleetDeck Agent Service.log

Download File

Process:	C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
File Type:	ASCII text, with very long lines (498)
Category:	dropped
Size (bytes):	1171
Entropy (8bit):	5.085254733142551
Encrypted:	false
SSDEEP:	24:hWjnX6YXF+lMpwih1lSInLfDJ68A+OGFdWoiKXF+libpwT:OXbwlqwih1lSwrI+OFoiKwli1wT
MD5:	CFC4F57D525EB408CE60B43CC183892E
SHA1:	E9B6A8D36EFD5877ADFE8BACD0F33797BBFE251E
SHA-256:	A2F568B2BC12ABAFA637464C833FD0C12D4A62B3972103B5DE9E6D2333D5F7DA
SHA-512:	B8448CAC5F6E24D7866AD8FA462066CBC30E7EC5BD0CE0835746002269834E565A7FD6FDEB838077C19B02921DA43D48560C69FDC04AD5089447783E142B5381
Malicious:	false
Preview:	2024/11/12 15:50:27 Starting FleetDeck Agent Service built using version "718da8a1b87729f24d9e6cab0e29a26d3d9795d7"....2024/11/12 15:50:27 IPC server starting....2024/11/12 15:50:27 Performing update....2024/11/12 15:50:27 Polling for latest version from: https://agentupdate.fleetdeck.io/latest.json.2024/11/12 15:50:27 Could not dial agentupdate.fleetdeck.io:443 using built-in dns resolvers, retrying using DoT....2024/11/12 15:50:40 Error when updating: Failed to get latest version: Failed to connect to url: Get "https://agentupdate.fleetdeck.io/latest.json": Unable to resolve agentupdate.fleetdeck.io using the following DoT configurations: [{[1.1.1.1]:853 cloudflare-dns.com} {[8.8.8.8]:853 dns.google} {[9.9.9.9]:853 dns.quad9.net} {[2606:4700:4700::1111]:853 cloudflare-dns.com} {[2001:4860:4860::8888]:853 dns.google} {[2620:fe::fe]:853 dns.quad9.net}], waiting for 2s before retrying with attempt: 1....2024/11/12 15:50:42 Performing update....2024/11/12 15:50:42 Polling for latest vers

C:\Windows\Temp\__PSScriptPolicyTest_2vt013jc.nso.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_5zdwvmyg.bmb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_eascx3qe.lg4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_fe5rcljs.t0o.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_gx1rpepn.5tb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_jjwmadbr.hak.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_lvcixcwt.0y2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_pjdgdsnb.qxu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Chrome Cache Entry: 200

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	downloaded
Size (bytes):	4081208
Entropy (8bit):	7.421421330971419
Encrypted:	false
SSDEEP:	98304:sdPsh/HLvyQInTgNbXZnkwcK50k7Ltj6zOny:s9sBW0ZXtkzK5tZe
MD5:	043ABB0F947E2219446A8FBC8E37049B
SHA1:	DCB579040FA9CA0DC5CAD8384EEFD44843C64BBD
SHA-256:	9E7275E75B3AF20EA579A8DD8E9A74EA6F30F141D58A1222F0EE87B335B90A69
SHA-512:	8CDE3A6C00FC2BA141CC160C0401822A8826D9BCFA18585ED5429A5A14D301D189BB5A17F6AD8BEC3369E6728CA15694F6FF9E132F27A114D4A12EFB496388CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
URL:	https://agentinstall.fleetdeck.io/fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........=...................#..................@.......................... A......}>...@...................................>.......@...............>.8*....>.:................................................... ................................text...`........................... ..`.rdata..............................@..@.data....1&.......#.................@....idata........>.......<.............@....reloc..:.....>.......<.............@..B.symtab.......?.......=................B.rsrc.........@.......=.............@..@........................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PDF document, version 1.4, 11 pages
Entropy (8bit):	7.7594720894126405
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	ACHAT DE 2 IMMEUBLES.pdf
File size:	1'582'655 bytes
MD5:	208e977d2a735133acb0bd4e347deea5
SHA1:	997034e9e36d11984cdf4b5b0dfcd8dc50c61a23
SHA256:	890bbf43f2c9244ffdb71a12beab0a7db68be4d8e897a0197a32dc8d1172dd41
SHA512:	79e8fcf38f88cc3474126d346ce612cdd489840fb34e96fc1bf2dd9acbfd0fa8e2a087a2fcf37257181cd0291993141725e317909849e41f5f804eedec80c3e3
SSDEEP:	49152:mMuYnZW1T1aB7pVAUWUraUsjGWYZf9cKt6:mMuCW1T1aVHWUraURWYu
TLSH:	D9750132FBC3E799578746ADA53D3E3307A9A5E9DAC0246B102F4C193084F369A5367C
File Content Preview:	%PDF-1.4.%.....1 0 obj.<<./Type /Catalog./Version /1.4./Pages 2 0 R./StructTreeRoot 3 0 R./MarkInfo 4 0 R./Lang (en)./ViewerPreferences 5 0 R.>>.endobj.6 0 obj.<<./Title (ACHAT DE 2 IMMEUBLES FR.pdf)./Creator (Canva)./Producer (Canva)./CreationDate (D:202

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-1.4
Total Entropy:	7.759472
Total Bytes:	1582655
Stream Entropy:	7.753502
Stream Bytes:	1562625
Entropy outside Streams:	5.222125
Bytes outside Streams:	20030
Number of EOF found:	1
Bytes after EOF:

Keywords Statistics

Name	Count
obj	132
endobj	132
stream	42
endstream	42
xref	1
trailer	1
startxref	1
/Page	11
/Encrypt	0
/ObjStm	0
/URI	10
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5
21	0000000000000000	342360ac75e62d1ff1e3437a0b9e2231
22	70494d7139230313	0937ec0469de5811a78ff6b71125f828
23	0812b2b271716906	38f7b21475db7ce3c733747145eaef8f
24	a8a5ada1e84d6660	2c2c39e105cd59e7cabb19a48b001e1f
25	203b5755d5532b80	f4af29e577c6250b1fbcfee0a8d4a28e

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-12T16:49:34.068040+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.16	49707	TCP
2024-11-12T16:50:11.925602+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.16	59359	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 16:49:22.920296907 CET	49673	443	192.168.2.16	204.79.197.203
Nov 12, 2024 16:49:23.224728107 CET	49673	443	192.168.2.16	204.79.197.203
Nov 12, 2024 16:49:23.831770897 CET	49673	443	192.168.2.16	204.79.197.203
Nov 12, 2024 16:49:25.046716928 CET	49673	443	192.168.2.16	204.79.197.203
Nov 12, 2024 16:49:27.144958019 CET	49690	80	192.168.2.16	192.229.211.108
Nov 12, 2024 16:49:27.450771093 CET	49673	443	192.168.2.16	204.79.197.203
Nov 12, 2024 16:49:31.127954006 CET	49678	443	192.168.2.16	20.189.173.10
Nov 12, 2024 16:49:31.434758902 CET	49678	443	192.168.2.16	20.189.173.10
Nov 12, 2024 16:49:32.049752951 CET	49678	443	192.168.2.16	20.189.173.10
Nov 12, 2024 16:49:32.257783890 CET	49673	443	192.168.2.16	204.79.197.203
Nov 12, 2024 16:49:32.696580887 CET	49707	443	192.168.2.16	20.109.210.53
Nov 12, 2024 16:49:32.696621895 CET	443	49707	20.109.210.53	192.168.2.16
Nov 12, 2024 16:49:32.696700096 CET	49707	443	192.168.2.16	20.109.210.53
Nov 12, 2024 16:49:32.698169947 CET	49707	443	192.168.2.16	20.109.210.53
Nov 12, 2024 16:49:32.698184967 CET	443	49707	20.109.210.53	192.168.2.16
Nov 12, 2024 16:49:33.262337923 CET	49678	443	192.168.2.16	20.189.173.10
Nov 12, 2024 16:49:33.499201059 CET	443	49707	20.109.210.53	192.168.2.16
Nov 12, 2024 16:49:33.501904011 CET	49707	443	192.168.2.16	20.109.210.53
Nov 12, 2024 16:49:33.588354111 CET	49707	443	192.168.2.16	20.109.210.53
Nov 12, 2024 16:49:33.588399887 CET	443	49707	20.109.210.53	192.168.2.16
Nov 12, 2024 16:49:33.588867903 CET	443	49707	20.109.210.53	192.168.2.16
Nov 12, 2024 16:49:33.640624046 CET	49707	443	192.168.2.16	20.109.210.53
Nov 12, 2024 16:49:33.651442051 CET	49711	443	192.168.2.16	18.173.205.127
Nov 12, 2024 16:49:33.651489019 CET	443	49711	18.173.205.127	192.168.2.16
Nov 12, 2024 16:49:33.651621103 CET	49711	443	192.168.2.16	18.173.205.127
Nov 12, 2024 16:49:33.654778004 CET	49711	443	192.168.2.16	18.173.205.127
Nov 12, 2024 16:49:33.654793978 CET	443	49711	18.173.205.127	192.168.2.16
Nov 12, 2024 16:49:33.802898884 CET	49707	443	192.168.2.16	20.109.210.53
Nov 12, 2024 16:49:33.847322941 CET	443	49707	20.109.210.53	192.168.2.16
Nov 12, 2024 16:49:34.066092968 CET	443	49707	20.109.210.53	192.168.2.16
Nov 12, 2024 16:49:34.066119909 CET	443	49707	20.109.210.53	192.168.2.16
Nov 12, 2024 16:49:34.066126108 CET	443	49707	20.109.210.53	192.168.2.16
Nov 12, 2024 16:49:34.066148043 CET	443	49707	20.109.210.53	192.168.2.16
Nov 12, 2024 16:49:34.066154957 CET	443	49707	20.109.210.53	192.168.2.16
Nov 12, 2024 16:49:34.066158056 CET	443	49707	20.109.210.53	192.168.2.16
Nov 12, 2024 16:49:34.066270113 CET	49707	443	192.168.2.16	20.109.210.53
Nov 12, 2024 16:49:34.066270113 CET	49707	443	192.168.2.16	20.109.210.53
Nov 12, 2024 16:49:34.066304922 CET	443	49707	20.109.210.53	192.168.2.16
Nov 12, 2024 16:49:34.066430092 CET	49707	443	192.168.2.16	20.109.210.53
Nov 12, 2024 16:49:34.067444086 CET	443	49707	20.109.210.53	192.168.2.16
Nov 12, 2024 16:49:34.067575932 CET	49707	443	192.168.2.16	20.109.210.53
Nov 12, 2024 16:49:34.067584038 CET	443	49707	20.109.210.53	192.168.2.16
Nov 12, 2024 16:49:34.067926884 CET	443	49707	20.109.210.53	192.168.2.16
Nov 12, 2024 16:49:34.068583965 CET	49707	443	192.168.2.16	20.109.210.53
Nov 12, 2024 16:49:34.078915119 CET	49707	443	192.168.2.16	20.109.210.53
Nov 12, 2024 16:49:34.078915119 CET	49707	443	192.168.2.16	20.109.210.53
Nov 12, 2024 16:49:34.078932047 CET	443	49707	20.109.210.53	192.168.2.16
Nov 12, 2024 16:49:34.078938961 CET	443	49707	20.109.210.53	192.168.2.16
Nov 12, 2024 16:49:34.501624107 CET	443	49711	18.173.205.127	192.168.2.16
Nov 12, 2024 16:49:34.502063990 CET	49711	443	192.168.2.16	18.173.205.127
Nov 12, 2024 16:49:34.502088070 CET	443	49711	18.173.205.127	192.168.2.16
Nov 12, 2024 16:49:34.503302097 CET	443	49711	18.173.205.127	192.168.2.16
Nov 12, 2024 16:49:34.503462076 CET	49711	443	192.168.2.16	18.173.205.127
Nov 12, 2024 16:49:34.504457951 CET	49711	443	192.168.2.16	18.173.205.127
Nov 12, 2024 16:49:34.504512072 CET	49711	443	192.168.2.16	18.173.205.127
Nov 12, 2024 16:49:34.504517078 CET	443	49711	18.173.205.127	192.168.2.16
Nov 12, 2024 16:49:34.504529953 CET	443	49711	18.173.205.127	192.168.2.16
Nov 12, 2024 16:49:34.544785976 CET	49711	443	192.168.2.16	18.173.205.127
Nov 12, 2024 16:49:34.544806004 CET	443	49711	18.173.205.127	192.168.2.16
Nov 12, 2024 16:49:34.592775106 CET	49711	443	192.168.2.16	18.173.205.127
Nov 12, 2024 16:49:35.562515974 CET	49680	80	192.168.2.16	192.229.211.108
Nov 12, 2024 16:49:35.673774958 CET	49678	443	192.168.2.16	20.189.173.10
Nov 12, 2024 16:49:35.869402885 CET	49680	80	192.168.2.16	192.229.211.108
Nov 12, 2024 16:49:36.479787111 CET	49680	80	192.168.2.16	192.229.211.108
Nov 12, 2024 16:49:37.689801931 CET	49680	80	192.168.2.16	192.229.211.108
Nov 12, 2024 16:49:38.114613056 CET	443	49711	18.173.205.127	192.168.2.16
Nov 12, 2024 16:49:38.114691019 CET	443	49711	18.173.205.127	192.168.2.16
Nov 12, 2024 16:49:38.115075111 CET	49711	443	192.168.2.16	18.173.205.127
Nov 12, 2024 16:49:38.115075111 CET	49711	443	192.168.2.16	18.173.205.127
Nov 12, 2024 16:49:38.115096092 CET	443	49711	18.173.205.127	192.168.2.16
Nov 12, 2024 16:49:38.115139008 CET	49711	443	192.168.2.16	18.173.205.127
Nov 12, 2024 16:49:38.115237951 CET	49711	443	192.168.2.16	18.173.205.127
Nov 12, 2024 16:49:38.142146111 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:38.142175913 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:38.144757986 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:38.144757986 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:38.144797087 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:38.164288044 CET	49716	443	192.168.2.16	142.250.186.164
Nov 12, 2024 16:49:38.164328098 CET	443	49716	142.250.186.164	192.168.2.16
Nov 12, 2024 16:49:38.164414883 CET	49716	443	192.168.2.16	142.250.186.164
Nov 12, 2024 16:49:38.164783955 CET	49716	443	192.168.2.16	142.250.186.164
Nov 12, 2024 16:49:38.164794922 CET	443	49716	142.250.186.164	192.168.2.16
Nov 12, 2024 16:49:38.980689049 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:38.980978012 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:38.980998039 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:38.982105017 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:38.982173920 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:38.983581066 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:38.983669996 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:38.983916044 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:38.983925104 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:39.025801897 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:39.043282986 CET	443	49716	142.250.186.164	192.168.2.16
Nov 12, 2024 16:49:39.044281006 CET	49716	443	192.168.2.16	142.250.186.164
Nov 12, 2024 16:49:39.044305086 CET	443	49716	142.250.186.164	192.168.2.16
Nov 12, 2024 16:49:39.045630932 CET	443	49716	142.250.186.164	192.168.2.16
Nov 12, 2024 16:49:39.045730114 CET	49716	443	192.168.2.16	142.250.186.164
Nov 12, 2024 16:49:39.046786070 CET	49716	443	192.168.2.16	142.250.186.164
Nov 12, 2024 16:49:39.046869993 CET	443	49716	142.250.186.164	192.168.2.16
Nov 12, 2024 16:49:39.088787079 CET	49716	443	192.168.2.16	142.250.186.164
Nov 12, 2024 16:49:39.088799953 CET	443	49716	142.250.186.164	192.168.2.16
Nov 12, 2024 16:49:39.136754990 CET	49716	443	192.168.2.16	142.250.186.164
Nov 12, 2024 16:49:39.320251942 CET	59357	53	192.168.2.16	1.1.1.1
Nov 12, 2024 16:49:39.325107098 CET	53	59357	1.1.1.1	192.168.2.16
Nov 12, 2024 16:49:39.325181007 CET	59357	53	192.168.2.16	1.1.1.1
Nov 12, 2024 16:49:39.325242996 CET	59357	53	192.168.2.16	1.1.1.1
Nov 12, 2024 16:49:39.330192089 CET	53	59357	1.1.1.1	192.168.2.16
Nov 12, 2024 16:49:39.922282934 CET	53	59357	1.1.1.1	192.168.2.16
Nov 12, 2024 16:49:39.923005104 CET	59357	53	192.168.2.16	1.1.1.1
Nov 12, 2024 16:49:39.929909945 CET	53	59357	1.1.1.1	192.168.2.16
Nov 12, 2024 16:49:39.929963112 CET	59357	53	192.168.2.16	1.1.1.1
Nov 12, 2024 16:49:39.990745068 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:39.990765095 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:39.990772963 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:39.990799904 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:39.990816116 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:39.990828037 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:39.990828037 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:39.990852118 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:39.990865946 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:39.990875006 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:39.990911961 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:40.091788054 CET	49680	80	192.168.2.16	192.229.211.108
Nov 12, 2024 16:49:40.132709026 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.132786989 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:40.132843971 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.132906914 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:40.248207092 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.248231888 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.248286009 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:40.248305082 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.248338938 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:40.248415947 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:40.252062082 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.252120972 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:40.367659092 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.367685080 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.367798090 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:40.367822886 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.367886066 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:40.473783016 CET	49678	443	192.168.2.16	20.189.173.10
Nov 12, 2024 16:49:40.483274937 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.483298063 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.483378887 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:40.483397007 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.483426094 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:40.483436108 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:40.570683956 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.570704937 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.570769072 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:40.570786953 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.570997953 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:40.603826046 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.603844881 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.603936911 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:40.603955984 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.604000092 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:40.717880011 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.717905998 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.717955112 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:40.717972994 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.717998981 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:40.718017101 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:40.718537092 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.718600035 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:40.833136082 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.833157063 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.833235979 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:40.833256006 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.833468914 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:40.945482016 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.945498943 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.945580006 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:40.945600033 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:40.945827007 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.030469894 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.030493975 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.030522108 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.030561924 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.030587912 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.030617952 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.064250946 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.064273119 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.064321995 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.064342976 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.064367056 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.110771894 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.110794067 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.157772064 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.179001093 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.179012060 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.179055929 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.179088116 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.179088116 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.179111004 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.179136038 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.179157019 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.179300070 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.179358959 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.179546118 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.221781969 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.291831017 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.291841984 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.291892052 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.291920900 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.291932106 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.291946888 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.291956902 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.291963100 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.291979074 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.296351910 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.296384096 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.296439886 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.296458960 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.296478987 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.349781036 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.410053968 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.410063982 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.410095930 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.410103083 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.410135031 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.410161972 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.410181999 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.412441969 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.412461996 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.412503958 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.412520885 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.412543058 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.412563086 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.526702881 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.526721001 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.526791096 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.526809931 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.526966095 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.527024031 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.527089119 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.527131081 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.527138948 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.572777987 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.638865948 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.638885021 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.638935089 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.638967991 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.638998985 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.639017105 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.643138885 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.643157959 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.643204927 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.643219948 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.643239021 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.683782101 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.756484032 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.756498098 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.756553888 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.756570101 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.756591082 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.756623983 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.756639004 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.756706953 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.759954929 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.759983063 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.760020971 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.760031939 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.760062933 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.760083914 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.859801054 CET	49673	443	192.168.2.16	204.79.197.203
Nov 12, 2024 16:49:41.872469902 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.872488976 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.872607946 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.872634888 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.872781038 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.875396013 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.875417948 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.875459909 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.875463009 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.875505924 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.875514030 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.923774004 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.988291979 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.988311052 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.988409996 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.988440037 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.988818884 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.991615057 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.991636992 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.991682053 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.991689920 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.991705894 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:41.991736889 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:41.991765976 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.104710102 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.104729891 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.104820967 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.104840040 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.104971886 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.107460022 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.107500076 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.107525110 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.107532978 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.107574940 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.107593060 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.108237982 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.108289003 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.219439983 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.219500065 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.219541073 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.219563007 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.219589949 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.219609022 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.219623089 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.222363949 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.222382069 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.222440004 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.222450018 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.222769022 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.223123074 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.273782015 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.273803949 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.321765900 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.333470106 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.333479881 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.333515882 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.333545923 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.333544970 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.333561897 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.333581924 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.333606005 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.337038040 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.337078094 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.337107897 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.337117910 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.337152004 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.337162018 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.375744104 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.375762939 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.375783920 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.375848055 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.375868082 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.375894070 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.417768002 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.451997995 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.452023029 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.452049017 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.452106953 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.452126980 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.452157021 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.453957081 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.453975916 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.454077959 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.454092026 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.497948885 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.497968912 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.545569897 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.566785097 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.566795111 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.566833019 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.566848040 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.566885948 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.566906929 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.566921949 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.566940069 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.566971064 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.567011118 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.569602966 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.569618940 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.569638968 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.569677114 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.569693089 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.569736004 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.569755077 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.651302099 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.651328087 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.651351929 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.651395082 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.651422977 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.651456118 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.683902979 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.683924913 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.683979034 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.684003115 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.684031010 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.686335087 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.686350107 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.686405897 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.686423063 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.734822989 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.800095081 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.800106049 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.800149918 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.800164938 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.800193071 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.800223112 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.800256014 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.803010941 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.803031921 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.803059101 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.803071976 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.803090096 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.803117037 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.805561066 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.805577993 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.805603981 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.805629015 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.805660963 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.805675983 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.805706024 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.805746078 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.918327093 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.918381929 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.918445110 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.918463945 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.918502092 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.918519020 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.920881033 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.920898914 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.920936108 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.920938015 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.920948982 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.920960903 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.920973063 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.920999050 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.924074888 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.924093008 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.924145937 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:42.924160957 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:42.924372911 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.031186104 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.031208038 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.031294107 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.031323910 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.031373978 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.034831047 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.034856081 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.034914970 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.034930944 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.034960985 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.035034895 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.037378073 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.037403107 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.037425995 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.037466049 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.037482023 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.037508965 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.037534952 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.146440983 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.146513939 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.146533966 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.146562099 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.146589041 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.146611929 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.149966955 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.149985075 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.150007010 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.150048018 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.150060892 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.150094032 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.150120020 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.150850058 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.153112888 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.153126955 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.153209925 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.153222084 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.196799040 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.254555941 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.254590034 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.254661083 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.254682064 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.254750967 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.254833937 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.263128996 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.264889002 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.264904976 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.265078068 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.265094995 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.267023087 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.267046928 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.267083883 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.267100096 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.267122030 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.267144918 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.267904043 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.267965078 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.271853924 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.271873951 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.272030115 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.272044897 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.272123098 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.377933979 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.377998114 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.378067017 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.378108978 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.378122091 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.378159046 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.378365040 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.378415108 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.381397963 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.381413937 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.381470919 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.381493092 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.381860971 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.381926060 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.384006977 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.384021044 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.384040117 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.384077072 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.384095907 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.384109974 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.436793089 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.464734077 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.464786053 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.464824915 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.464840889 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.464883089 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.493746042 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.493812084 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.495412111 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.495429993 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.495511055 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.495520115 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.495960951 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.497083902 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.497127056 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.497158051 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.497165918 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.497183084 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.497200966 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.498924971 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.498964071 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.498996973 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.499001980 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.499034882 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.499052048 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.499974012 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.500030994 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.609380007 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.609416962 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.609538078 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.609572887 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.609587908 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.611392021 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.611413002 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.611479998 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.611488104 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.611498117 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.613461971 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.613477945 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.613497972 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.613535881 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.613543987 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.613565922 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.613584042 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.615259886 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.615287066 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.615346909 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.615353107 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.615609884 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.697557926 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.697577000 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.697689056 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.697704077 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.697756052 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.726495028 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.726517916 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.726607084 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.726628065 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.728230000 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.728250980 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.728308916 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.728332043 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.728342056 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.728490114 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.729688883 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.729705095 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.729724884 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.729830027 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.729836941 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.769836903 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.812730074 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.812748909 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.812859058 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.812870026 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.812915087 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.841042995 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.841063023 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.841103077 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.841192007 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.841202021 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.841252089 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.843379974 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.843404055 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.843436003 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.843483925 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.843491077 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.843537092 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.844245911 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.844278097 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.844316959 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.844321966 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.844340086 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.844371080 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.845097065 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.845191002 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.846024990 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.846041918 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.846116066 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.846122980 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.846470118 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.846800089 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.897825956 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.956038952 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.956059933 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.956089020 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.956193924 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.956213951 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.958494902 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.958519936 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.958585024 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.958591938 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.958621025 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.959444046 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.959460020 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.959522009 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.959528923 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.959810019 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.961107016 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.961122036 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.961185932 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:43.961191893 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:43.961532116 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.043941975 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.043983936 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.044070005 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.044089079 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.044121027 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.071882010 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.071909904 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.071933985 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.071983099 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.071993113 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.072019100 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.072038889 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.074455023 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.074470997 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.074565887 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.074573040 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.074619055 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.076061010 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.076088905 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.076119900 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.076131105 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.076148987 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.076163054 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.076180935 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.077111959 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.077142954 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.077181101 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.077188969 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.077213049 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.077235937 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.077826977 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.120841980 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.160154104 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.160171032 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.160284042 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.160304070 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.160499096 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.187386036 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.187446117 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.187505007 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.187517881 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.187570095 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.187712908 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.190841913 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.190892935 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.190932035 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.190944910 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.190974951 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.192199945 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.192220926 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.192272902 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.192282915 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.192310095 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.193221092 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.193234921 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.193317890 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.193326950 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.237236023 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.237366915 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.237404108 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.237425089 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.237481117 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.237488985 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.278872013 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.278906107 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.302675962 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.302695990 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.302738905 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.302791119 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.302813053 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.302824974 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.303076982 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.303107023 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.303126097 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.303133011 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.303142071 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.305645943 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.305664062 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.305748940 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.305759907 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.307173967 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.307190895 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.307269096 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.307279110 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.307549000 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.307606936 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.307615042 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.307663918 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.308768034 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.308788061 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.308828115 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.308851957 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.308851957 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.308860064 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.308870077 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.349241018 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.349338055 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.349364042 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.349386930 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.349452019 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.349458933 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.406784058 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.418622971 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.418633938 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.418675900 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.418697119 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.418710947 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.418730021 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.418747902 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.418765068 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.420861959 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.420888901 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.420944929 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.420953035 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.420964003 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.420993090 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.421787977 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.421804905 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.421871901 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.421880007 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.421921015 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.422069073 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.422122955 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.422348976 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.423471928 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.423517942 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.423541069 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.423547029 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.423590899 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.423712969 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.423762083 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.424593925 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.424611092 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.424633026 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.424674034 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.424681902 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.424715042 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.470854998 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.507685900 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.507708073 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.507833958 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.507869959 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.507922888 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.534728050 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.534764051 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.534806967 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.534847021 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.534874916 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.534919024 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.536945105 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.536964893 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.537018061 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.537033081 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.537065029 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.537082911 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.538146973 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.538166046 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.538213968 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.538228035 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.538258076 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.538273096 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.539151907 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.539199114 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.539230108 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.539239883 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.539282084 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.539310932 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.539885044 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.539904118 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.539968014 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.539979935 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.540013075 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.540195942 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.540249109 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.650388956 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.650458097 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.650516987 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.650559902 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.650573969 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.650609016 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.651213884 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.651237011 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.651284933 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.651293039 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.651350975 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.651350975 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.652565002 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.652581930 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.652602911 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.652641058 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.652651072 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.652673960 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.652681112 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.653506041 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.653521061 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.653578043 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.653588057 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.653633118 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.653894901 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.653947115 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.654972076 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.655023098 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.655040979 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.655046940 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.655076981 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.655093908 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.655105114 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.655147076 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.655991077 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.656037092 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.656069040 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.656085014 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.656110048 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.656130075 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.700246096 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.700265884 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.700395107 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.700433969 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.700483084 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.700490952 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.744484901 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.766691923 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.766726017 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.766978979 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.767025948 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.767086029 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.768244982 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.768286943 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.768336058 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.768347979 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.768388987 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.768433094 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.768482924 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.768487930 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.768918991 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.768939972 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.768984079 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.768992901 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.769021988 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.769043922 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.770401955 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.770495892 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.770529032 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.770587921 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.770684958 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.770745039 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.771038055 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.771075964 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.771109104 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.771114111 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.771136045 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.771167994 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.773467064 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.773505926 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.773565054 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.773572922 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.773610115 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.893228054 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.893340111 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.893373966 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.893403053 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.893418074 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.893436909 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.893465996 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.893471003 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.893510103 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.894042969 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.894082069 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.894112110 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.894115925 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.894144058 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.894162893 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.894866943 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.894886971 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.894910097 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.894946098 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.894953966 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.894999981 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.895018101 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.895688057 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.895714998 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.895775080 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.895781040 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.895808935 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.895831108 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.896714926 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.896743059 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.896786928 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.896792889 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.896822929 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.896841049 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.897576094 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.897593021 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.897658110 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.897661924 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.897711039 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.898473024 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.898494005 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.898557901 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.898561954 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.898603916 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.900830984 CET	49680	80	192.168.2.16	192.229.211.108
Nov 12, 2024 16:49:44.997421026 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.997450113 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.997620106 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.997646093 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.997694969 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.998733997 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.998758078 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.998840094 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:44.998847961 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:44.998928070 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.008918047 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.008940935 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.009069920 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.009088039 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.009139061 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.009661913 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.009680033 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.009753942 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.009758949 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.009812117 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.010349035 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.010368109 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.010428905 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.010432959 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.010476112 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.011286974 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.011305094 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.011373043 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.011378050 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.011420012 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.012348890 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.012367964 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.012418032 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.012422085 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.012450933 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.012459040 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.047195911 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.047219038 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.047337055 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.047363043 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.047405005 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.113477945 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.113509893 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.113646030 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.113677025 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.113733053 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.123956919 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.123985052 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.124115944 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.124124050 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.124171019 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.124643087 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.124660969 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.124741077 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.124746084 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.124829054 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.125763893 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.125782013 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.125844955 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.125854015 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.125889063 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.126494884 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.126511097 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.126543045 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.126548052 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.126585007 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.126616001 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.127429008 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.127445936 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.127504110 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.127511024 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.127537012 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.127545118 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.128307104 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.128324986 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.128410101 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.128410101 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.128416061 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.128453016 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.163100004 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.163127899 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.163264990 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.163292885 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.163342953 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.228662968 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.228687048 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.228816032 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.228846073 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.228889942 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.239721060 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.239748001 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.239847898 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.239877939 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.239917994 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.240597010 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.240614891 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.240653038 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.240664005 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.240686893 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.240705967 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.241290092 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.241307974 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.241338015 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.241353035 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.241368055 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.241390944 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.242305040 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.242324114 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.242356062 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.242366076 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.242388964 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.242407084 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.243344069 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.243371010 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.243396044 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.243406057 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.243427992 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.243446112 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.244060040 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.244079113 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.244112015 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.244119883 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.244143963 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.244162083 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.274620056 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.274645090 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.274693012 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.274714947 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.274754047 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.344405890 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.344433069 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.344540119 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.344566107 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.344605923 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.345124006 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.345143080 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.345201015 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.345208883 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.345247984 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.356041908 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.356091976 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.356175900 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.356199026 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.356221914 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.356235027 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.357265949 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.357297897 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.357347012 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.357357025 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.357367992 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.357381105 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.357402086 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.357764959 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.357788086 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.357839108 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.357847929 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.357877016 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.358599901 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.358628988 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.358661890 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.358670950 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.358699083 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.359504938 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.359520912 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.359545946 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.359587908 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.359601021 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.359612942 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.360495090 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.360521078 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.360562086 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.360568047 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.360578060 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.360595942 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.360610008 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.360615015 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.360663891 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.396565914 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.396611929 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.396662951 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.396678925 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.396733999 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.396754026 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.654572964 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.654598951 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.654637098 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.654757977 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.654781103 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.654825926 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.655108929 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.655142069 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.655179024 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.655183077 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.655211926 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.655229092 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.656428099 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.656443119 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.656500101 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.656506062 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.656565905 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.657282114 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.657296896 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.657350063 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.657354116 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.657402039 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.658154011 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.658171892 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.658195972 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.658225060 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.658231020 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.658257961 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.658272028 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.659194946 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.659210920 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.659262896 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.659269094 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.659311056 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.660037041 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.660059929 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.660094023 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.660099030 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.660125017 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.660142899 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.660295963 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.660315990 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.660362959 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.660368919 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.660413980 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.661151886 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.661212921 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.661557913 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.661571980 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.661619902 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.661623955 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.661648035 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.662472010 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.662493944 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.662529945 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.662534952 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.662559032 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.663362980 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.663376093 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.663429976 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.663436890 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.663943052 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.663964987 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.664001942 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.664007902 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.664017916 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.664144039 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.664159060 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.664196014 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.664201021 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.664216995 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.665034056 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.665052891 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.665095091 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.665102005 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.665112019 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.665962934 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.665980101 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.666042089 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.666048050 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.666543961 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.666569948 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.666601896 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.666605949 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.666640997 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.667582989 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.667596102 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.667654037 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.667655945 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.667666912 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.667676926 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.667690039 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.667711973 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.667716026 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.667753935 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.690593004 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.690612078 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.690783978 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.690800905 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.691890001 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.691912889 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.691955090 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.691961050 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.691987991 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.702152967 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.702167034 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.702253103 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.702259064 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.702596903 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.702647924 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.702652931 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.703730106 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.703747988 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.703800917 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.703808069 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.704771042 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.704783916 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.704838037 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.704843998 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.704886913 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.705408096 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.705424070 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.705485106 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.705488920 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.705538034 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.705848932 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.705863953 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.705919981 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.705924988 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.705966949 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.706732988 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.706748962 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.706804037 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.706808090 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.706851006 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.707374096 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.707390070 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.707468987 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.707473040 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.707520008 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.708791971 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.708806038 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.708865881 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.708872080 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.708913088 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.789886951 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.789908886 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.790000916 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.790015936 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.790060997 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.807498932 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.807523012 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.807581902 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.807589054 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.807622910 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.807647943 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.818106890 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.818123102 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.818190098 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.818197012 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.818240881 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.819478035 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.819499016 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.819565058 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.819569111 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.819622993 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.820368052 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.820388079 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.820447922 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.820453882 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.820506096 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.820508957 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.821027994 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.821047068 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.821088076 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.821094036 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.821115971 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.821594000 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.821610928 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.821660042 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.821665049 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.822329044 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.822348118 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.822385073 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.822391033 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.822417974 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.823079109 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.823091030 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.823142052 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.823148012 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.823721886 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.823741913 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.823791981 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.823796034 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.823807955 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.857503891 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.857528925 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.857594013 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.857608080 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.857635975 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.899828911 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.921813965 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.921844959 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.921936989 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.921971083 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.922022104 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.923336983 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.923352957 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.923415899 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.923433065 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.923479080 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.934828043 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.934854984 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.934912920 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.934936047 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.934972048 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.935858011 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.935882092 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.935924053 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.935931921 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.935951948 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.935969114 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.936755896 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.936778069 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.936816931 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.936824083 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.936871052 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.937566042 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.937587976 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.937644958 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.937654972 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.937696934 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.938215971 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.938234091 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.938313961 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.938329935 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.938378096 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.938851118 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.938867092 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.938914061 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.938920975 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.938960075 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.939248085 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.939265013 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.939320087 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.939328909 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.939377069 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.943451881 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.943475962 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.943538904 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.943562984 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.943609953 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.969630957 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.969660044 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.969757080 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:45.969799995 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:45.969840050 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.037875891 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.037913084 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.038052082 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.038108110 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.038156986 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.039051056 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.039067984 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.039119005 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.039139032 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.039185047 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.050021887 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.050043106 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.050123930 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.050156116 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.050208092 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.050594091 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.050611019 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.050693989 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.050702095 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.050755024 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.051829100 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.051855087 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.051893950 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.051912069 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.051935911 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.051954031 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.053041935 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.053057909 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.053122997 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.053138971 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.053184986 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.055282116 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.055295944 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.055366993 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.055373907 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.055409908 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.055866957 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.055882931 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.055943012 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.055949926 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.055999041 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.056565046 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.056581020 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.056632042 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.056638002 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.056678057 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.057053089 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.057068110 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.057130098 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.057140112 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.057183027 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.059247971 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.059263945 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.059330940 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.059339046 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.059385061 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.088766098 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.088799000 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.088939905 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.088973045 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.089015007 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.153635979 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.153666973 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.153793097 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.153825998 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.153872967 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.154834986 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.154855013 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.154905081 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.154916048 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.154959917 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.165775061 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.165802002 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.165882111 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.165904045 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.165958881 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.166471004 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.166488886 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.166544914 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.166552067 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.166595936 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.167517900 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.167536020 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.167593956 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.167603016 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.167646885 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.168334007 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.168349981 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.168422937 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.168437958 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.168498039 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.171674013 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.171693087 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.171772957 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.171783924 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.171809912 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.171832085 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.171988010 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.172003031 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.172044039 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.172049046 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.172081947 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.172557116 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.172573090 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.172636032 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.172641039 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.172673941 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.172992945 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.173007011 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.173054934 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.173059940 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.173091888 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.174715042 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.174732924 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.174787045 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.174793959 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.174839020 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.201153040 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.201189995 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.201256990 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.201299906 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.201317072 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.201347113 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.253242016 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.253276110 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.253334999 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.253374100 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.253391027 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.253416061 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.269913912 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.269938946 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.270004034 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.270031929 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.270046949 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.270073891 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.270522118 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.270536900 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.270597935 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.270603895 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.270653963 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.281491041 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.281521082 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.281575918 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.281626940 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.281646013 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.281678915 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.282948017 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.282969952 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.283036947 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.283046961 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.283083916 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.283436060 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.283456087 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.283516884 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.283526897 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.283588886 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.284878016 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.284913063 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.284948111 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.284960032 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.284980059 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.284992933 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.284996986 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:46.285043001 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.285098076 CET	49715	443	192.168.2.16	18.66.112.116
Nov 12, 2024 16:49:46.285115004 CET	443	49715	18.66.112.116	192.168.2.16
Nov 12, 2024 16:49:49.055519104 CET	443	49716	142.250.186.164	192.168.2.16
Nov 12, 2024 16:49:49.055586100 CET	443	49716	142.250.186.164	192.168.2.16
Nov 12, 2024 16:49:49.055668116 CET	49716	443	192.168.2.16	142.250.186.164
Nov 12, 2024 16:49:49.909791946 CET	49716	443	192.168.2.16	142.250.186.164
Nov 12, 2024 16:49:49.909835100 CET	443	49716	142.250.186.164	192.168.2.16
Nov 12, 2024 16:49:50.080277920 CET	49678	443	192.168.2.16	20.189.173.10
Nov 12, 2024 16:49:54.514520884 CET	49680	80	192.168.2.16	192.229.211.108
Nov 12, 2024 16:50:10.806004047 CET	59359	443	192.168.2.16	172.202.163.200
Nov 12, 2024 16:50:10.806045055 CET	443	59359	172.202.163.200	192.168.2.16
Nov 12, 2024 16:50:10.806133986 CET	59359	443	192.168.2.16	172.202.163.200
Nov 12, 2024 16:50:10.806643009 CET	59359	443	192.168.2.16	172.202.163.200
Nov 12, 2024 16:50:10.806654930 CET	443	59359	172.202.163.200	192.168.2.16
Nov 12, 2024 16:50:11.597697973 CET	443	59359	172.202.163.200	192.168.2.16
Nov 12, 2024 16:50:11.597790003 CET	59359	443	192.168.2.16	172.202.163.200
Nov 12, 2024 16:50:11.602082014 CET	59359	443	192.168.2.16	172.202.163.200
Nov 12, 2024 16:50:11.602093935 CET	443	59359	172.202.163.200	192.168.2.16
Nov 12, 2024 16:50:11.602338076 CET	443	59359	172.202.163.200	192.168.2.16
Nov 12, 2024 16:50:11.608901024 CET	59359	443	192.168.2.16	172.202.163.200
Nov 12, 2024 16:50:11.655332088 CET	443	59359	172.202.163.200	192.168.2.16
Nov 12, 2024 16:50:11.920289993 CET	443	59359	172.202.163.200	192.168.2.16
Nov 12, 2024 16:50:11.920312881 CET	443	59359	172.202.163.200	192.168.2.16
Nov 12, 2024 16:50:11.920329094 CET	443	59359	172.202.163.200	192.168.2.16
Nov 12, 2024 16:50:11.920392990 CET	59359	443	192.168.2.16	172.202.163.200
Nov 12, 2024 16:50:11.920406103 CET	443	59359	172.202.163.200	192.168.2.16
Nov 12, 2024 16:50:11.920449972 CET	59359	443	192.168.2.16	172.202.163.200
Nov 12, 2024 16:50:11.922169924 CET	443	59359	172.202.163.200	192.168.2.16
Nov 12, 2024 16:50:11.922204018 CET	443	59359	172.202.163.200	192.168.2.16
Nov 12, 2024 16:50:11.922234058 CET	59359	443	192.168.2.16	172.202.163.200
Nov 12, 2024 16:50:11.922240973 CET	443	59359	172.202.163.200	192.168.2.16
Nov 12, 2024 16:50:11.922260046 CET	59359	443	192.168.2.16	172.202.163.200
Nov 12, 2024 16:50:11.925307035 CET	59359	443	192.168.2.16	172.202.163.200
Nov 12, 2024 16:50:11.925318956 CET	443	59359	172.202.163.200	192.168.2.16
Nov 12, 2024 16:50:11.925340891 CET	59359	443	192.168.2.16	172.202.163.200
Nov 12, 2024 16:50:11.925477982 CET	443	59359	172.202.163.200	192.168.2.16
Nov 12, 2024 16:50:11.925566912 CET	443	59359	172.202.163.200	192.168.2.16
Nov 12, 2024 16:50:11.925612926 CET	59359	443	192.168.2.16	172.202.163.200
Nov 12, 2024 16:50:28.303932905 CET	59361	443	192.168.2.16	18.239.18.47
Nov 12, 2024 16:50:28.303965092 CET	443	59361	18.239.18.47	192.168.2.16
Nov 12, 2024 16:50:28.304064035 CET	59361	443	192.168.2.16	18.239.18.47
Nov 12, 2024 16:50:28.304707050 CET	59361	443	192.168.2.16	18.239.18.47
Nov 12, 2024 16:50:28.304724932 CET	443	59361	18.239.18.47	192.168.2.16
Nov 12, 2024 16:50:29.156552076 CET	443	59361	18.239.18.47	192.168.2.16
Nov 12, 2024 16:50:29.156716108 CET	59361	443	192.168.2.16	18.239.18.47
Nov 12, 2024 16:50:29.156738997 CET	443	59361	18.239.18.47	192.168.2.16
Nov 12, 2024 16:50:29.157078028 CET	59361	443	192.168.2.16	18.239.18.47
Nov 12, 2024 16:50:29.157083035 CET	443	59361	18.239.18.47	192.168.2.16
Nov 12, 2024 16:50:29.158138990 CET	443	59361	18.239.18.47	192.168.2.16
Nov 12, 2024 16:50:29.158202887 CET	59361	443	192.168.2.16	18.239.18.47
Nov 12, 2024 16:50:29.159918070 CET	59361	443	192.168.2.16	18.239.18.47
Nov 12, 2024 16:50:29.159955978 CET	59361	443	192.168.2.16	18.239.18.47
Nov 12, 2024 16:50:29.160111904 CET	443	59361	18.239.18.47	192.168.2.16
Nov 12, 2024 16:50:29.160161018 CET	59361	443	192.168.2.16	18.239.18.47
Nov 12, 2024 16:50:29.160398960 CET	59362	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:29.165520906 CET	853	59362	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:29.165618896 CET	59362	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:29.166285992 CET	59362	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:29.171325922 CET	853	59362	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:29.762521982 CET	853	59362	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:29.762536049 CET	853	59362	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:29.762546062 CET	853	59362	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:29.762609005 CET	59362	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:29.802891016 CET	59362	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:29.810075045 CET	59362	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:29.810122967 CET	59362	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:29.814903021 CET	853	59362	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:29.814913988 CET	853	59362	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:29.971110106 CET	853	59362	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:29.971342087 CET	59362	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:29.971359968 CET	59362	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:29.971647024 CET	59363	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:29.976370096 CET	853	59362	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:29.976511955 CET	853	59363	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:29.976597071 CET	59363	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:29.977096081 CET	853	59362	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:29.977166891 CET	59362	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:29.977241039 CET	59363	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:29.982026100 CET	853	59363	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:30.572612047 CET	853	59363	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:30.572635889 CET	853	59363	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:30.572647095 CET	853	59363	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:30.572705984 CET	59363	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:30.575829983 CET	59363	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:30.575875044 CET	59363	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:30.580753088 CET	853	59363	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:30.580765009 CET	853	59363	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:30.846901894 CET	853	59363	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:30.847723007 CET	59363	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:30.847755909 CET	59363	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:30.850564957 CET	59372	443	192.168.2.16	18.154.219.118
Nov 12, 2024 16:50:30.850611925 CET	443	59372	18.154.219.118	192.168.2.16
Nov 12, 2024 16:50:30.850713015 CET	59372	443	192.168.2.16	18.154.219.118
Nov 12, 2024 16:50:30.851334095 CET	59372	443	192.168.2.16	18.154.219.118
Nov 12, 2024 16:50:30.851346016 CET	443	59372	18.154.219.118	192.168.2.16
Nov 12, 2024 16:50:30.852724075 CET	853	59363	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:30.853521109 CET	853	59363	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:30.853573084 CET	59363	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:31.447320938 CET	443	59372	18.154.219.118	192.168.2.16
Nov 12, 2024 16:50:31.447587013 CET	59372	443	192.168.2.16	18.154.219.118
Nov 12, 2024 16:50:31.447618961 CET	443	59372	18.154.219.118	192.168.2.16
Nov 12, 2024 16:50:31.448009014 CET	59372	443	192.168.2.16	18.154.219.118
Nov 12, 2024 16:50:31.448019981 CET	443	59372	18.154.219.118	192.168.2.16
Nov 12, 2024 16:50:31.449114084 CET	443	59372	18.154.219.118	192.168.2.16
Nov 12, 2024 16:50:31.449187040 CET	59372	443	192.168.2.16	18.154.219.118
Nov 12, 2024 16:50:31.450990915 CET	59372	443	192.168.2.16	18.154.219.118
Nov 12, 2024 16:50:31.451015949 CET	59372	443	192.168.2.16	18.154.219.118
Nov 12, 2024 16:50:31.451143980 CET	443	59372	18.154.219.118	192.168.2.16
Nov 12, 2024 16:50:31.451334953 CET	59373	443	192.168.2.16	18.154.219.78
Nov 12, 2024 16:50:31.451359034 CET	59372	443	192.168.2.16	18.154.219.118
Nov 12, 2024 16:50:31.451385975 CET	443	59373	18.154.219.78	192.168.2.16
Nov 12, 2024 16:50:31.451468945 CET	59373	443	192.168.2.16	18.154.219.78
Nov 12, 2024 16:50:31.452135086 CET	59373	443	192.168.2.16	18.154.219.78
Nov 12, 2024 16:50:31.452147961 CET	443	59373	18.154.219.78	192.168.2.16
Nov 12, 2024 16:50:32.059684038 CET	443	59373	18.154.219.78	192.168.2.16
Nov 12, 2024 16:50:32.059880018 CET	59373	443	192.168.2.16	18.154.219.78
Nov 12, 2024 16:50:32.059912920 CET	443	59373	18.154.219.78	192.168.2.16
Nov 12, 2024 16:50:32.060214043 CET	59373	443	192.168.2.16	18.154.219.78
Nov 12, 2024 16:50:32.060220003 CET	443	59373	18.154.219.78	192.168.2.16
Nov 12, 2024 16:50:32.061311960 CET	443	59373	18.154.219.78	192.168.2.16
Nov 12, 2024 16:50:32.061391115 CET	59373	443	192.168.2.16	18.154.219.78
Nov 12, 2024 16:50:32.063061953 CET	59373	443	192.168.2.16	18.154.219.78
Nov 12, 2024 16:50:32.063087940 CET	59373	443	192.168.2.16	18.154.219.78
Nov 12, 2024 16:50:32.063225031 CET	443	59373	18.154.219.78	192.168.2.16
Nov 12, 2024 16:50:32.063275099 CET	59373	443	192.168.2.16	18.154.219.78
Nov 12, 2024 16:50:32.063349009 CET	59374	443	192.168.2.16	18.154.219.68
Nov 12, 2024 16:50:32.063375950 CET	443	59374	18.154.219.68	192.168.2.16
Nov 12, 2024 16:50:32.063451052 CET	59374	443	192.168.2.16	18.154.219.68
Nov 12, 2024 16:50:32.064038992 CET	59374	443	192.168.2.16	18.154.219.68
Nov 12, 2024 16:50:32.064052105 CET	443	59374	18.154.219.68	192.168.2.16
Nov 12, 2024 16:50:32.671423912 CET	443	59374	18.154.219.68	192.168.2.16
Nov 12, 2024 16:50:32.671610117 CET	59374	443	192.168.2.16	18.154.219.68
Nov 12, 2024 16:50:32.671627998 CET	443	59374	18.154.219.68	192.168.2.16
Nov 12, 2024 16:50:32.671948910 CET	59374	443	192.168.2.16	18.154.219.68
Nov 12, 2024 16:50:32.671953917 CET	443	59374	18.154.219.68	192.168.2.16
Nov 12, 2024 16:50:32.673013926 CET	443	59374	18.154.219.68	192.168.2.16
Nov 12, 2024 16:50:32.673079014 CET	59374	443	192.168.2.16	18.154.219.68
Nov 12, 2024 16:50:32.674784899 CET	59374	443	192.168.2.16	18.154.219.68
Nov 12, 2024 16:50:32.674813032 CET	59374	443	192.168.2.16	18.154.219.68
Nov 12, 2024 16:50:32.674928904 CET	443	59374	18.154.219.68	192.168.2.16
Nov 12, 2024 16:50:32.674973965 CET	59374	443	192.168.2.16	18.154.219.68
Nov 12, 2024 16:50:32.675101042 CET	59375	443	192.168.2.16	18.154.219.19
Nov 12, 2024 16:50:32.675142050 CET	443	59375	18.154.219.19	192.168.2.16
Nov 12, 2024 16:50:32.675223112 CET	59375	443	192.168.2.16	18.154.219.19
Nov 12, 2024 16:50:32.675894022 CET	59375	443	192.168.2.16	18.154.219.19
Nov 12, 2024 16:50:32.675906897 CET	443	59375	18.154.219.19	192.168.2.16
Nov 12, 2024 16:50:33.293720961 CET	443	59375	18.154.219.19	192.168.2.16
Nov 12, 2024 16:50:33.293910027 CET	59375	443	192.168.2.16	18.154.219.19
Nov 12, 2024 16:50:33.293936014 CET	443	59375	18.154.219.19	192.168.2.16
Nov 12, 2024 16:50:33.294331074 CET	59375	443	192.168.2.16	18.154.219.19
Nov 12, 2024 16:50:33.294336081 CET	443	59375	18.154.219.19	192.168.2.16
Nov 12, 2024 16:50:33.295450926 CET	443	59375	18.154.219.19	192.168.2.16
Nov 12, 2024 16:50:33.295533895 CET	59375	443	192.168.2.16	18.154.219.19
Nov 12, 2024 16:50:33.297245026 CET	59375	443	192.168.2.16	18.154.219.19
Nov 12, 2024 16:50:33.297276020 CET	59375	443	192.168.2.16	18.154.219.19
Nov 12, 2024 16:50:33.297400951 CET	443	59375	18.154.219.19	192.168.2.16
Nov 12, 2024 16:50:33.297456026 CET	59375	443	192.168.2.16	18.154.219.19
Nov 12, 2024 16:50:33.297590017 CET	59376	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:33.302536964 CET	853	59376	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:33.302664042 CET	59376	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:33.303334951 CET	59376	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:33.308178902 CET	853	59376	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:33.928390026 CET	853	59376	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:33.928416014 CET	853	59376	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:33.928426981 CET	853	59376	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:33.928435087 CET	853	59376	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:33.928525925 CET	59376	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:33.928577900 CET	59376	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:33.932343006 CET	59376	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:33.932404995 CET	59376	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:33.937325001 CET	853	59376	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:33.937346935 CET	853	59376	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:34.119827032 CET	853	59376	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:34.120739937 CET	59376	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:34.120780945 CET	59376	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:34.121088028 CET	59378	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:34.125729084 CET	853	59376	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:34.126099110 CET	853	59378	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:34.126198053 CET	59378	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:34.126250982 CET	853	59376	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:34.126300097 CET	59376	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:34.127624035 CET	59378	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:34.132662058 CET	853	59378	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:34.729815006 CET	853	59378	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:34.729851961 CET	853	59378	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:34.729866982 CET	853	59378	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:34.729948044 CET	59378	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:34.730010033 CET	853	59378	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:34.730050087 CET	59378	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:34.730113983 CET	853	59378	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:34.733773947 CET	59378	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:34.733818054 CET	59378	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:34.738657951 CET	853	59378	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:34.738786936 CET	853	59378	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:34.915193081 CET	853	59378	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:34.915446043 CET	59378	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:34.915484905 CET	59378	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:34.917588949 CET	59387	443	192.168.2.16	18.155.173.111
Nov 12, 2024 16:50:34.917618990 CET	443	59387	18.155.173.111	192.168.2.16
Nov 12, 2024 16:50:34.918293953 CET	59387	443	192.168.2.16	18.155.173.111
Nov 12, 2024 16:50:34.918293953 CET	59387	443	192.168.2.16	18.155.173.111
Nov 12, 2024 16:50:34.918325901 CET	443	59387	18.155.173.111	192.168.2.16
Nov 12, 2024 16:50:34.920422077 CET	853	59378	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:34.921514988 CET	853	59378	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:34.921567917 CET	59378	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:35.566279888 CET	443	59387	18.155.173.111	192.168.2.16
Nov 12, 2024 16:50:35.566451073 CET	59387	443	192.168.2.16	18.155.173.111
Nov 12, 2024 16:50:35.566478968 CET	443	59387	18.155.173.111	192.168.2.16
Nov 12, 2024 16:50:35.566819906 CET	59387	443	192.168.2.16	18.155.173.111
Nov 12, 2024 16:50:35.566827059 CET	443	59387	18.155.173.111	192.168.2.16
Nov 12, 2024 16:50:35.567857981 CET	443	59387	18.155.173.111	192.168.2.16
Nov 12, 2024 16:50:35.567920923 CET	59387	443	192.168.2.16	18.155.173.111
Nov 12, 2024 16:50:35.569545031 CET	59387	443	192.168.2.16	18.155.173.111
Nov 12, 2024 16:50:35.569575071 CET	59387	443	192.168.2.16	18.155.173.111
Nov 12, 2024 16:50:35.569699049 CET	443	59387	18.155.173.111	192.168.2.16
Nov 12, 2024 16:50:35.569750071 CET	59387	443	192.168.2.16	18.155.173.111
Nov 12, 2024 16:50:35.569879055 CET	59388	443	192.168.2.16	18.155.173.31
Nov 12, 2024 16:50:35.569925070 CET	443	59388	18.155.173.31	192.168.2.16
Nov 12, 2024 16:50:35.570008039 CET	59388	443	192.168.2.16	18.155.173.31
Nov 12, 2024 16:50:35.570580959 CET	59388	443	192.168.2.16	18.155.173.31
Nov 12, 2024 16:50:35.570594072 CET	443	59388	18.155.173.31	192.168.2.16
Nov 12, 2024 16:50:36.218278885 CET	443	59388	18.155.173.31	192.168.2.16
Nov 12, 2024 16:50:36.218514919 CET	59388	443	192.168.2.16	18.155.173.31
Nov 12, 2024 16:50:36.218568087 CET	443	59388	18.155.173.31	192.168.2.16
Nov 12, 2024 16:50:36.218835115 CET	59388	443	192.168.2.16	18.155.173.31
Nov 12, 2024 16:50:36.218841076 CET	443	59388	18.155.173.31	192.168.2.16
Nov 12, 2024 16:50:36.219914913 CET	443	59388	18.155.173.31	192.168.2.16
Nov 12, 2024 16:50:36.220005989 CET	59388	443	192.168.2.16	18.155.173.31
Nov 12, 2024 16:50:36.221625090 CET	59388	443	192.168.2.16	18.155.173.31
Nov 12, 2024 16:50:36.221654892 CET	59388	443	192.168.2.16	18.155.173.31
Nov 12, 2024 16:50:36.221771955 CET	443	59388	18.155.173.31	192.168.2.16
Nov 12, 2024 16:50:36.221827030 CET	59388	443	192.168.2.16	18.155.173.31
Nov 12, 2024 16:50:36.221920013 CET	59389	443	192.168.2.16	18.155.173.98
Nov 12, 2024 16:50:36.221957922 CET	443	59389	18.155.173.98	192.168.2.16
Nov 12, 2024 16:50:36.222042084 CET	59389	443	192.168.2.16	18.155.173.98
Nov 12, 2024 16:50:36.223014116 CET	59389	443	192.168.2.16	18.155.173.98
Nov 12, 2024 16:50:36.223027945 CET	443	59389	18.155.173.98	192.168.2.16
Nov 12, 2024 16:50:36.878232002 CET	443	59389	18.155.173.98	192.168.2.16
Nov 12, 2024 16:50:36.878437996 CET	59389	443	192.168.2.16	18.155.173.98
Nov 12, 2024 16:50:36.878451109 CET	443	59389	18.155.173.98	192.168.2.16
Nov 12, 2024 16:50:36.878921986 CET	59389	443	192.168.2.16	18.155.173.98
Nov 12, 2024 16:50:36.878927946 CET	443	59389	18.155.173.98	192.168.2.16
Nov 12, 2024 16:50:36.880070925 CET	443	59389	18.155.173.98	192.168.2.16
Nov 12, 2024 16:50:36.880137920 CET	59389	443	192.168.2.16	18.155.173.98
Nov 12, 2024 16:50:36.882637978 CET	59389	443	192.168.2.16	18.155.173.98
Nov 12, 2024 16:50:36.882678032 CET	59389	443	192.168.2.16	18.155.173.98
Nov 12, 2024 16:50:36.882812023 CET	443	59389	18.155.173.98	192.168.2.16
Nov 12, 2024 16:50:36.882858038 CET	59389	443	192.168.2.16	18.155.173.98
Nov 12, 2024 16:50:36.883044004 CET	59390	443	192.168.2.16	18.155.173.66
Nov 12, 2024 16:50:36.883093119 CET	443	59390	18.155.173.66	192.168.2.16
Nov 12, 2024 16:50:36.883173943 CET	59390	443	192.168.2.16	18.155.173.66
Nov 12, 2024 16:50:36.883975983 CET	59390	443	192.168.2.16	18.155.173.66
Nov 12, 2024 16:50:36.883990049 CET	443	59390	18.155.173.66	192.168.2.16
Nov 12, 2024 16:50:37.864048958 CET	443	59390	18.155.173.66	192.168.2.16
Nov 12, 2024 16:50:37.864243984 CET	59390	443	192.168.2.16	18.155.173.66
Nov 12, 2024 16:50:37.864264011 CET	443	59390	18.155.173.66	192.168.2.16
Nov 12, 2024 16:50:37.864573956 CET	59390	443	192.168.2.16	18.155.173.66
Nov 12, 2024 16:50:37.864579916 CET	443	59390	18.155.173.66	192.168.2.16
Nov 12, 2024 16:50:37.865709066 CET	443	59390	18.155.173.66	192.168.2.16
Nov 12, 2024 16:50:37.865771055 CET	59390	443	192.168.2.16	18.155.173.66
Nov 12, 2024 16:50:37.867413998 CET	59390	443	192.168.2.16	18.155.173.66
Nov 12, 2024 16:50:37.867444992 CET	59390	443	192.168.2.16	18.155.173.66
Nov 12, 2024 16:50:37.867583990 CET	443	59390	18.155.173.66	192.168.2.16
Nov 12, 2024 16:50:37.867636919 CET	59390	443	192.168.2.16	18.155.173.66
Nov 12, 2024 16:50:37.867758036 CET	59391	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:37.872555017 CET	853	59391	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:37.872636080 CET	59391	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:37.873339891 CET	59391	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:37.878133059 CET	853	59391	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:38.207988977 CET	59392	443	192.168.2.16	142.250.186.164
Nov 12, 2024 16:50:38.208050966 CET	443	59392	142.250.186.164	192.168.2.16
Nov 12, 2024 16:50:38.208148003 CET	59392	443	192.168.2.16	142.250.186.164
Nov 12, 2024 16:50:38.208391905 CET	59392	443	192.168.2.16	142.250.186.164
Nov 12, 2024 16:50:38.208406925 CET	443	59392	142.250.186.164	192.168.2.16
Nov 12, 2024 16:50:38.466389894 CET	853	59391	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:38.466411114 CET	853	59391	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:38.466422081 CET	853	59391	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:38.466434002 CET	853	59391	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:38.466490030 CET	59391	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:38.466526985 CET	59391	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:38.518429995 CET	59391	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:38.518470049 CET	59391	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:38.523257017 CET	853	59391	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:38.523267031 CET	853	59391	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:38.641355991 CET	853	59391	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:38.641372919 CET	853	59391	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:38.641448021 CET	59391	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:38.756287098 CET	853	59391	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:38.756561995 CET	59391	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:38.756606102 CET	59391	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:38.756927967 CET	59393	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:38.761364937 CET	853	59391	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:38.761677980 CET	853	59391	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:38.761703014 CET	853	59393	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:38.761739969 CET	59391	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:38.761845112 CET	59393	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:38.762531996 CET	59393	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:38.767292023 CET	853	59393	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:39.063688993 CET	443	59392	142.250.186.164	192.168.2.16
Nov 12, 2024 16:50:39.064071894 CET	59392	443	192.168.2.16	142.250.186.164
Nov 12, 2024 16:50:39.064095020 CET	443	59392	142.250.186.164	192.168.2.16
Nov 12, 2024 16:50:39.064457893 CET	443	59392	142.250.186.164	192.168.2.16
Nov 12, 2024 16:50:39.064754963 CET	59392	443	192.168.2.16	142.250.186.164
Nov 12, 2024 16:50:39.064824104 CET	443	59392	142.250.186.164	192.168.2.16
Nov 12, 2024 16:50:39.108084917 CET	59392	443	192.168.2.16	142.250.186.164
Nov 12, 2024 16:50:39.353930950 CET	853	59393	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:39.353955984 CET	853	59393	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:39.353966951 CET	853	59393	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:39.353979111 CET	853	59393	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:39.354072094 CET	59393	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:39.354130983 CET	59393	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:39.424256086 CET	59393	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:39.424298048 CET	59393	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:39.429122925 CET	853	59393	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:39.429229975 CET	853	59393	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:39.548983097 CET	853	59393	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:39.565553904 CET	853	59393	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:39.565649986 CET	59393	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:39.565711975 CET	59393	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:39.565745115 CET	59393	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:39.568252087 CET	59402	443	192.168.2.16	99.86.102.89
Nov 12, 2024 16:50:39.568305016 CET	443	59402	99.86.102.89	192.168.2.16
Nov 12, 2024 16:50:39.568397045 CET	59402	443	192.168.2.16	99.86.102.89
Nov 12, 2024 16:50:39.569422007 CET	59402	443	192.168.2.16	99.86.102.89
Nov 12, 2024 16:50:39.569442987 CET	443	59402	99.86.102.89	192.168.2.16
Nov 12, 2024 16:50:39.570600033 CET	853	59393	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:39.571187973 CET	853	59393	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:39.571243048 CET	59393	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:40.193233967 CET	443	59402	99.86.102.89	192.168.2.16
Nov 12, 2024 16:50:40.193479061 CET	59402	443	192.168.2.16	99.86.102.89
Nov 12, 2024 16:50:40.193509102 CET	443	59402	99.86.102.89	192.168.2.16
Nov 12, 2024 16:50:40.193840981 CET	59402	443	192.168.2.16	99.86.102.89
Nov 12, 2024 16:50:40.193845987 CET	443	59402	99.86.102.89	192.168.2.16
Nov 12, 2024 16:50:40.194741011 CET	443	59402	99.86.102.89	192.168.2.16
Nov 12, 2024 16:50:40.194817066 CET	59402	443	192.168.2.16	99.86.102.89
Nov 12, 2024 16:50:40.196445942 CET	59402	443	192.168.2.16	99.86.102.89
Nov 12, 2024 16:50:40.196481943 CET	59402	443	192.168.2.16	99.86.102.89
Nov 12, 2024 16:50:40.196583033 CET	443	59402	99.86.102.89	192.168.2.16
Nov 12, 2024 16:50:40.196640015 CET	59402	443	192.168.2.16	99.86.102.89
Nov 12, 2024 16:50:40.196865082 CET	59403	443	192.168.2.16	99.86.102.13
Nov 12, 2024 16:50:40.196907997 CET	443	59403	99.86.102.13	192.168.2.16
Nov 12, 2024 16:50:40.196990967 CET	59403	443	192.168.2.16	99.86.102.13
Nov 12, 2024 16:50:40.197566032 CET	59403	443	192.168.2.16	99.86.102.13
Nov 12, 2024 16:50:40.197591066 CET	443	59403	99.86.102.13	192.168.2.16
Nov 12, 2024 16:50:40.815088034 CET	443	59403	99.86.102.13	192.168.2.16
Nov 12, 2024 16:50:40.815306902 CET	59403	443	192.168.2.16	99.86.102.13
Nov 12, 2024 16:50:40.815330982 CET	443	59403	99.86.102.13	192.168.2.16
Nov 12, 2024 16:50:40.815644026 CET	59403	443	192.168.2.16	99.86.102.13
Nov 12, 2024 16:50:40.815649986 CET	443	59403	99.86.102.13	192.168.2.16
Nov 12, 2024 16:50:40.816620111 CET	443	59403	99.86.102.13	192.168.2.16
Nov 12, 2024 16:50:40.816692114 CET	59403	443	192.168.2.16	99.86.102.13
Nov 12, 2024 16:50:40.818317890 CET	59403	443	192.168.2.16	99.86.102.13
Nov 12, 2024 16:50:40.818346977 CET	59403	443	192.168.2.16	99.86.102.13
Nov 12, 2024 16:50:40.818461895 CET	443	59403	99.86.102.13	192.168.2.16
Nov 12, 2024 16:50:40.818511963 CET	59403	443	192.168.2.16	99.86.102.13
Nov 12, 2024 16:50:40.818646908 CET	59404	443	192.168.2.16	99.86.102.129
Nov 12, 2024 16:50:40.818681002 CET	443	59404	99.86.102.129	192.168.2.16
Nov 12, 2024 16:50:40.818768024 CET	59404	443	192.168.2.16	99.86.102.129
Nov 12, 2024 16:50:40.819447994 CET	59404	443	192.168.2.16	99.86.102.129
Nov 12, 2024 16:50:40.819462061 CET	443	59404	99.86.102.129	192.168.2.16
Nov 12, 2024 16:50:41.444267035 CET	443	59404	99.86.102.129	192.168.2.16
Nov 12, 2024 16:50:41.444462061 CET	59404	443	192.168.2.16	99.86.102.129
Nov 12, 2024 16:50:41.444482088 CET	443	59404	99.86.102.129	192.168.2.16
Nov 12, 2024 16:50:41.444802999 CET	59404	443	192.168.2.16	99.86.102.129
Nov 12, 2024 16:50:41.444808960 CET	443	59404	99.86.102.129	192.168.2.16
Nov 12, 2024 16:50:41.445874929 CET	443	59404	99.86.102.129	192.168.2.16
Nov 12, 2024 16:50:41.445952892 CET	59404	443	192.168.2.16	99.86.102.129
Nov 12, 2024 16:50:41.447530985 CET	59404	443	192.168.2.16	99.86.102.129
Nov 12, 2024 16:50:41.447560072 CET	59404	443	192.168.2.16	99.86.102.129
Nov 12, 2024 16:50:41.447673082 CET	443	59404	99.86.102.129	192.168.2.16
Nov 12, 2024 16:50:41.447720051 CET	59404	443	192.168.2.16	99.86.102.129
Nov 12, 2024 16:50:41.447839975 CET	59405	443	192.168.2.16	99.86.102.19
Nov 12, 2024 16:50:41.447870970 CET	443	59405	99.86.102.19	192.168.2.16
Nov 12, 2024 16:50:41.447952986 CET	59405	443	192.168.2.16	99.86.102.19
Nov 12, 2024 16:50:41.448558092 CET	59405	443	192.168.2.16	99.86.102.19
Nov 12, 2024 16:50:41.448573112 CET	443	59405	99.86.102.19	192.168.2.16
Nov 12, 2024 16:50:42.064260006 CET	443	59405	99.86.102.19	192.168.2.16
Nov 12, 2024 16:50:42.064477921 CET	59405	443	192.168.2.16	99.86.102.19
Nov 12, 2024 16:50:42.064495087 CET	443	59405	99.86.102.19	192.168.2.16
Nov 12, 2024 16:50:42.064810038 CET	59405	443	192.168.2.16	99.86.102.19
Nov 12, 2024 16:50:42.064815044 CET	443	59405	99.86.102.19	192.168.2.16
Nov 12, 2024 16:50:42.065694094 CET	443	59405	99.86.102.19	192.168.2.16
Nov 12, 2024 16:50:42.065776110 CET	59405	443	192.168.2.16	99.86.102.19
Nov 12, 2024 16:50:42.067615032 CET	59405	443	192.168.2.16	99.86.102.19
Nov 12, 2024 16:50:42.067681074 CET	59405	443	192.168.2.16	99.86.102.19
Nov 12, 2024 16:50:42.067732096 CET	443	59405	99.86.102.19	192.168.2.16
Nov 12, 2024 16:50:42.067790031 CET	59405	443	192.168.2.16	99.86.102.19
Nov 12, 2024 16:50:44.075954914 CET	59409	443	192.168.2.16	18.239.18.47
Nov 12, 2024 16:50:44.075985909 CET	443	59409	18.239.18.47	192.168.2.16
Nov 12, 2024 16:50:44.076095104 CET	59409	443	192.168.2.16	18.239.18.47
Nov 12, 2024 16:50:44.076721907 CET	59409	443	192.168.2.16	18.239.18.47
Nov 12, 2024 16:50:44.076729059 CET	443	59409	18.239.18.47	192.168.2.16
Nov 12, 2024 16:50:44.920648098 CET	443	59409	18.239.18.47	192.168.2.16
Nov 12, 2024 16:50:44.920859098 CET	59409	443	192.168.2.16	18.239.18.47
Nov 12, 2024 16:50:44.920877934 CET	443	59409	18.239.18.47	192.168.2.16
Nov 12, 2024 16:50:44.921195984 CET	59409	443	192.168.2.16	18.239.18.47
Nov 12, 2024 16:50:44.921200037 CET	443	59409	18.239.18.47	192.168.2.16
Nov 12, 2024 16:50:44.922081947 CET	443	59409	18.239.18.47	192.168.2.16
Nov 12, 2024 16:50:44.922152042 CET	59409	443	192.168.2.16	18.239.18.47
Nov 12, 2024 16:50:44.923815012 CET	59409	443	192.168.2.16	18.239.18.47
Nov 12, 2024 16:50:44.923837900 CET	59409	443	192.168.2.16	18.239.18.47
Nov 12, 2024 16:50:44.923949957 CET	443	59409	18.239.18.47	192.168.2.16
Nov 12, 2024 16:50:44.924010038 CET	59409	443	192.168.2.16	18.239.18.47
Nov 12, 2024 16:50:44.924221039 CET	59410	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:44.929022074 CET	853	59410	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:44.929109097 CET	59410	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:44.929706097 CET	59410	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:44.934484959 CET	853	59410	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:45.525446892 CET	853	59410	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:45.525465012 CET	853	59410	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:45.525481939 CET	853	59410	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:45.525496006 CET	853	59410	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:45.525536060 CET	59410	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:45.525583029 CET	59410	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:45.528577089 CET	59410	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:45.528637886 CET	59410	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:45.533375025 CET	853	59410	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:45.533485889 CET	853	59410	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:45.694617033 CET	853	59410	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:45.694869995 CET	59410	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:45.694910049 CET	59410	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:45.695259094 CET	59411	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:45.699801922 CET	853	59410	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:45.700226068 CET	853	59411	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:45.700268030 CET	853	59410	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:45.700314045 CET	59411	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:45.700345039 CET	59410	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:45.701123953 CET	59411	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:45.706232071 CET	853	59411	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:46.516330957 CET	853	59411	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:46.516349077 CET	853	59411	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:46.516360044 CET	853	59411	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:46.516371012 CET	853	59411	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:46.516402960 CET	853	59411	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:46.516408920 CET	59411	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:46.516472101 CET	59411	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:46.519222021 CET	59411	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:46.519268990 CET	59411	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:46.524164915 CET	853	59411	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:46.524175882 CET	853	59411	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:46.685224056 CET	853	59411	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:46.685448885 CET	59411	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:46.685475111 CET	59411	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:46.688812971 CET	59420	443	192.168.2.16	18.154.219.118
Nov 12, 2024 16:50:46.688849926 CET	443	59420	18.154.219.118	192.168.2.16
Nov 12, 2024 16:50:46.688987970 CET	59420	443	192.168.2.16	18.154.219.118
Nov 12, 2024 16:50:46.689699888 CET	59420	443	192.168.2.16	18.154.219.118
Nov 12, 2024 16:50:46.689716101 CET	443	59420	18.154.219.118	192.168.2.16
Nov 12, 2024 16:50:46.690428019 CET	853	59411	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:46.690992117 CET	853	59411	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:46.691040039 CET	59411	853	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:47.707957029 CET	443	59420	18.154.219.118	192.168.2.16
Nov 12, 2024 16:50:47.708158016 CET	59420	443	192.168.2.16	18.154.219.118
Nov 12, 2024 16:50:47.708172083 CET	443	59420	18.154.219.118	192.168.2.16
Nov 12, 2024 16:50:47.708503962 CET	59420	443	192.168.2.16	18.154.219.118
Nov 12, 2024 16:50:47.708508968 CET	443	59420	18.154.219.118	192.168.2.16
Nov 12, 2024 16:50:47.709414005 CET	443	59420	18.154.219.118	192.168.2.16
Nov 12, 2024 16:50:47.709484100 CET	59420	443	192.168.2.16	18.154.219.118
Nov 12, 2024 16:50:47.711086035 CET	59420	443	192.168.2.16	18.154.219.118
Nov 12, 2024 16:50:47.711119890 CET	59420	443	192.168.2.16	18.154.219.118
Nov 12, 2024 16:50:47.711222887 CET	443	59420	18.154.219.118	192.168.2.16
Nov 12, 2024 16:50:47.711272001 CET	59420	443	192.168.2.16	18.154.219.118
Nov 12, 2024 16:50:47.711432934 CET	59421	443	192.168.2.16	18.154.219.19
Nov 12, 2024 16:50:47.711463928 CET	443	59421	18.154.219.19	192.168.2.16
Nov 12, 2024 16:50:47.711544991 CET	59421	443	192.168.2.16	18.154.219.19
Nov 12, 2024 16:50:47.712188959 CET	59421	443	192.168.2.16	18.154.219.19
Nov 12, 2024 16:50:47.712203979 CET	443	59421	18.154.219.19	192.168.2.16
Nov 12, 2024 16:50:48.340610027 CET	443	59421	18.154.219.19	192.168.2.16
Nov 12, 2024 16:50:48.340817928 CET	59421	443	192.168.2.16	18.154.219.19
Nov 12, 2024 16:50:48.340846062 CET	443	59421	18.154.219.19	192.168.2.16
Nov 12, 2024 16:50:48.341164112 CET	59421	443	192.168.2.16	18.154.219.19
Nov 12, 2024 16:50:48.341169119 CET	443	59421	18.154.219.19	192.168.2.16
Nov 12, 2024 16:50:48.342061996 CET	443	59421	18.154.219.19	192.168.2.16
Nov 12, 2024 16:50:48.342133999 CET	59421	443	192.168.2.16	18.154.219.19
Nov 12, 2024 16:50:48.343525887 CET	59421	443	192.168.2.16	18.154.219.19
Nov 12, 2024 16:50:48.343553066 CET	59421	443	192.168.2.16	18.154.219.19
Nov 12, 2024 16:50:48.343663931 CET	443	59421	18.154.219.19	192.168.2.16
Nov 12, 2024 16:50:48.343707085 CET	59421	443	192.168.2.16	18.154.219.19
Nov 12, 2024 16:50:48.343895912 CET	59422	443	192.168.2.16	18.154.219.78
Nov 12, 2024 16:50:48.343923092 CET	443	59422	18.154.219.78	192.168.2.16
Nov 12, 2024 16:50:48.344001055 CET	59422	443	192.168.2.16	18.154.219.78
Nov 12, 2024 16:50:48.344575882 CET	59422	443	192.168.2.16	18.154.219.78
Nov 12, 2024 16:50:48.344588041 CET	443	59422	18.154.219.78	192.168.2.16
Nov 12, 2024 16:50:48.958456993 CET	443	59422	18.154.219.78	192.168.2.16
Nov 12, 2024 16:50:48.958676100 CET	59422	443	192.168.2.16	18.154.219.78
Nov 12, 2024 16:50:48.958697081 CET	443	59422	18.154.219.78	192.168.2.16
Nov 12, 2024 16:50:48.958998919 CET	59422	443	192.168.2.16	18.154.219.78
Nov 12, 2024 16:50:48.959003925 CET	443	59422	18.154.219.78	192.168.2.16
Nov 12, 2024 16:50:48.959903002 CET	443	59422	18.154.219.78	192.168.2.16
Nov 12, 2024 16:50:48.959969044 CET	59422	443	192.168.2.16	18.154.219.78
Nov 12, 2024 16:50:48.961513996 CET	59422	443	192.168.2.16	18.154.219.78
Nov 12, 2024 16:50:48.961546898 CET	59422	443	192.168.2.16	18.154.219.78
Nov 12, 2024 16:50:48.961637020 CET	443	59422	18.154.219.78	192.168.2.16
Nov 12, 2024 16:50:48.961680889 CET	59422	443	192.168.2.16	18.154.219.78
Nov 12, 2024 16:50:48.961833954 CET	59423	443	192.168.2.16	18.154.219.68
Nov 12, 2024 16:50:48.961858988 CET	443	59423	18.154.219.68	192.168.2.16
Nov 12, 2024 16:50:48.961956024 CET	59423	443	192.168.2.16	18.154.219.68
Nov 12, 2024 16:50:48.962724924 CET	59423	443	192.168.2.16	18.154.219.68
Nov 12, 2024 16:50:48.962733984 CET	443	59423	18.154.219.68	192.168.2.16
Nov 12, 2024 16:50:49.079520941 CET	443	59392	142.250.186.164	192.168.2.16
Nov 12, 2024 16:50:49.079581976 CET	443	59392	142.250.186.164	192.168.2.16
Nov 12, 2024 16:50:49.079632044 CET	59392	443	192.168.2.16	142.250.186.164
Nov 12, 2024 16:50:49.805866003 CET	443	59423	18.154.219.68	192.168.2.16
Nov 12, 2024 16:50:49.807209015 CET	59423	443	192.168.2.16	18.154.219.68
Nov 12, 2024 16:50:49.807234049 CET	443	59423	18.154.219.68	192.168.2.16
Nov 12, 2024 16:50:49.807594061 CET	59423	443	192.168.2.16	18.154.219.68
Nov 12, 2024 16:50:49.807600021 CET	443	59423	18.154.219.68	192.168.2.16
Nov 12, 2024 16:50:49.808494091 CET	443	59423	18.154.219.68	192.168.2.16
Nov 12, 2024 16:50:49.808568954 CET	59423	443	192.168.2.16	18.154.219.68
Nov 12, 2024 16:50:49.810349941 CET	59423	443	192.168.2.16	18.154.219.68
Nov 12, 2024 16:50:49.810376883 CET	59423	443	192.168.2.16	18.154.219.68
Nov 12, 2024 16:50:49.810498953 CET	443	59423	18.154.219.68	192.168.2.16
Nov 12, 2024 16:50:49.810570955 CET	59423	443	192.168.2.16	18.154.219.68
Nov 12, 2024 16:50:49.810693026 CET	59424	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:49.815545082 CET	853	59424	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:49.815639973 CET	59424	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:49.816250086 CET	59424	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:49.822062969 CET	853	59424	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:49.908608913 CET	59392	443	192.168.2.16	142.250.186.164
Nov 12, 2024 16:50:49.908668995 CET	443	59392	142.250.186.164	192.168.2.16
Nov 12, 2024 16:50:50.685559034 CET	853	59424	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:50.685579062 CET	853	59424	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:50.685587883 CET	853	59424	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:50.685630083 CET	853	59424	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:50.685642004 CET	853	59424	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:50.685663939 CET	59424	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:50.685669899 CET	853	59424	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:50.685699940 CET	59424	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:50.685713053 CET	59424	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:50.685786009 CET	853	59424	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:50.685825109 CET	59424	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:50.697647095 CET	59424	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:50.697694063 CET	59424	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:50.702477932 CET	853	59424	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:50.702536106 CET	853	59424	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:50.824604034 CET	853	59424	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:50.824848890 CET	59424	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:50.824881077 CET	59424	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:50.825205088 CET	59425	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:50.829715014 CET	853	59424	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:50.829973936 CET	853	59425	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:50.830049992 CET	59425	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:50.830703974 CET	59425	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:50.830851078 CET	853	59424	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:50.830904007 CET	59424	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:50.835556030 CET	853	59425	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:51.434315920 CET	853	59425	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:51.434334993 CET	853	59425	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:51.434353113 CET	853	59425	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:51.434429884 CET	59425	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:51.434511900 CET	853	59425	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:51.434555054 CET	59425	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:51.437863111 CET	59425	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:51.437863111 CET	59425	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:51.442872047 CET	853	59425	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:51.442884922 CET	853	59425	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:51.603715897 CET	853	59425	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:51.603919029 CET	59425	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:51.603957891 CET	59425	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:51.605868101 CET	59434	443	192.168.2.16	18.155.173.98
Nov 12, 2024 16:50:51.605902910 CET	443	59434	18.155.173.98	192.168.2.16
Nov 12, 2024 16:50:51.605977058 CET	59434	443	192.168.2.16	18.155.173.98
Nov 12, 2024 16:50:51.606564999 CET	59434	443	192.168.2.16	18.155.173.98
Nov 12, 2024 16:50:51.606579065 CET	443	59434	18.155.173.98	192.168.2.16
Nov 12, 2024 16:50:51.608808994 CET	853	59425	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:51.609652996 CET	853	59425	8.8.8.8	192.168.2.16
Nov 12, 2024 16:50:51.609705925 CET	59425	853	192.168.2.16	8.8.8.8
Nov 12, 2024 16:50:52.286933899 CET	443	59434	18.155.173.98	192.168.2.16
Nov 12, 2024 16:50:52.287105083 CET	59434	443	192.168.2.16	18.155.173.98
Nov 12, 2024 16:50:52.287130117 CET	443	59434	18.155.173.98	192.168.2.16
Nov 12, 2024 16:50:52.287421942 CET	59434	443	192.168.2.16	18.155.173.98
Nov 12, 2024 16:50:52.287425995 CET	443	59434	18.155.173.98	192.168.2.16
Nov 12, 2024 16:50:52.288484097 CET	443	59434	18.155.173.98	192.168.2.16
Nov 12, 2024 16:50:52.288554907 CET	59434	443	192.168.2.16	18.155.173.98
Nov 12, 2024 16:50:52.290149927 CET	59434	443	192.168.2.16	18.155.173.98
Nov 12, 2024 16:50:52.290178061 CET	59434	443	192.168.2.16	18.155.173.98
Nov 12, 2024 16:50:52.290309906 CET	443	59434	18.155.173.98	192.168.2.16
Nov 12, 2024 16:50:52.290363073 CET	59434	443	192.168.2.16	18.155.173.98
Nov 12, 2024 16:50:52.290451050 CET	59435	443	192.168.2.16	18.155.173.111
Nov 12, 2024 16:50:52.290496111 CET	443	59435	18.155.173.111	192.168.2.16
Nov 12, 2024 16:50:52.290580034 CET	59435	443	192.168.2.16	18.155.173.111
Nov 12, 2024 16:50:52.291280031 CET	59435	443	192.168.2.16	18.155.173.111
Nov 12, 2024 16:50:52.291301012 CET	443	59435	18.155.173.111	192.168.2.16
Nov 12, 2024 16:50:53.282305002 CET	443	59435	18.155.173.111	192.168.2.16
Nov 12, 2024 16:50:53.282543898 CET	59435	443	192.168.2.16	18.155.173.111
Nov 12, 2024 16:50:53.282569885 CET	443	59435	18.155.173.111	192.168.2.16
Nov 12, 2024 16:50:53.282901049 CET	59435	443	192.168.2.16	18.155.173.111
Nov 12, 2024 16:50:53.282907009 CET	443	59435	18.155.173.111	192.168.2.16
Nov 12, 2024 16:50:53.283972979 CET	443	59435	18.155.173.111	192.168.2.16
Nov 12, 2024 16:50:53.284061909 CET	59435	443	192.168.2.16	18.155.173.111
Nov 12, 2024 16:50:53.285651922 CET	59435	443	192.168.2.16	18.155.173.111
Nov 12, 2024 16:50:53.285679102 CET	59435	443	192.168.2.16	18.155.173.111
Nov 12, 2024 16:50:53.285788059 CET	443	59435	18.155.173.111	192.168.2.16
Nov 12, 2024 16:50:53.285844088 CET	59435	443	192.168.2.16	18.155.173.111
Nov 12, 2024 16:50:53.285990953 CET	59436	443	192.168.2.16	18.155.173.66
Nov 12, 2024 16:50:53.286016941 CET	443	59436	18.155.173.66	192.168.2.16
Nov 12, 2024 16:50:53.286098957 CET	59436	443	192.168.2.16	18.155.173.66
Nov 12, 2024 16:50:53.286665916 CET	59436	443	192.168.2.16	18.155.173.66
Nov 12, 2024 16:50:53.286681890 CET	443	59436	18.155.173.66	192.168.2.16
Nov 12, 2024 16:50:53.941823006 CET	443	59436	18.155.173.66	192.168.2.16
Nov 12, 2024 16:50:53.942038059 CET	59436	443	192.168.2.16	18.155.173.66
Nov 12, 2024 16:50:53.942070961 CET	443	59436	18.155.173.66	192.168.2.16
Nov 12, 2024 16:50:53.942420959 CET	59436	443	192.168.2.16	18.155.173.66
Nov 12, 2024 16:50:53.942429066 CET	443	59436	18.155.173.66	192.168.2.16
Nov 12, 2024 16:50:53.943324089 CET	443	59436	18.155.173.66	192.168.2.16
Nov 12, 2024 16:50:53.943396091 CET	59436	443	192.168.2.16	18.155.173.66
Nov 12, 2024 16:50:53.945189953 CET	59436	443	192.168.2.16	18.155.173.66
Nov 12, 2024 16:50:53.945218086 CET	59436	443	192.168.2.16	18.155.173.66
Nov 12, 2024 16:50:53.945338011 CET	443	59436	18.155.173.66	192.168.2.16
Nov 12, 2024 16:50:53.945388079 CET	59436	443	192.168.2.16	18.155.173.66
Nov 12, 2024 16:50:53.945492983 CET	59437	443	192.168.2.16	18.155.173.31
Nov 12, 2024 16:50:53.945518970 CET	443	59437	18.155.173.31	192.168.2.16
Nov 12, 2024 16:50:53.945595980 CET	59437	443	192.168.2.16	18.155.173.31
Nov 12, 2024 16:50:53.946199894 CET	59437	443	192.168.2.16	18.155.173.31
Nov 12, 2024 16:50:53.946217060 CET	443	59437	18.155.173.31	192.168.2.16
Nov 12, 2024 16:50:54.593031883 CET	443	59437	18.155.173.31	192.168.2.16
Nov 12, 2024 16:50:54.645564079 CET	59437	443	192.168.2.16	18.155.173.31
Nov 12, 2024 16:50:58.448730946 CET	59437	443	192.168.2.16	18.155.173.31
Nov 12, 2024 16:50:58.448772907 CET	443	59437	18.155.173.31	192.168.2.16
Nov 12, 2024 16:50:58.449065924 CET	59437	443	192.168.2.16	18.155.173.31
Nov 12, 2024 16:50:58.449074984 CET	443	59437	18.155.173.31	192.168.2.16
Nov 12, 2024 16:50:58.450124979 CET	443	59437	18.155.173.31	192.168.2.16
Nov 12, 2024 16:50:58.450140953 CET	443	59437	18.155.173.31	192.168.2.16
Nov 12, 2024 16:50:58.450213909 CET	59437	443	192.168.2.16	18.155.173.31
Nov 12, 2024 16:50:58.451816082 CET	59437	443	192.168.2.16	18.155.173.31
Nov 12, 2024 16:50:58.451816082 CET	59437	443	192.168.2.16	18.155.173.31
Nov 12, 2024 16:50:58.452003002 CET	443	59437	18.155.173.31	192.168.2.16
Nov 12, 2024 16:50:58.452048063 CET	59438	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:58.452058077 CET	59437	443	192.168.2.16	18.155.173.31
Nov 12, 2024 16:50:58.457887888 CET	853	59438	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:58.458107948 CET	59438	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:58.458811045 CET	59438	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:58.463716030 CET	853	59438	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:59.083237886 CET	853	59438	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:59.083259106 CET	853	59438	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:59.083272934 CET	853	59438	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:59.083295107 CET	853	59438	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:59.083360910 CET	59438	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:59.083411932 CET	59438	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:59.118648052 CET	59438	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:59.118710041 CET	59438	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:59.123584986 CET	853	59438	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:59.123596907 CET	853	59438	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:59.247776031 CET	853	59438	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:59.247790098 CET	853	59438	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:59.247864008 CET	59438	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:59.248013020 CET	853	59438	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:59.248167038 CET	59438	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:59.248182058 CET	59438	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:59.248467922 CET	59439	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:59.252978086 CET	853	59438	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:59.253338099 CET	853	59439	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:59.253412962 CET	59439	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:59.253547907 CET	853	59438	9.9.9.9	192.168.2.16
Nov 12, 2024 16:50:59.253593922 CET	59438	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:59.254002094 CET	59439	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:50:59.258805037 CET	853	59439	9.9.9.9	192.168.2.16
Nov 12, 2024 16:51:00.217909098 CET	853	59439	9.9.9.9	192.168.2.16
Nov 12, 2024 16:51:00.217924118 CET	853	59439	9.9.9.9	192.168.2.16
Nov 12, 2024 16:51:00.217986107 CET	853	59439	9.9.9.9	192.168.2.16
Nov 12, 2024 16:51:00.217997074 CET	853	59439	9.9.9.9	192.168.2.16
Nov 12, 2024 16:51:00.218012094 CET	59439	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:51:00.218055010 CET	59439	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:51:00.218118906 CET	853	59439	9.9.9.9	192.168.2.16
Nov 12, 2024 16:51:00.218159914 CET	59439	853	192.168.2.16	9.9.9.9
Nov 12, 2024 16:51:00.218641043 CET	853	59439	9.9.9.9	192.168.2.16
Nov 12, 2024 16:51:00.218683004 CET	59439	853	192.168.2.16	9.9.9.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 16:49:33.395092964 CET	53	61044	1.1.1.1	192.168.2.16
Nov 12, 2024 16:49:33.626003027 CET	53	51831	1.1.1.1	192.168.2.16
Nov 12, 2024 16:49:33.637200117 CET	53	54493	1.1.1.1	192.168.2.16
Nov 12, 2024 16:49:34.891644001 CET	53	62761	1.1.1.1	192.168.2.16
Nov 12, 2024 16:49:37.920691013 CET	53903	53	192.168.2.16	1.1.1.1
Nov 12, 2024 16:49:38.117069006 CET	55494	53	192.168.2.16	1.1.1.1
Nov 12, 2024 16:49:38.117204905 CET	51189	53	192.168.2.16	1.1.1.1
Nov 12, 2024 16:49:38.137974977 CET	53	55494	1.1.1.1	192.168.2.16
Nov 12, 2024 16:49:38.141597033 CET	53	51189	1.1.1.1	192.168.2.16
Nov 12, 2024 16:49:38.156147003 CET	49756	53	192.168.2.16	1.1.1.1
Nov 12, 2024 16:49:38.156147003 CET	63251	53	192.168.2.16	1.1.1.1
Nov 12, 2024 16:49:38.163186073 CET	53	49756	1.1.1.1	192.168.2.16
Nov 12, 2024 16:49:38.163273096 CET	53	63251	1.1.1.1	192.168.2.16
Nov 12, 2024 16:49:39.319768906 CET	53	63224	1.1.1.1	192.168.2.16
Nov 12, 2024 16:49:51.993637085 CET	53	65492	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:10.983829975 CET	53	49613	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:27.261476994 CET	138	138	192.168.2.16	192.168.2.255
Nov 12, 2024 16:50:28.266333103 CET	53021	53	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:28.300869942 CET	53	53021	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:33.345410109 CET	53	55207	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:33.506172895 CET	53	55165	1.1.1.1	192.168.2.16
Nov 12, 2024 16:50:46.657685995 CET	57081	53	192.168.2.16	1.1.1.1
Nov 12, 2024 16:50:46.680166006 CET	53	57081	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 12, 2024 16:49:37.920691013 CET	192.168.2.16	1.1.1.1	0x5a4d	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Nov 12, 2024 16:49:38.117069006 CET	192.168.2.16	1.1.1.1	0x58d5	Standard query (0)	agentinstall.fleetdeck.io	A (IP address)	IN (0x0001)	false
Nov 12, 2024 16:49:38.117204905 CET	192.168.2.16	1.1.1.1	0xd4db	Standard query (0)	agentinstall.fleetdeck.io	65	IN (0x0001)	false
Nov 12, 2024 16:49:38.156147003 CET	192.168.2.16	1.1.1.1	0x11bb	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 16:49:38.156147003 CET	192.168.2.16	1.1.1.1	0x8375	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 12, 2024 16:50:28.266333103 CET	192.168.2.16	1.1.1.1	0xb570	Standard query (0)	agentupdate.fleetdeck.io	A (IP address)	IN (0x0001)	false
Nov 12, 2024 16:50:46.657685995 CET	192.168.2.16	1.1.1.1	0xf991	Standard query (0)	agentupdate.fleetdeck.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 12, 2024 16:49:26.176772118 CET	1.1.1.1	192.168.2.16	0x74eb	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 12, 2024 16:49:26.176772118 CET	1.1.1.1	192.168.2.16	0x74eb	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 12, 2024 16:49:37.934190035 CET	1.1.1.1	192.168.2.16	0x5a4d	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 16:49:38.137974977 CET	1.1.1.1	192.168.2.16	0x58d5	No error (0)	agentinstall.fleetdeck.io		18.66.112.116	A (IP address)	IN (0x0001)	false
Nov 12, 2024 16:49:38.137974977 CET	1.1.1.1	192.168.2.16	0x58d5	No error (0)	agentinstall.fleetdeck.io		18.66.112.64	A (IP address)	IN (0x0001)	false
Nov 12, 2024 16:49:38.137974977 CET	1.1.1.1	192.168.2.16	0x58d5	No error (0)	agentinstall.fleetdeck.io		18.66.112.2	A (IP address)	IN (0x0001)	false
Nov 12, 2024 16:49:38.137974977 CET	1.1.1.1	192.168.2.16	0x58d5	No error (0)	agentinstall.fleetdeck.io		18.66.112.98	A (IP address)	IN (0x0001)	false
Nov 12, 2024 16:49:38.163186073 CET	1.1.1.1	192.168.2.16	0x11bb	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)	false
Nov 12, 2024 16:49:38.163273096 CET	1.1.1.1	192.168.2.16	0x8375	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 12, 2024 16:50:28.300869942 CET	1.1.1.1	192.168.2.16	0xb570	No error (0)	agentupdate.fleetdeck.io		18.239.18.47	A (IP address)	IN (0x0001)	false
Nov 12, 2024 16:50:28.300869942 CET	1.1.1.1	192.168.2.16	0xb570	No error (0)	agentupdate.fleetdeck.io		18.239.18.124	A (IP address)	IN (0x0001)	false
Nov 12, 2024 16:50:28.300869942 CET	1.1.1.1	192.168.2.16	0xb570	No error (0)	agentupdate.fleetdeck.io		18.239.18.129	A (IP address)	IN (0x0001)	false
Nov 12, 2024 16:50:28.300869942 CET	1.1.1.1	192.168.2.16	0xb570	No error (0)	agentupdate.fleetdeck.io		18.239.18.46	A (IP address)	IN (0x0001)	false
Nov 12, 2024 16:50:46.680166006 CET	1.1.1.1	192.168.2.16	0xf991	No error (0)	agentupdate.fleetdeck.io		18.172.112.118	A (IP address)	IN (0x0001)	false
Nov 12, 2024 16:50:46.680166006 CET	1.1.1.1	192.168.2.16	0xf991	No error (0)	agentupdate.fleetdeck.io		18.172.112.93	A (IP address)	IN (0x0001)	false
Nov 12, 2024 16:50:46.680166006 CET	1.1.1.1	192.168.2.16	0xf991	No error (0)	agentupdate.fleetdeck.io		18.172.112.126	A (IP address)	IN (0x0001)	false
Nov 12, 2024 16:50:46.680166006 CET	1.1.1.1	192.168.2.16	0xf991	No error (0)	agentupdate.fleetdeck.io		18.172.112.129	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

slscr.update.microsoft.com

agent.fleetdeck.io

agentinstall.fleetdeck.io

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49707	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 15:49:33 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FWbpFe63sLSlRyu&MD=XACCHnmc HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-12 15:49:34 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: f5bc500f-2cae-447f-b273-8a7f28da87cd MS-RequestId: 5d5c7167-fc23-4467-9024-df05aafe0ef0 MS-CV: GLpxtcZ8yUO7adiZ.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 12 Nov 2024 15:49:33 GMT Connection: close Content-Length: 24490
2024-11-12 15:49:34 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-12 15:49:34 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49711	18.173.205.127	443	7756	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 15:49:34 UTC	687	OUT	GET /AkKkGEnzwtzPvTHp9XURrp?win HTTP/1.1 Host: agent.fleetdeck.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 15:49:38 UTC	619	IN	HTTP/1.1 302 Found Content-Type: application/json Content-Length: 0 Connection: close Date: Tue, 12 Nov 2024 15:49:37 GMT X-Amzn-Trace-Id: Root=1-6733790e-4177a240310c589d5458a228;Parent=6e5e4dba57407f23;Sampled=0;Lineage=1:cfe0e7e4:0 x-amzn-RequestId: c6fe3129-dc71-4915-9a69-2d0cb5c62b5e x-amz-apigw-id: BI_aZGo9PHcERbQ= Location: https://agentinstall.fleetdeck.io/fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe X-Cache: Miss from cloudfront Via: 1.1 f0b5999c895f4b29c49c485a0a825d0c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P12 X-Amz-Cf-Id: 634OE4-G0ZDRDdseQPn_3lcEoZJ4DN9vsuwJgOnJOdAzcNbDm0qm8w==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49715	18.66.112.116	443	7756	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 15:49:38 UTC	710	OUT	GET /fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe HTTP/1.1 Host: agentinstall.fleetdeck.io Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 15:49:39 UTC	626	IN	HTTP/1.1 200 OK Content-Type: application/x-msdownload Content-Length: 4081208 Connection: close Date: Tue, 12 Nov 2024 15:49:40 GMT Last-Modified: Tue, 12 Nov 2024 15:49:38 GMT x-amz-expiration: expiry-date="Thu, 14 Nov 2024 00:00:00 GMT", rule-id="Yjg0OWZjMTUtNzUxNS00MDI2LWIyNWUtODcwOWQ5NDM4MWM5" ETag: "043abb0f947e2219446a8fbc8e37049b" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 edffe6978db53d114a80cda421e0b6b8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P5 X-Amz-Cf-Id: mABAQ7AmxYb-RTpmQcAivCKGwnPVwTnKo2yED648QHrdHX3i_zcpCA==
2024-11-12 15:49:39 UTC	14588	IN	Data Raw: 4d 5a 90 00 03 00 04 00 00 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 00 00 00 00 00 04 3d 00 00 00 00 00 e0 00 02 03 0b 01 03 00 00 ac 0c 00 00 80 23 00 00 00 00 00 e0 aa 05 00 00 10 00 00 00 a0 18 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 20 41 00 00 04 00 00 a7 7d 3e 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL=#@ A}>@
2024-11-12 15:49:39 UTC	2272	IN	Data Raw: 20 11 00 00 8b 44 24 04 85 c0 0f 85 68 03 00 00 8b 44 24 44 8b 08 39 48 04 0f 87 06 03 00 00 0f b6 4c 24 4c 84 c9 75 17 90 90 8b 44 24 24 89 04 24 e8 be 4b 00 00 c6 44 24 54 00 83 c4 40 c3 64 8b 05 14 00 00 00 8b 80 00 00 00 00 89 44 24 28 e8 4f 04 03 00 8b 04 24 c7 40 18 00 00 00 00 c7 40 1c 00 00 00 00 8b 4c 24 18 85 c9 0f 95 c2 8b 5c 24 1c 85 db 87 dd 0f 95 c3 87 dd 09 d5 95 84 c0 95 74 0e c7 40 18 ff ff ff ff c7 40 1c ff ff ff ff 8b 15 b0 83 7e 00 85 d2 75 16 8b 54 24 48 89 50 0c c7 40 2c 00 00 00 00 8b 6c 24 28 89 28 eb 2d 8d 78 0c 89 c2 8b 44 24 48 e8 f4 59 05 00 8d 7a 2c 89 c5 31 c0 e8 e8 59 05 00 89 d7 8b 44 24 28 e8 dd 59 05 00 89 f8 89 ea 8b 6c 24 28 c6 40 24 00 8d 78 34 8b 35 b0 83 7e 00 85 f6 75 09 8b 74 24 44 89 70 34 eb 11 89 c6 8b 44 24 44 Data Ascii: D$hD$D9HL$LuD$$$KD$T@dD$(O$@@L$\$t@@~uT$HP@,l$((-xD$HYz,1YD$(Yl$(@$x45~ut$Dp4D$D
2024-11-12 15:49:40 UTC	16384	IN	Data Raw: 89 44 24 04 e8 0b cc 02 00 90 e8 85 3d 05 00 e9 c0 fd ff ff 64 8b 0d 14 00 00 00 8b 89 00 00 00 00 3b 61 08 76 46 83 ec 08 8b 44 24 0c 8b 48 04 85 c9 75 1f 83 c0 28 89 04 24 e8 35 d0 ff ff 8b 44 24 04 85 c0 0f 95 c0 83 f0 01 88 44 24 10 83 c4 08 c3 89 04 24 e8 89 d0 ff ff 8b 44 24 04 85 c0 0f 94 c0 88 44 24 10 83 c4 08 c3 e8 23 3d 05 00 eb a1 cc 83 ec 10 8b 44 24 14 89 04 24 8b 44 24 18 89 44 24 04 c6 44 24 08 01 e8 04 00 00 00 83 c4 10 c3 64 8b 0d 14 00 00 00 8b 89 00 00 00 00 3b 61 08 0f 86 89 05 00 00 83 ec 44 8b 44 24 48 85 c0 0f 84 13 05 00 00 0f b6 4c 24 50 84 c9 74 04 31 d2 eb 18 89 04 24 e8 46 ff ff ff 0f b6 44 24 04 0f b6 4c 24 50 89 c2 8b 44 24 48 84 d2 74 5e 8d 48 10 89 0c 24 e8 77 cf ff ff 8b 44 24 04 85 c0 0f 84 c5 04 00 00 8b 44 24 48 89 04 Data Ascii: D$=d;avFD$Hu($5D$D$$D$D$#=D$$D$D$D$d;aDD$HL$Pt1$FD$L$PD$Ht^H$wD$D$H
2024-11-12 15:49:40 UTC	16384	IN	Data Raw: cc cc cc cc 64 8b 0d 14 00 00 00 8b 89 00 00 00 00 3b 61 08 0f 86 8b 00 00 00 83 ec 24 8b 44 24 28 89 04 24 e8 4b 92 ff ff 8b 44 24 04 85 c0 0f 94 c1 8b 54 24 08 85 d2 0f 94 c3 21 cb 84 db 75 58 89 54 24 1c 89 44 24 18 89 54 24 20 84 02 90 89 14 24 e8 1c 92 ff ff 8b 44 24 04 8b 4c 24 08 8b 54 24 28 89 14 24 8b 5c 24 1c 89 5c 24 08 8b 5c 24 18 89 5c 24 04 89 4c 24 10 89 44 24 0c e8 b0 90 ff ff 0f b6 44 24 14 84 c0 74 90 8b 44 24 20 89 44 24 2c 83 c4 24 c3 c7 44 24 2c 00 00 00 00 83 c4 24 c3 e8 ea fc 04 00 e9 55 ff ff ff cc cc cc cc cc 64 8b 0d 14 00 00 00 8b 89 00 00 00 00 3b 61 08 76 01 c3 e8 c8 fc 04 00 eb e6 cc cc cc cc cc cc 64 8b 0d 14 00 00 00 8b 89 00 00 00 00 3b 61 08 76 1b 83 ec 08 8b 44 24 0c 89 04 24 c7 44 24 04 00 00 00 00 e8 57 09 00 00 83 c4 Data Ascii: d;a$D$($KD$T$!uXT$D$T$ $D$L$T$($\$\$\$\$L$D$D$tD$ D$,$D$,$Ud;avd;avD$$D$W
2024-11-12 15:49:40 UTC	3778	IN	Data Raw: 20 89 43 28 0f b6 42 04 83 e0 03 80 f8 03 74 14 8d 42 04 89 04 24 c6 44 24 04 03 e8 a4 52 ff ff 8b 5c 24 14 89 1c 24 e8 18 00 00 00 83 c4 08 c3 83 c4 08 c3 e8 5b bd 04 00 e9 b6 fd ff ff cc cc cc cc cc cc 64 8b 0d 14 00 00 00 8b 89 00 00 00 00 3b 61 08 0f 86 45 04 00 00 83 ec 40 8b 7c 24 44 8b 5f 0c 0f b6 6b 04 95 f6 c0 04 95 0f 85 15 04 00 00 89 5c 24 38 8b 6f 08 89 6c 24 30 8b 77 28 89 e8 8b 6f 14 89 d9 0f b6 5f 27 89 da 8b 5f 2c eb 0e 0f b7 50 32 8d 54 15 fc 84 00 8b 2a 31 d2 85 ed 0f 85 b3 00 00 00 39 77 20 75 0c 0f b6 5f 25 84 db 0f 85 b0 00 00 00 8b 59 10 85 db 74 60 0f b6 6f 26 95 38 41 05 95 75 55 8b 6f 0c 89 da 0f b6 5d 05 0f b6 6d 04 95 f6 c0 08 95 75 01 4b 89 d9 bd 01 00 00 00 d3 e5 8d 5d ff 21 f3 0f b7 68 32 0f af dd 90 89 e9 8d 2c 1a 0f b6 1c Data Ascii: C(BtB$D$R\$$[d;aE@\|$D_k\$8ol$0w(o_'_,P2T*19w u_%Yt`o&8AuUo]muK]!h2,
2024-11-12 15:49:40 UTC	16384	IN	Data Raw: 21 00 00 00 e8 a9 44 02 00 90 e8 c3 ae 04 00 e9 ae fe ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc 64 8b 0d 14 00 00 00 8b 89 00 00 00 00 3b 61 08 0f 86 b1 02 00 00 83 ec 34 8b 44 24 3c 85 c0 0f 84 89 02 00 00 0f b6 48 04 f6 c1 04 0f 85 66 02 00 00 8b 4c 24 38 8b 51 2c 8b 1a 8b 68 08 8d 74 24 40 89 34 24 89 6c 24 04 ff d3 8b 44 24 08 89 44 24 14 8b 4c 24 3c 0f b6 59 04 83 f3 04 88 59 04 8b 59 0c 85 db 75 49 8b 44 24 38 8b 48 28 8b 11 89 14 24 89 4c 24 04 c6 44 24 08 01 e8 9e c9 ff ff 8b 05 b0 83 7e 00 8b 4c 24 0c 85 c0 75 09 8b 44 24 3c 89 48 0c eb 10 8b 54 24 3c 8d 7a 0c 89 c8 e8 49 c2 04 00 89 d0 8b 44 24 14 8b 4c 24 3c 8b 54 24 38 eb 1e 89 14 24 89 6c 24 04 e8 0d f5 ff ff 8b 44 24 38 8b 4c 24 3c 8b 54 24 14 89 d0 8b 54 24 38 0f b6 59 05 89 cd 89 d9 Data Ascii: !Dd;a4D$<HfL$8Q,ht$@4$l$D$D$L$<YYYuID$8H($L$D$~L$uD$<HT$<zID$L$<T$8$l$D$8L$<T$T$8Y
2024-11-12 15:49:40 UTC	16384	IN	Data Raw: 2c 24 8b 6c 24 78 39 d0 72 db 8b 34 24 39 d0 76 1a 29 d0 83 f8 20 19 ed 89 c1 d3 ee 21 ee 8b 8c 24 90 00 00 00 8b 6c 24 78 89 d0 83 f8 01 75 15 83 fe 01 75 0c b8 19 00 00 00 be ff ff ff 01 eb 13 89 d8 eb 0f 8d 14 00 83 fa 19 77 07 89 c2 e9 17 01 00 00 89 34 24 8b 54 24 24 89 44 24 44 8b 44 24 0c 89 44 24 30 8b 44 24 44 eb 1a 8b 4c 24 20 29 c1 8b 34 24 8b 6c 24 78 89 5c 24 30 89 cb 8b 8c 24 90 00 00 00 39 d8 77 2a 89 5c 24 20 8b 6c 24 30 83 fd 20 19 db 89 e9 d3 e6 21 de 09 f2 8d 1c 08 8b ac 24 90 00 00 00 83 fd 01 0f 84 8f 00 00 00 eb 79 85 db 76 47 89 7c 24 74 83 fb 20 89 e8 19 ed 8b 7c 24 30 83 ff 20 19 ff 89 7c 24 2c 89 d9 bf 01 00 00 00 d3 e7 21 ef 8d 6f ff 21 ee 8b 4c 24 30 d3 e6 8b 6c 24 2c 21 ee 09 f2 01 cb 8b 8c 24 90 00 00 00 89 c5 8b 7c 24 74 eb Data Ascii: ,$l$x9r4$9v) !$l$xuuw4$T$$D$DD$D$0D$DL$ )4$l$x\$0$9w*\$ l$0 !$yvG\|$t \|$0 \|$,!o!L$0l$,!$\|$t
2024-11-12 15:49:40 UTC	16384	IN	Data Raw: 8b 44 24 5c 8b 8c 24 88 00 00 00 19 c8 8b 8c 24 b8 00 00 00 89 ca c1 f9 1f 8b 9c 24 b4 00 00 00 0f af d9 8b 8c 24 b0 00 00 00 01 d9 0f af c2 01 c8 8b 8c 24 a8 00 00 00 8b 94 24 ac 00 00 00 01 d1 8b 8c 24 8c 00 00 00 11 c1 f2 0f 10 44 24 08 f2 0f 11 84 24 d0 00 00 00 89 4c 24 04 8b 44 24 3c 89 04 24 e8 59 e7 03 00 f2 0f 10 84 24 d0 00 00 00 f2 0f 5e 44 24 08 f2 0f 11 05 e0 ad 7e 00 c7 05 6c 28 7c 00 00 00 00 00 c7 05 70 28 7c 00 00 00 00 00 0f b6 05 80 8c 7e 00 84 c0 74 06 ff 05 dc ad 7e 00 90 90 8d 05 a0 8c 7e 00 89 04 24 e8 9d 31 ff ff ff 05 d8 ad 7e 00 8d 05 a4 8c 7e 00 89 04 24 e8 c9 44 02 00 90 90 8d 05 a0 8c 7e 00 89 04 24 e8 79 33 ff ff e8 44 35 01 00 8b 05 cc 82 7c 00 89 84 24 c8 00 00 00 c6 84 24 cc 00 00 00 00 90 8d 05 d4 82 7c 00 89 04 24 c7 44 Data Ascii: D$\$$$$$$$D$$L$D$<$Y$^D$~l(\|p(\|~t~~$1~~$D~$y3D5\|$$\|$D
2024-11-12 15:49:40 UTC	16384	IN	Data Raw: 01 00 8d 05 00 96 4e 00 89 04 24 c7 44 24 04 13 00 00 00 e8 9a a2 01 00 c7 44 24 04 00 00 00 00 8b 44 24 38 89 04 24 e8 26 9f 01 00 e8 c1 9b 01 00 e8 0c 9a 01 00 8d 05 30 da 4e 00 89 04 24 c7 44 24 04 20 00 00 00 e8 66 84 01 00 8b 84 24 3c 01 00 00 89 04 24 e8 47 81 fe ff 8b 84 24 50 01 00 00 8b 48 50 89 4c 24 48 8b 50 54 89 54 24 44 8b 5c 24 04 89 5c 24 34 e8 55 99 01 00 8d 05 e7 aa 4e 00 89 04 24 c7 44 24 04 16 00 00 00 e8 1f a2 01 00 8b 84 24 50 01 00 00 89 04 24 e8 90 a1 01 00 8d 05 7d 6c 4e 00 89 04 24 c7 44 24 04 07 00 00 00 e8 fa a1 01 00 8b 44 24 44 89 44 24 04 8b 44 24 48 89 04 24 e8 e6 9f 01 00 8d 05 00 96 4e 00 89 04 24 c7 44 24 04 13 00 00 00 e8 d0 a1 01 00 c7 44 24 04 00 00 00 00 8b 44 24 34 89 04 24 e8 3c a0 01 00 e8 f7 9a 01 00 e8 42 99 01 Data Ascii: N$D$D$D$8$&0N$D$ f$<$G$PHPL$HPTT$D\$\$4UN$D$$P$}lN$D$D$DD$D$H$N$D$D$D$4$<B
2024-11-12 15:49:40 UTC	16384	IN	Data Raw: 18 8b 54 24 14 39 d1 76 07 90 89 cb 29 d1 eb 04 89 cb 31 c9 85 c9 74 09 8b 4c 24 1c 39 48 68 74 04 83 c4 0c c3 f7 c2 ff ff 3f 00 75 17 83 c0 54 89 04 24 89 54 24 04 89 5c 24 08 e8 22 c8 00 00 83 c4 0c c3 8d 05 c2 c8 4e 00 89 04 24 c7 44 24 04 1c 00 00 00 e8 58 44 01 00 90 e8 d2 99 03 00 eb 80 64 8b 0d 14 00 00 00 8b 89 00 00 00 00 3b 61 0c 0f 86 f1 02 00 00 83 ec 44 8b 5c 24 48 84 03 8b 6c 24 50 8b 74 24 4c 39 f5 76 07 90 89 ef 29 f5 eb 04 89 ef 31 ed 85 ed 0f 84 46 01 00 00 f7 c6 ff ff 3f 00 0f 85 a6 02 00 00 8b 6c 24 54 89 e8 c1 ed 0d a9 ff 1f 00 00 74 01 45 89 f0 8b 35 8c 82 7e 00 c1 ee 0d 83 fe 01 73 05 be 01 00 00 00 4f 89 7c 24 28 90 8b 4b 28 89 ea 8b 6b 24 c1 ef 16 39 f9 0f 86 60 02 00 00 8d 4c fd 00 8b 69 04 8b 09 f7 c5 00 00 00 80 74 07 b9 00 00 Data Ascii: T$9v)1tL$9Hht?uT$T$\$"N$D$XDd;aD\$Hl$Pt$L9v)1F?l$TtE5~sO\|$(K(k$9`Lit

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	59359	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 15:50:11 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FWbpFe63sLSlRyu&MD=XACCHnmc HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-12 15:50:11 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: c41bbb9a-2f18-41d4-a6e8-c67a1d20c54c MS-RequestId: 8f6b6393-c9ab-4abf-9923-1ad095c10a19 MS-CV: APbxHuMkPU21OTJa.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 12 Nov 2024 15:50:10 GMT Connection: close Content-Length: 30005
2024-11-12 15:50:11 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-12 15:50:11 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	0
Start time:	10:49:22
Start date:	12/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\ACHAT DE 2 IMMEUBLES.pdf"
Imagebase:	0x7ff6ebcb0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	10:49:23
Start date:	12/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	10:49:24
Start date:	12/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff7e67a0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	10:49:25
Start date:	12/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1728 --field-trial-handle=1572,i,16750144883042128142,8722937577736343165,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff7e67a0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	10:49:29
Start date:	12/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:49:30
Start date:	12/11/2024
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff7648e0000
File size:	329'504 bytes
MD5 hash:	3BA1A18A0DC30A0545E7765CB97D8E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	10:49:30
Start date:	12/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	10:49:30
Start date:	12/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	10:49:30
Start date:	12/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	10:49:31
Start date:	12/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://agent.fleetdeck.io/AkKkGEnzwtzPvTHp9XURrp?win
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	10:49:31
Start date:	12/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1980,i,11466266959600269699,13698241653752948834,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	10:49:38
Start date:	12/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5716 --field-trial-handle=1980,i,11466266959600269699,13698241653752948834,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:49:48
Start date:	12/11/2024
Path:	C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Downloads\fleetdeck-agent-AkKkGEnzwtzPvTHp9XURrp.exe"
Imagebase:	0x710000
File size:	4'081'208 bytes
MD5 hash:	043ABB0F947E2219446A8FBC8E37049B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:49:50
Start date:	12/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"
Imagebase:	0x7ff7582a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:49:50
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:50:03
Start date:	12/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"
Imagebase:	0x7ff7582a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:50:03
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	10:50:27
Start date:	12/11/2024
Path:	C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"
Imagebase:	0x560000
File size:	5'504'560 bytes
MD5 hash:	0915F113042460AD625950FF06CAB044
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	10:50:30
Start date:	12/11/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff65ed20000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	10:50:30
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	35.7%
Total number of Nodes:	14
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFEC61F2C30 Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE ref: 00007FFEC620CD6F

Memory Dump Source

Source File: 00000014.00000002.1579655943.00007FFEC61F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC61F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffec61f0000_powershell.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: cb8cb308801c218633c17b6f5ae0fcb8481317b7e71762fef596e616c47eccb5
Instruction ID: a37d16bb7c9710431a3ad8975b5f262abd5b4c12a969bd5712ca46527a355872
Opcode Fuzzy Hash: cb8cb308801c218633c17b6f5ae0fcb8481317b7e71762fef596e616c47eccb5
Instruction Fuzzy Hash: 1841E37190C60C4FEB59EB68C8056FA7BE0FF95322F04422AE04DD3591EA79644ACB81

Function 00007FFEC68239E3 Relevance: .5, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000014.00000002.1591120936.00007FFEC6820000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffec6820000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3cc56a2f542e53722fff25aa479601796cd0ec8c11a492e7a4b5e2ecfaa2c98
Instruction ID: 5417cabbe2fc53d7b9fd8e57ca0d407c59b659f8fc93a72492152f50d43aeeb9
Opcode Fuzzy Hash: e3cc56a2f542e53722fff25aa479601796cd0ec8c11a492e7a4b5e2ecfaa2c98
Instruction Fuzzy Hash: 6EE14731A1CA864FE75EDF2884256B677E1EF56300F1405BDE68E871E3DE28B846C781

Function 00007FFEC61F88AA Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ComputeAccessTokenFromCodeAuthzLevel.ADVAPI32 ref: 00007FFEC620C60E

Memory Dump Source

Source File: 00000014.00000002.1579655943.00007FFEC61F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC61F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffec61f0000_powershell.jbxd

Similarity

API ID: AccessAuthzCodeComputeFromLevelToken
String ID:
API String ID: 132034935-0
Opcode ID: ce24ec7c7cf042fd3f5d61948bb7d099807cc7d510cecd582ae98957b9dc20d4
Instruction ID: 3d990e6d6e19d5e2a9498c7cbb37a7f37d211a9df5905b1a1dae34eb1feb2b2e
Opcode Fuzzy Hash: ce24ec7c7cf042fd3f5d61948bb7d099807cc7d510cecd582ae98957b9dc20d4
Instruction Fuzzy Hash: 0731D57191CA1C8FDB18DF5CD8496F97BE1FBA9712F04422EE049E3252CB74A846CB85

Function 00007FFEC61F71AA Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE ref: 00007FFEC61F7FF7

Memory Dump Source

Source File: 00000014.00000002.1579655943.00007FFEC61F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC61F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffec61f0000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fbed69a35ef3ff2f7ea566455e24ecb7a6e72bc7a8f0c3b7fae337ccbca38f89
Instruction ID: e69ccf724087c4a687dc29c00871283011aa09bec8459da5df8d60a848446ebf
Opcode Fuzzy Hash: fbed69a35ef3ff2f7ea566455e24ecb7a6e72bc7a8f0c3b7fae337ccbca38f89
Instruction Fuzzy Hash: FC218F71908A1C9FDB58DF98D849AFABBF0FF55311F00822BD00ED3651DB70A8168B81

Function 00007FFEC61F7F6F Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE ref: 00007FFEC61F7FF7

Memory Dump Source

Source File: 00000014.00000002.1579655943.00007FFEC61F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC61F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffec61f0000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c1cec7c9d358c7f1aba021fe5dec6a5b0493f848b10ab0c45f9a40b2e40339d2
Instruction ID: 96633667d1bb6655053345e906cbf024d9ec52809985dd9502cf000d8253919e
Opcode Fuzzy Hash: c1cec7c9d358c7f1aba021fe5dec6a5b0493f848b10ab0c45f9a40b2e40339d2
Instruction Fuzzy Hash: 66215E71908A1C9FDB59DF98D849AEABBF1FF95321F04822FD00DD3651DB70A8168B81

Function 00007FFEC61F7F59 Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE ref: 00007FFEC61F7FF7

Memory Dump Source

Source File: 00000014.00000002.1579655943.00007FFEC61F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC61F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffec61f0000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 76f8599ce24a32cd1b9b1a46e2358c9257fbaa4cb815b04d8caf875f100efedb
Instruction ID: 7553040546a42e4c9e1f18ed7536c869eadcd14d490824cc4bea5ff390330631
Opcode Fuzzy Hash: 76f8599ce24a32cd1b9b1a46e2358c9257fbaa4cb815b04d8caf875f100efedb
Instruction Fuzzy Hash: 45217C31908A5C8FDB59DF989449AA9BBF0EF69311F04826BC00DD3662CB74A845CB81

Function 00007FFEC69531F4 Relevance: 1.3, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H, xrefs: 00007FFEC69531F4

Memory Dump Source

Source File: 00000014.00000002.1593524087.00007FFEC6950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffec6950000_powershell.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 457160579dbe0314723bbc8d843e324963936a1171f14cab45810ca9c179d884
Instruction ID: 6817af518fe6cdc92b6f3c85dcfc1e6b0543f28fca59dd9f4f2a05e3607231d5
Opcode Fuzzy Hash: 457160579dbe0314723bbc8d843e324963936a1171f14cab45810ca9c179d884
Instruction Fuzzy Hash: 8B11DA3090864C8FDB99DF18C494BAAB7F1FF69300F0045AEA44EE3261DF759944CB01

Function 00007FFEC6951450 Relevance: .3, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000014.00000002.1593524087.00007FFEC6950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffec6950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b39c77b411aac765fc8792e927cfcc40b2e81416c6baae627cbdceabe4bcd227
Instruction ID: 53cc7af60b41c38a901c661746f5156f58c4ee3cb7647e7bfbc49700c635264c
Opcode Fuzzy Hash: b39c77b411aac765fc8792e927cfcc40b2e81416c6baae627cbdceabe4bcd227
Instruction Fuzzy Hash: 8391DA30A1861D9FDB99EF18C894BAA77F1FF58305F5441B9E40ED32A1CB35A985CB01

Function 00007FFEC695379F Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1593524087.00007FFEC6950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffec6950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba9f88cb4a66cfa01ee67db9668ee2575f7b7857783a95b10a3d207ea057fbdb
Instruction ID: f7279683dcec65f6a3bd96d9eaf19f3264580fdadc18fb9f03c6509a66dc8918
Opcode Fuzzy Hash: ba9f88cb4a66cfa01ee67db9668ee2575f7b7857783a95b10a3d207ea057fbdb
Instruction Fuzzy Hash: 0241F730A2891D8FDB99DF48D495AFA77F1FF88315F14416AE44DE32A1CA24AC02CB80

Function 00007FFEC69529E6 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1593524087.00007FFEC6950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffec6950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 083b3aa5d3024c14f50b7537a2328338d518fb83eea731f6f356fac9a11da5f0
Instruction ID: 6f1f2752ef6ada6fe4d640ea4f85f1b8483b7a89809c4b94dacf77b4c33afb02
Opcode Fuzzy Hash: 083b3aa5d3024c14f50b7537a2328338d518fb83eea731f6f356fac9a11da5f0
Instruction Fuzzy Hash: 31217F20B18D0E4FAB9AEF1C846576A66D3EF9D300B464175E40DC72A2CE24EC828381

Function 00007FFEC6823A19 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1591120936.00007FFEC6820000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffec6820000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4407a7e79b982269d7732e1b9e7119fef58df9a928edf6cbebf73810a0bbbef4
Instruction ID: 592f3939ac1a13f022d69c46e37ed88c7007af4a617579e55d27d74b0732209c
Opcode Fuzzy Hash: 4407a7e79b982269d7732e1b9e7119fef58df9a928edf6cbebf73810a0bbbef4
Instruction Fuzzy Hash: 1F215E30A1CE094FDB59EE1C9415A6AB7E1FB98740F504639F54EC32A6DE24F8418785

Function 00007FFEC6952891 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1593524087.00007FFEC6950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffec6950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9406f44ff65a26dcf11b71a88e26c0e240fa63a724f8e5c8bf88a150ee97aa7e
Instruction ID: ea95f78d28f396a1652d68ef0520cc800659d07c0e5fb03c8cc40c7b55b02708
Opcode Fuzzy Hash: 9406f44ff65a26dcf11b71a88e26c0e240fa63a724f8e5c8bf88a150ee97aa7e
Instruction Fuzzy Hash: 9421C370A0C9494FD78AEF2C84107A677D2FB59304B1941BAD44DCB392CD25ED41C381

Function 00007FFEC6823A14 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1591120936.00007FFEC6820000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffec6820000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 197d79dda78fbadb1ebc9047de695cae2f1d01d1795bf9a82ea6b8e7b9b96b8f
Instruction ID: 247c9da0f8104fee9e1556d9b983ada4d1bbaffde030c7e8e6122fc8c3c279df
Opcode Fuzzy Hash: 197d79dda78fbadb1ebc9047de695cae2f1d01d1795bf9a82ea6b8e7b9b96b8f
Instruction Fuzzy Hash: 0021D121A1CA494FDB5AEF28841166AB7E1FF59300F54467EF54EC32E3DE24F8468741

Function 00007FFEC6954016 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1593524087.00007FFEC6950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffec6950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b83a38cab025b3ed3282693e2e3dad2580040ee6169d56953bbcbef0d2c3571
Instruction ID: 8175453584c40b8ef23dd0fcbf9911cd45869af23cf54970bf84fe424f36e09f
Opcode Fuzzy Hash: 7b83a38cab025b3ed3282693e2e3dad2580040ee6169d56953bbcbef0d2c3571
Instruction Fuzzy Hash: 0001A46044E7D91FD793DBB8885D9933FF5DD5722070901DBE488CB163D5598809C7A2

Function 00007FFEC6951C8B Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1593524087.00007FFEC6950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffec6950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4fbff453dc963f2ff9ff39032291dffe6c43296c1af6d98964cfc9c26179e47
Instruction ID: c1ee38042b5cda813b6b6b0915b355cd9068153d2ef5e77cec203dbbf9272136
Opcode Fuzzy Hash: e4fbff453dc963f2ff9ff39032291dffe6c43296c1af6d98964cfc9c26179e47
Instruction Fuzzy Hash: F1F0DA34A199495FDF89EB288455AAA62E6FF9C305F5085B8D00DC72A6DE3AE881C740

Function 00007FFEC6951CDB Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1593524087.00007FFEC6950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffec6950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bb5efa390c8165d383fec858f5739e333e9f9109fb6756b7d43c252d8ac0743
Instruction ID: 30f4596d11b165ad3004fa80528bd8f5ab63c650b68b1e1d05702498b007526f
Opcode Fuzzy Hash: 1bb5efa390c8165d383fec858f5739e333e9f9109fb6756b7d43c252d8ac0743
Instruction Fuzzy Hash: 54E086306199885FDB89FA34885DBB976D6EF9C305F0484FD904ED7262DD359985C700

Function 00007FFEC6956E7E Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1593524087.00007FFEC6950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffec6950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 618e049f04057ff1163c3cfc38a1a8bb678a28c82a5bd270fb919131dd9b34a9
Instruction ID: 78b54ac49d1c2d1673cd92b11eec08d911b962d906c95fe4e33d51ca2ec80005
Opcode Fuzzy Hash: 618e049f04057ff1163c3cfc38a1a8bb678a28c82a5bd270fb919131dd9b34a9
Instruction Fuzzy Hash: E8C09202A48C2A1B65A9B6AC384A1F812D1CB98662B4500A2FC1CCB3A5EC080DD303C6

Function 00007FFEC69536D0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1593524087.00007FFEC6950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffec6950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b73926e5d32f81c20c097a1c79e9b59ae374ee35975f6efb2fb647b7bdeffac3
Instruction ID: 6eef64bb532dcf2ba22b1bd2af0f1d273ce6ae749ec02a7fc0e489f1acc33046
Opcode Fuzzy Hash: b73926e5d32f81c20c097a1c79e9b59ae374ee35975f6efb2fb647b7bdeffac3
Instruction Fuzzy Hash: 22A00204C9B90A01A90879FA1DD709474D05B89114FC51961EC48C1197ECCE19E90293

Non-executed Functions

Function 00007FFEC69551E0 Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1593524087.00007FFEC6950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffec6950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8300548ea17a67519466a6dcc977857105f050e184e178f200d562fdc2dfaea
Instruction ID: 7cb4a148c2faa7601c26a80565f148ae6c93cd47a1f9c7857f0bdfed05ffdbe3
Opcode Fuzzy Hash: b8300548ea17a67519466a6dcc977857105f050e184e178f200d562fdc2dfaea
Instruction Fuzzy Hash: 7191654390D2B225E212FABC7D491F9DFD8DF116BBB28C7B7E288894D36C0B158152D5

Analysis Process: powershell.exePID: 3652, Parent PID: 1176COMMON

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	11
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFEC61D302F Relevance: 1.7, APIs: 1, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000016.00000002.1786509329.00007FFEC61D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC61D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffec61d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02acd5a30ca363e22acc58615e973fea7151900b62990f4d5b8a9a5eda7b4c6f
Instruction ID: 74340c84a0634fa6babcc750015889953962a2dca15f9efcc6c0e9431b0c282e
Opcode Fuzzy Hash: 02acd5a30ca363e22acc58615e973fea7151900b62990f4d5b8a9a5eda7b4c6f
Instruction Fuzzy Hash: 35514831A0C6084FD755EF2CD8096EA7BE0FF95727F04427BE08CC71A2DA25A44AC791

Function 00007FFEC61D8DF2 Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE ref: 00007FFEC61D9CD7

Memory Dump Source

Source File: 00000016.00000002.1786509329.00007FFEC61D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC61D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffec61d0000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 65b7759f8769da66ae9d17991d727b4de213878fb11a889824e697d01a9918b7
Instruction ID: 76aa19ded579c08ca5ddacce7e2f9261d1ef740a69ddfbd6b2373911da1d9f62
Opcode Fuzzy Hash: 65b7759f8769da66ae9d17991d727b4de213878fb11a889824e697d01a9918b7
Instruction Fuzzy Hash: 6E217E71908A1C9FDB59DF58C849AFABBE1FB69311F04822FD04ED3651DB70A806CB91

Function 00007FFEC61D9C4F Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE ref: 00007FFEC61D9CD7

Memory Dump Source

Source File: 00000016.00000002.1786509329.00007FFEC61D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC61D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffec61d0000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 91e2a1cee1c7f3972c6e1c9fea1733f441323215c69ef800396433eda993859a
Instruction ID: 91e0a70a5a4f9a262099db7d9f77eac487d01641ff4dbcdca27070597363e376
Opcode Fuzzy Hash: 91e2a1cee1c7f3972c6e1c9fea1733f441323215c69ef800396433eda993859a
Instruction Fuzzy Hash: 05217171908A1C8FDB59DF58D849AEABBE1FB55311F04422FD049D3651DB70A815CB81

Function 00007FFEC61D9C39 Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE ref: 00007FFEC61D9CD7

Memory Dump Source

Source File: 00000016.00000002.1786509329.00007FFEC61D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC61D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffec61d0000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9d9b3b9052bab7256508501d94799f6dac64561d23ffbbaa8bc47316c1103a2c
Instruction ID: e8f5d63ca740fb4cc89525a7149e3b5f3c3beee30400bc3d3cdaca8f2f2aa4ca
Opcode Fuzzy Hash: 9d9b3b9052bab7256508501d94799f6dac64561d23ffbbaa8bc47316c1103a2c
Instruction Fuzzy Hash: 96217C3190CA4C8FDB5ADF9898496E9BBF0FF69311F04426BC04ED7662CB74A845CB81

Function 00007FFEC6930999 Relevance: .3, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000016.00000002.1813772051.00007FFEC6930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffec6930000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce7cf2c15f9479e40299213fffa59d2db8139b390ea2dfcaf8fadc328c5a7bd6
Instruction ID: 6392f01cb9928a4ac77b951d500da2b1d490e911ac2d172a4c374d8294745b21
Opcode Fuzzy Hash: ce7cf2c15f9479e40299213fffa59d2db8139b390ea2dfcaf8fadc328c5a7bd6
Instruction Fuzzy Hash: 6BA1C630A1895D8FEF95EF28C894BAA77E1FF58315F5040B9E40ED72B1CA35A985CB01

Function 00007FFEC642546F Relevance: .2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000016.00000002.1793967849.00007FFEC6420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffec6420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40d9df0501584af86695579f4dfb6f4b9b7a49fd163348b953e72b647b029202
Instruction ID: ca941874bea82a6633ae9148215eb98adcd8cdfd2067fb1ff735359364faa6e9
Opcode Fuzzy Hash: 40d9df0501584af86695579f4dfb6f4b9b7a49fd163348b953e72b647b029202
Instruction Fuzzy Hash: BB512731A1891A8FEF99DF5884557FEB7E2FF98315F54407AE40DE32A4CA786884C780

Function 00007FFEC69302A6 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1813772051.00007FFEC6930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffec6930000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9150d5b1ed32998cdeaddf576edfed78481d796f9a3f1d69ecf003ce3212db
Instruction ID: 2f331d595a61f421ecb3f21ecf37f0f64e8e47bc3bbf4bc5ca117552dbc37133
Opcode Fuzzy Hash: 8a9150d5b1ed32998cdeaddf576edfed78481d796f9a3f1d69ecf003ce3212db
Instruction Fuzzy Hash: AE31412071CD4A4FE79AEF6C8466A7B67E2EF99200B5440B9E44DD73B2CD68EC41C380

Function 00007FFEC680659C Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1809442162.00007FFEC6800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffec6800000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55062aaa06930c40dc7cf4a98154a27e9c7850efa16debd9158a2e1bfc10240d
Instruction ID: 43f20cc48faaeaf60d7a78fd4df159eafcf5d6504e7e88bd93c81ec37d37f45a
Opcode Fuzzy Hash: 55062aaa06930c40dc7cf4a98154a27e9c7850efa16debd9158a2e1bfc10240d
Instruction Fuzzy Hash: 9711B436B1DA094FF655AA5C98036B673D1EF85720F50467AE49EC33DACD19BC428381

Function 00007FFEC6423B5F Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1793967849.00007FFEC6420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffec6420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2477c4692d29940a962a6981651ce2073252fff50c2d0b0a3bef341343a6d96
Instruction ID: 46f8780f6c640fefaa7c5fa95d571bfcac432b35253cc819b6ee561ba2db9d78
Opcode Fuzzy Hash: e2477c4692d29940a962a6981651ce2073252fff50c2d0b0a3bef341343a6d96
Instruction Fuzzy Hash: 9511027051DA8D8FDB89FF18C8159EA3BE1FF95300F1801AAE40DDB292CA34D942C781

Function 00007FFEC68058DF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1809442162.00007FFEC6800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffec6800000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df65259836b31c3fda654d5ef5847b9218a70c43988057e27b2220ed91f07bcc
Instruction ID: e9ab62923a69145d465de8a2e53970c0885daacb05b5354f841b21a54996b885
Opcode Fuzzy Hash: df65259836b31c3fda654d5ef5847b9218a70c43988057e27b2220ed91f07bcc
Instruction Fuzzy Hash: 57018032B1CA094FDB59DE1CE442AA5B3E1EB98360B10466EE45EC3582DA25F852C7C4

Function 00007FFEC6930186 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1813772051.00007FFEC6930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffec6930000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3ac659113a25f9f0b52a384451aa9b7d0f847aa1673b15e2694b6657d3c4099
Instruction ID: a64170fe277bc45b34725aa11f899718ab037cf755209e06c0b640308f30bece
Opcode Fuzzy Hash: b3ac659113a25f9f0b52a384451aa9b7d0f847aa1673b15e2694b6657d3c4099
Instruction Fuzzy Hash: 1111C830A0DA894FE35ADA7C44157AA7FE1EF96304F1842F9D08DC76F2CD699941C381

Function 00007FFEC6423B42 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1793967849.00007FFEC6420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffec6420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddace540ea820d464abbe91a19940c06ec23981697ba2a8e09206365f84eca5c
Instruction ID: f0af979779a0ff42b84c69a9c2d1b94f8c84eb8401e553ca3490e96273301c5a
Opcode Fuzzy Hash: ddace540ea820d464abbe91a19940c06ec23981697ba2a8e09206365f84eca5c
Instruction Fuzzy Hash: 7401A76150EA8A4FD38AEB3448285E97FA1FF46310F1D42FAC0498B197C92C95068350

Function 00007FFEC680658F Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1809442162.00007FFEC6800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffec6800000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04fb919860a496a5055917e7f7dc42dd148e52da8de0977cd7490d82c03f56ae
Instruction ID: 21df12d50f687f8ad69452ce99cf5527c452d37db7a0c9c8ac1774f997bd8ed3
Opcode Fuzzy Hash: 04fb919860a496a5055917e7f7dc42dd148e52da8de0977cd7490d82c03f56ae
Instruction Fuzzy Hash: 38F09027B0CA064BF669995DA8430B633C1EB85720B20467AE49F8339ADD19784382C6

Function 00007FFEC69311DB Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1813772051.00007FFEC6930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffec6930000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 479ecde31738e31b6de07a310b9e64784e20cec39d66120fdd7a8fd089f622d0
Instruction ID: bb575c9bb08728576ea6c9c06dd6bb36dddc30e37c6fe35dd66255701fb9960f
Opcode Fuzzy Hash: 479ecde31738e31b6de07a310b9e64784e20cec39d66120fdd7a8fd089f622d0
Instruction Fuzzy Hash: 47F0DA30A189494FDF89EB2884596AA72E2FF99301F5084B8E40DC72A6DD3AEC42C740

Function 00007FFEC6425511 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1793967849.00007FFEC6420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffec6420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4db5f66d6c1fae50460a68beb469e6ae1c2c6d7ed4ed358851b007209e12cd01
Instruction ID: 2cc83620fb06754dddc3d28c3fc39738b01d47f5d1649f0af40cf76cf99e9fc2
Opcode Fuzzy Hash: 4db5f66d6c1fae50460a68beb469e6ae1c2c6d7ed4ed358851b007209e12cd01
Instruction Fuzzy Hash: 85E06D31E1481A4AAF54EF6858466FDB7E2FFC8250F444036D20CD3185CE6464824780

Function 00007FFEC693122B Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.1813772051.00007FFEC6930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC6930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffec6930000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27261b187f993beffa78400ea8b051911bd9b8bb17066c1af58bb385cd67b328
Instruction ID: a38b5c57539ded2dfa300fb4e48e5fdc291ccf5840d81dd88dcbfdbcc7cd864d
Opcode Fuzzy Hash: 27261b187f993beffa78400ea8b051911bd9b8bb17066c1af58bb385cd67b328
Instruction Fuzzy Hash: F5E04F306099885FDB89E634881DAA976E2EF98305F0084FD944ED7152DD359986C700

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ACHAT DE 2 IMMEUBLES.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3fcfad2f-1955-4c6e-9738-9bd72cdb9587.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\64cfd53e-e575-463b-84c2-00137460116d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF42f933.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241112154928Z-171.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
ACHAT DE 2 IMMEUBLES.pdf

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre