Play interactive tour

Edit tour

Windows Analysis Report Updated Invoices.pdf

Overview

General Information

Sample Name:	Updated Invoices.pdf
Analysis ID:	440459
MD5:	25f75ef8f84476257dfac7668b0925d8
SHA1:	b6895d09fb2ae7cf44c703791c7ba8d8b52daf32
SHA256:	193ed0025b1d72c693b96e1cde2936645aba62398ebfe8380d87b93e32d98e67
Infos:
Most interesting Screenshot:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

JA3 SSL client fingerprint seen in connection with other malware

Classification

Analysis Advice

No malicious behavior found, analyze the document also on other version of Office / Acrobat

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Process Tree

System is w10x64

AcroRd32.exe (PID: 5452 cmdline: 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' 'C:\Users\user\Desktop\Updated Invoices.pdf' MD5: B969CF0C7B2C443A99034881E8C8740A)

AcroRd32.exe (PID: 6224 cmdline: 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer /prefetch:1 'C:\Users\user\Desktop\Updated Invoices.pdf' MD5: B969CF0C7B2C443A99034881E8C8740A)

RdrCEF.exe (PID: 6484 cmdline: 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --backgroundcolor=16514043 MD5: 9AEBA3BACD721484391D15478A4080C7)

RdrCEF.exe (PID: 6668 cmdline: 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1588,6436224196370243818,47289614401758773,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=8902479671005506358 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=8902479671005506358 --renderer-client-id=2 --mojo-platform-channel-handle=1716 --allow-no-sandbox-job /prefetch:1 MD5: 9AEBA3BACD721484391D15478A4080C7)

RdrCEF.exe (PID: 6688 cmdline: 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=gpu-process --field-trial-handle=1588,6436224196370243818,47289614401758773,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --service-request-channel-token=6192589008187299491 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=' --type=renderer ' /prefetch:2 MD5: 9AEBA3BACD721484391D15478A4080C7)

RdrCEF.exe (PID: 6728 cmdline: 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1588,6436224196370243818,47289614401758773,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=4651875932248415935 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4651875932248415935 --renderer-client-id=4 --mojo-platform-channel-handle=1836 --allow-no-sandbox-job /prefetch:1 MD5: 9AEBA3BACD721484391D15478A4080C7)

RdrCEF.exe (PID: 6960 cmdline: 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1588,6436224196370243818,47289614401758773,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=16296965572426256682 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=16296965572426256682 --renderer-client-id=5 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job /prefetch:1 MD5: 9AEBA3BACD721484391D15478A4080C7)

iexplore.exe (PID: 6368 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' https://cloud.degoo.com/share/yEamRoo0VDj2ZJXd1fAFww MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 4696 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6368 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 52.52.240.3:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.52.240.3:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.193.100:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.193.100:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.229.238:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.229.238:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.229.238:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.229.238:443 -> 192.168.2.5:49743 version: TLS 1.2

Source: Joe Sandbox View

JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c

Source: AcroRd32.exe, 00000001.00000000.349973117.000000000A96E000.00000004.00000001.sdmp, Updated Invoices.pdf	String found in binary or memory: <</Subtype/Link/Rect[ 153.02 468.19 179.3 494.59] /BS<</W 0>>/F 4/A<</Type/Action/S/URI/URI(https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Feconomicmobilitypathways&data=04%7C01%7Ceblack%40empathways.org%7Ca251c1ffaf674b5a316808d934ea66e6%7C6e76b0bf73044c7eb144a9f2e9ff9343%7C0%7C0%7C637599003611650209%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=AnEmFSJybb5g7kKFYkRpNyFokrgkllbUDcrMrlZoxR8%3D&reserved=0) >>/StructParent 7>> equals www.linkedin.com (Linkedin)
Source: AcroRd32.exe, 00000001.00000000.349973117.000000000A96E000.00000004.00000001.sdmp, Updated Invoices.pdf	String found in binary or memory: <</Subtype/Link/Rect[ 99.024 468.19 125.3 494.59] /BS<</W 0>>/F 4/A<</Type/Action/S/URI/URI(https://nam02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.facebook.com%2Fdisruptpoverty&data=04%7C01%7Ceblack%40empathways.org%7Ca251c1ffaf674b5a316808d934ea66e6%7C6e76b0bf73044c7eb144a9f2e9ff9343%7C0%7C0%7C637599003611640215%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=jaxfg3g5UfjEKnn%2FpqyE3ydgEk9D8J5i3a%2BBWQUEgQE%3D&reserved=0) >>/StructParent 5>> equals www.facebook.com (Facebook)
Source: js[1].js.27.dr	String found in binary or memory: E=V("YT"),D=function(){e(C)};J(u.vtp_gtmOnSuccess);if(E)E.ready&&E.ready(D);else{var I=V("onYouTubeIframeAPIReady");Kt("onYouTubeIframeAPIReady",function(){I&&I();D()});J(function(){for(var R=V("document"),Q=R.getElementsByTagName("script"),T=Q.length,S=0;S<T;S++){var X=Q[S].getAttribute("src");if(b(X,"iframe_api")\|\|b(X,"player_api"))return}for(var K=R.getElementsByTagName("iframe"),U=K.length,ba=0;ba<U;ba++)if(!t&&c(K[ba],C.jc)){P("https://www.youtube.com/iframe_api");t=!0;break}})}}else J(u.vtp_gtmOnSuccess)} equals www.youtube.com (Youtube)
Source: js[1].js.27.dr	String found in binary or memory: Math.round(p);v["gtm.videoCurrentTime"]=Math.round(q);v["gtm.videoElapsedTime"]=Math.round(f);v["gtm.videoPercent"]=r;v["gtm.videoVisible"]=t;return v},zg:function(){e=ab()},Fb:function(){d()}}};var Zq=["www.youtube.com","www.youtube-nocookie.com"],$q,ar=!1,br=0; equals www.youtube.com (Youtube)
Source: AcroRd32.exe, 00000001.00000000.351337734.000000000B7B3000.00000004.00000001.sdmp	String found in binary or memory: https://nam02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.facebook.com%2Fdisruptpoverty&data=04%7C01%7Ceblack%40empathways.org%7Ca251c1ffaf674b5a316808d934ea66e6%7C6e76b0bf73044c7eb144a9f2e9ff9343%7C0%7C0%7C637599003611640215%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=jaxfg3g5UfjEKnn%2FpqyE3ydgEk9D8J5i3a%2BBWQUEgQE%3D&reserved=0 equals www.facebook.com (Facebook)
Source: AcroRd32.exe, 00000001.00000000.351337734.000000000B7B3000.00000004.00000001.sdmp	String found in binary or memory: https://nam02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.facebook.com%2Fdisruptpoverty&data=04%7C01%7Ceblack%40empathways.org%7Ca251c1ffaf674b5a316808d934ea66e6%7C6e76b0bf73044c7eb144a9f2e9ff9343%7C0%7C0%7C637599003611640215%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=jaxfg3g5UfjEKnn%2FpqyE3ydgEk9D8J5i3a%2BBWQUEgQE%3D&reserved=0f equals www.facebook.com (Facebook)
Source: AcroRd32.exe, 00000001.00000000.351193414.000000000B769000.00000004.00000001.sdmp	String found in binary or memory: https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Feconomicmobilitypathways&data=04%7C01%7Ceblack%40empathways.org%7Ca251c1ffaf674b5a316808d934ea66e6%7C6e76b0bf73044c7eb144a9f2e9ff9343%7C0%7C0%7C637599003611650209%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=AnEmFSJybb5g7kKFYkRpNyFokrgkllbUDcrMrlZoxR8%3D&reserved=0 equals www.linkedin.com (Linkedin)
Source: js[1].js.27.dr	String found in binary or memory: var p=["www.youtube.com","www.youtube-nocookie.com"],q={UNSTARTED:-1,ENDED:0,PLAYING:1,PAUSED:2,BUFFERING:3,CUED:5},r,t=!1;(function(u){Y.__ytl=u;Y.__ytl.m="ytl";Y.__ytl.o=!0;Y.__ytl.priorityOverride=0})(function(u){u.vtp_triggerStartOption?m(u):yl(function(){m(u)})})}(); equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: degoo.com

Source: AcroRd32.exe, 00000001.00000000.342633462.0000000008D4D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: AcroRd32.exe, 00000001.00000000.342633462.0000000008D4D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: AcroRd32.exe, 00000001.00000000.342633462.0000000008D4D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: AcroRd32.exe, 00000001.00000000.342633462.0000000008D4D000.00000002.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: AcroRd32.exe, 00000001.00000000.349982598.000000000A982000.00000004.00000001.sdmp	String found in binary or memory: http://cipa.jp/exif/1.0/
Source: AcroRd32.exe, 00000001.00000000.353350335.000000000B949000.00000004.00000001.sdmp	String found in binary or memory: http://crl.mi
Source: AcroRd32.exe, 00000001.00000000.342633462.0000000008D4D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: AcroRd32.exe, 00000001.00000000.342633462.0000000008D4D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: AcroRd32.exe, 00000001.00000000.342633462.0000000008D4D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: AcroRd32.exe, 00000001.00000000.342633462.0000000008D4D000.00000002.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: AcroRd32.exe, 00000001.00000000.342633462.0000000008D4D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AcroRd32.exe, 00000001.00000000.342633462.0000000008D4D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: AcroRd32.exe, 00000001.00000000.342633462.0000000008D4D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: AcroRd32.exe, 00000001.00000000.342633462.0000000008D4D000.00000002.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: TitlingFBGothicMedium[1].eot.27.dr	String found in binary or memory: http://fontforge.sf.net/)
Source: AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/
Source: AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/m#
Source: AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/
Source: AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/em#TxN
Source: AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	String found in binary or memory: http://ns.useplus.org/ldf/xmp/1.0/
Source: AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	String found in binary or memory: http://ns.useplus.org/ldf/xmp/1.0/8-02-29/
Source: AcroRd32.exe, 00000001.00000000.342633462.0000000008D4D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: AcroRd32.exe, 00000001.00000000.342633462.0000000008D4D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: AcroRd32.exe, 00000001.00000000.342633462.0000000008D4D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: AcroRd32.exe, 00000001.00000000.342633462.0000000008D4D000.00000002.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: AcroRd32.exe, 00000001.00000000.355071246.000000000D3C7000.00000004.00000001.sdmp	String found in binary or memory: http://www.adobe.
Source: AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/extension/
Source: AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/field#
Source: AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/field#0/xmlns/f#
Source: AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/field#y#l/1.0/
Source: AcroRd32.exe, 00000001.00000000.349982598.000000000A982000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: AcroRd32.exe, 00000001.00000000.349982598.000000000A982000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/G
Source: AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/property#
Source: AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/schema#
Source: AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/type#
Source: AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/type#Font#
Source: AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/type#ty#wx
Source: AcroRd32.exe, 00000001.00000000.349982598.000000000A982000.00000004.00000001.sdmp	String found in binary or memory: http://www.aiim.org/pdfe/ns/id/
Source: AcroRd32.exe, 00000001.00000000.342633462.0000000008D4D000.00000002.00000001.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: AcroRd32.exe, 00000001.00000000.354948292.000000000D257000.00000004.00000001.sdmp	String found in binary or memory: http://www.empathways.org
Source: AcroRd32.exe, 00000001.00000000.351193414.000000000B769000.00000004.00000001.sdmp	String found in binary or memory: http://www.empathways.orgC
Source: AcroRd32.exe, 00000001.00000000.354948292.000000000D257000.00000004.00000001.sdmp	String found in binary or memory: http://www.empathways.orgIk
Source: AcroRd32.exe, 00000001.00000000.349982598.000000000A982000.00000004.00000001.sdmp	String found in binary or memory: http://www.npes.org/pdfx/ns/id/
Source: AcroRd32.exe, 00000001.00000000.338567460.0000000007E90000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/default/1.0%http://www.osmf.org/mediatype/default
Source: AcroRd32.exe, 00000001.00000000.338567460.0000000007E90000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/drm/default
Source: AcroRd32.exe, 00000001.00000000.338567460.0000000007E90000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/elementId%http://www.osmf.org/temporal/embedded$http://www.osmf.org/temporal/dyn
Source: AcroRd32.exe, 00000001.00000000.338567460.0000000007E90000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/layout/anchor
Source: AcroRd32.exe, 00000001.00000000.338567460.0000000007E90000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/layout/padding%http://www.osmf.org/layout/attributes
Source: AcroRd32.exe, 00000001.00000000.338567460.0000000007E90000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/region/target#http://www.osmf.org/layout/renderer#http://www.osmf.org/layout/abs
Source: AcroRd32.exe, 00000001.00000000.338567460.0000000007E90000.00000002.00000001.sdmp	String found in binary or memory: http://www.osmf.org/subclip/1.0
Source: AcroRd32.exe, 00000001.00000000.353818798.000000000BAF0000.00000004.00000001.sdmp	String found in binary or memory: http://www.quicktime.com.Acrobat
Source: AcroRd32.exe, 00000001.00000000.351399815.000000000B7D2000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/
Source: AcroRd32.exe, 00000001.00000000.353739458.000000000B9E7000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/5
Source: AcroRd32.exe, 00000001.00000000.354888538.000000000D1A2000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/
Source: AcroRd32.exe, 00000001.00000000.354888538.000000000D1A2000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/i
Source: AcroRd32.exe, 00000001.00000000.351399815.000000000B7D2000.00000004.00000001.sdmp	String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/y
Source: js[3].js.27.dr, js[1].js.27.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: analytics[1].js.27.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: js[2].js.27.dr	String found in binary or memory: https://analytics.google.com/g/collect
Source: AcroRd32.exe, 00000001.00000000.355071246.000000000D3C7000.00000004.00000001.sdmp	String found in binary or memory: https://api.echosign.com
Source: AcroRd32.exe, 00000001.00000000.354948292.000000000D257000.00000004.00000001.sdmp	String found in binary or memory: https://api.echosign.comRL/wo
Source: {FE9C8DC0-D5EA-11EB-90E5-ECF4BB570DC9}.dat.26.dr	String found in binary or memory: https://app.degoo
Source: imagestore.dat.26.dr	String found in binary or memory: https://app.degoo.com/assets/icons/favicon_round.ico
Source: imagestore.dat.26.dr	String found in binary or memory: https://app.degoo.com/assets/icons/favicon_round.ico~
Source: ~DF70FA6F493C9B0CC3.TMP.26.dr	String found in binary or memory: https://app.degoo.com/login?redirectUrl=%2Fmoments
Source: {FE9C8DC0-D5EA-11EB-90E5-ECF4BB570DC9}.dat.26.dr	String found in binary or memory: https://app.degoo.com/login?redirectUrl=%2Fmoments71
Source: ~DF70FA6F493C9B0CC3.TMP.26.dr	String found in binary or memory: https://app.degoo.com/login?redirectUrl=%2Fmoments7171307723363d=936917171307723363
Source: ~DF70FA6F493C9B0CC3.TMP.26.dr	String found in binary or memory: https://app.degoo.com/login?redirectUrl=%2Fmoments7171307723363d=9369171713077233630
Source: ~DF70FA6F493C9B0CC3.TMP.26.dr	String found in binary or memory: https://app.degoo.com/login?redirectUrl=%2Fmoments7171307723363d=93691717130772336336917171307723363
Source: ~DF70FA6F493C9B0CC3.TMP.26.dr	String found in binary or memory: https://app.degoo.com/login?redirectUrl=%2Fshared
Source: {FE9C8DC0-D5EA-11EB-90E5-ECF4BB570DC9}.dat.26.dr	String found in binary or memory: https://app.degoo.com/login?redirectUrl=%2Fshared1717
Source: ~DF70FA6F493C9B0CC3.TMP.26.dr	String found in binary or memory: https://app.degoo.com/login?redirectUrl=%2Fshared17171307723363.
Source: ~DF70FA6F493C9B0CC3.TMP.26.dr	String found in binary or memory: https://app.degoo.com/login?redirectUrl=%2Fshared17171307723363b
Source: {FE9C8DC0-D5EA-11EB-90E5-ECF4BB570DC9}.dat.26.dr	String found in binary or memory: https://app.degoo.com/moments?_branch_match_id=9369171
Source: ~DF70FA6F493C9B0CC3.TMP.26.dr	String found in binary or memory: https://app.degoo.com/moments?_branch_match_id=936917171307723363
Source: ~DF70FA6F493C9B0CC3.TMP.26.dr	String found in binary or memory: https://app.degoo.com/moments?_branch_match_id=936917171307723363d=9369171713077233630
Source: ~DF70FA6F493C9B0CC3.TMP.26.dr	String found in binary or memory: https://app.degoo.com/moments?_branch_match_id=936917171307723363d=936917171307723363T771
Source: {FE9C8DC0-D5EA-11EB-90E5-ECF4BB570DC9}.dat.26.dr	String found in binary or memory: https://app.degoo.com/moments?_branch_match_id=9369171anch_match_id=93691717130772336371307723363d=9
Source: ~DF70FA6F493C9B0CC3.TMP.26.dr	String found in binary or memory: https://app.degoo.com/share/yEamRoo0VDj2ZJXd1fAFww?_branch_match_id=936917171307723363
Source: {FE9C8DC0-D5EA-11EB-90E5-ECF4BB570DC9}.dat.26.dr	String found in binary or memory: https://app.degoo.com/share/yEamRoo0VDj2ZJXd1fAFww?_branch_match_id=936917171307723363Root
Source: {FE9C8DC0-D5EA-11EB-90E5-ECF4BB570DC9}.dat.26.dr	String found in binary or memory: https://app.degoo.com/share/yEamRoo0VDj2ZJXd1fAFww?_branch_match_id=936917171307723363anch_match_id=
Source: {FE9C8DC0-D5EA-11EB-90E5-ECF4BB570DC9}.dat.26.dr	String found in binary or memory: https://app.degoo.com/shared?_branch_match_id=93691717
Source: ~DF70FA6F493C9B0CC3.TMP.26.dr	String found in binary or memory: https://app.degoo.com/shared?_branch_match_id=936917171307723363
Source: ~DF70FA6F493C9B0CC3.TMP.26.dr	String found in binary or memory: https://app.degoo.com/shared?_branch_match_id=936917171307723363&
Source: ~DF70FA6F493C9B0CC3.TMP.26.dr	String found in binary or memory: https://app.degoo.com/shared?_branch_match_id=936917171307723363d=936917171307723363
Source: {FE9C8DC0-D5EA-11EB-90E5-ECF4BB570DC9}.dat.26.dr	String found in binary or memory: https://app.degoo1307723363Root
Source: {FE9C8DC0-D5EA-11EB-90E5-ECF4BB570DC9}.dat.26.dr	String found in binary or memory: https://app.degooRoot
Source: js[3].js.27.dr, js[1].js.27.dr, optimize[1].js.27.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: AcroRd32.exe, 00000001.00000000.349982598.000000000A982000.00000004.00000001.sdmp, ~DF70FA6F493C9B0CC3.TMP.26.dr	String found in binary or memory: https://cloud.degoo.com/share/yEamRoo0VDj2ZJXd1fAFww
Source: AcroRd32.exe, 00000001.00000000.349973117.000000000A96E000.00000004.00000001.sdmp, Updated Invoices.pdf	String found in binary or memory: https://cloud.degoo.com/share/yEamRoo0VDj2ZJXd1fAFww)
Source: {FE9C8DC0-D5EA-11EB-90E5-ECF4BB570DC9}.dat.26.dr	String found in binary or memory: https://cloud.degoo.com/share/yEamRoo0VDj2ZJXd1fAFwwRoot
Source: en[1].json.27.dr	String found in binary or memory: https://degoo.com/download
Source: en[1].htm.27.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4WxKKTU1Kvnz.woff2)
Source: en[1].htm.27.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2)
Source: en[1].htm.27.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxM.woff)
Source: en[1].htm.27.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu5mxKKTU1Kvnz.woff2)
Source: en[1].htm.27.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu72xKKTU1Kvnz.woff2)
Source: en[1].htm.27.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu7GxKKTU1Kvnz.woff2)
Source: en[1].htm.27.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu7WxKKTU1Kvnz.woff2)
Source: en[1].htm.27.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu7mxKKTU1Kvnz.woff2)
Source: AcroRd32.exe, 00000001.00000000.365175950.00000000095A2000.00000004.00000001.sdmp	String found in binary or memory: https://ims-na1.adobelogin.com
Source: AcroRd32.exe, 00000001.00000000.365175950.00000000095A2000.00000004.00000001.sdmp	String found in binary or memory: https://ims-na1.adobelogin.comMth
Source: en[1].htm.27.dr	String found in binary or memory: https://lh3.googleusercontent.com
Source: AcroRd32.exe, 00000001.00000000.351193414.000000000B769000.00000004.00000001.sdmp, AcroRd32.exe, 00000001.00000000.349973117.000000000A96E000.00000004.00000001.sdmp, Updated Invoices.pdf	String found in binary or memory: https://nam02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.empathways.org%2F&data=04%7C01%
Source: AcroRd32.exe, 00000001.00000000.350901535.000000000B685000.00000004.00000001.sdmp, AcroRd32.exe, 00000001.00000000.349973117.000000000A96E000.00000004.00000001.sdmp, Updated Invoices.pdf	String found in binary or memory: https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com%2Fdisruptpoverty&data=
Source: AcroRd32.exe, 00000001.00000000.351193414.000000000B769000.00000004.00000001.sdmp, AcroRd32.exe, 00000001.00000000.349973117.000000000A96E000.00000004.00000001.sdmp, Updated Invoices.pdf	String found in binary or memory: https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fvimeo.com%2Fempathways&data=04%7C0
Source: AcroRd32.exe, 00000001.00000000.351193414.000000000B769000.00000004.00000001.sdmp, AcroRd32.exe, 00000001.00000000.349973117.000000000A96E000.00000004.00000001.sdmp, Updated Invoices.pdf	String found in binary or memory: https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fecono
Source: js[3].js.27.dr, js[1].js.27.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: js[1].js.27.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: js[1].js.27.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect?v=2&
Source: analytics[1].js.27.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: analytics[1].js.27.dr	String found in binary or memory: https://tagassistant.google.com/
Source: AcroRd32.exe, 00000001.00000000.342633462.0000000008D4D000.00000002.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: en[1].htm.27.dr	String found in binary or memory: https://www.google-analytics.com
Source: js[3].js.27.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: analytics[1].js.27.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap
Source: js[2].js.27.dr	String found in binary or memory: https://www.google-analytics.com/g/collect
Source: analytics[1].js.27.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: optimize[1].js.27.dr	String found in binary or memory: https://www.google-analytics.com/gtm/optimize-dyn.js?id=OPT-M5H55H5
Source: analytics[1].js.27.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: js[3].js.27.dr, js[1].js.27.dr	String found in binary or memory: https://www.google.com
Source: en[1].htm.27.dr	String found in binary or memory: https://www.googletagmanager.com
Source: js[3].js.27.dr, js[1].js.27.dr	String found in binary or memory: https://www.googletagmanager.com/a?id=
Source: js[3].js.27.dr, js[1].js.27.dr, optimize[1].js.27.dr	String found in binary or memory: https://www.googletagmanager.com/debug/bootstrap
Source: analytics[1].js.27.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: js[1].js.27.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443

Source: unknown	HTTPS traffic detected: 52.52.240.3:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.52.240.3:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.193.100:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.193.100:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.229.238:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.229.238:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.78:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.229.238:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.229.238:443 -> 192.168.2.5:49743 version: TLS 1.2

Source: AcroRd32.exe, 00000001.00000000.352366286.000000000B8C1000.00000004.00000001.sdmp	Binary or memory string: dlng(.slngV.Arab, Armn, Cyrl, Geok, Geor, Grek, Hebr, LatnArab, Armn, Cyrl, Geok, Geor, Grek, Hebr, Latn
Source: AcroRd32.exe, 00000001.00000000.352366286.000000000B8C1000.00000004.00000001.sdmp	Binary or memory string: .slng

Source: classification engine

Classification label: clean0.winPDF@17/106@10/6

Source: Updated Invoices.pdf	Initial sample: https://nam02.safelinks.protection.outlook.com/?url=http%3a%2f%2fwww.empathways.org%2f&data=04%7c01%7ceblack%40empathways.org%7c312aeb663049469f047208d8e985a6d4%7c6e76b0bf73044c7eb144a9f2e9ff9343%7c0%7c1%7c637516107558896392%7cunknown%7ctwfpbgzsb3d8eyjwijoimc4wljawmdailcjqijoiv2lumziilcjbtii6ik1hawwilcjxvci6mn0%3d%7c1000&sdata=gfbcflvcxkvkadcyxhffzix%2fqmwu9vag%2bnerfoa59d4%3d&reserved=0
Source: Updated Invoices.pdf	Initial sample: https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com%2Fdisruptpoverty&data=04%7C01%7Ceblack%40empathways.org%7Ca251c1ffaf674b5a316808d934ea66e6%7C6e76b0bf73044c7eb144a9f2e9ff9343%7C0%7C0%7C637599003611630222%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=qFktsdZplsVUXzaqdDewXPiZ48sWRZcTF9eyLBn%2B4jw%3D&reserved=0
Source: Updated Invoices.pdf	Initial sample: https://nam02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.empathways.org%2F&data=04%7C01%7Ceblack%40empathways.org%7C312aeb663049469f047208d8e985a6d4%7C6e76b0bf73044c7eb144a9f2e9ff9343%7C0%7C1%7C637516107558896392%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=gFBCfLvcXKvKaDCYXHfFZix%2FqmwU9vAg%2BNErfOA59D4%3D&reserved=0
Source: Updated Invoices.pdf	Initial sample: mailto:eblack@empathways.org
Source: Updated Invoices.pdf	Initial sample: https://nam02.safelinks.protection.outlook.com/?url=https%3a%2f%2fvimeo.com%2fempathways&data=04%7c01%7ceblack%40empathways.org%7ca251c1ffaf674b5a316808d934ea66e6%7c6e76b0bf73044c7eb144a9f2e9ff9343%7c0%7c0%7c637599003611640215%7cunknown%7ctwfpbgzsb3d8eyjwijoimc4wljawmdailcjqijoiv2lumziilcjbtii6ik1hawwilcjxvci6mn0%3d%7c1000&sdata=nyrlkxecvcq3ilycijo%2bgf7w%2f07toyek74ibwgxr%2bw8%3d&reserved=0
Source: Updated Invoices.pdf	Initial sample: https://nam02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.facebook.com%2Fdisruptpoverty&data=04%7C01%7Ceblack%40empathways.org%7Ca251c1ffaf674b5a316808d934ea66e6%7C6e76b0bf73044c7eb144a9f2e9ff9343%7C0%7C0%7C637599003611640215%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=jaxfg3g5UfjEKnn%2FpqyE3ydgEk9D8J5i3a%2BBWQUEgQE%3D&reserved=0
Source: Updated Invoices.pdf	Initial sample: https://nam02.safelinks.protection.outlook.com/?url=https%3a%2f%2ftwitter.com%2fdisruptpoverty&data=04%7c01%7ceblack%40empathways.org%7ca251c1ffaf674b5a316808d934ea66e6%7c6e76b0bf73044c7eb144a9f2e9ff9343%7c0%7c0%7c637599003611630222%7cunknown%7ctwfpbgzsb3d8eyjwijoimc4wljawmdailcjqijoiv2lumziilcjbtii6ik1hawwilcjxvci6mn0%3d%7c1000&sdata=qfktsdzplsvuxzaqddewxpiz48swrzctf9eylbn%2b4jw%3d&reserved=0
Source: Updated Invoices.pdf	Initial sample: https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Feconomicmobilitypathways&data=04%7C01%7Ceblack%40empathways.org%7Ca251c1ffaf674b5a316808d934ea66e6%7C6e76b0bf73044c7eb144a9f2e9ff9343%7C0%7C0%7C637599003611650209%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=AnEmFSJybb5g7kKFYkRpNyFokrgkllbUDcrMrlZoxR8%3D&reserved=0
Source: Updated Invoices.pdf	Initial sample: https://nam02.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.linkedin.com%2fcompany%2feconomicmobilitypathways&data=04%7c01%7ceblack%40empathways.org%7ca251c1ffaf674b5a316808d934ea66e6%7c6e76b0bf73044c7eb144a9f2e9ff9343%7c0%7c0%7c637599003611650209%7cunknown%7ctwfpbgzsb3d8eyjwijoimc4wljawmdailcjqijoiv2lumziilcjbtii6ik1hawwilcjxvci6mn0%3d%7c1000&sdata=anemfsjybb5g7kkfykrpnyfokrgkllbudcrmrlzoxr8%3d&reserved=0
Source: Updated Invoices.pdf	Initial sample: https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fvimeo.com%2Fempathways&data=04%7C01%7Ceblack%40empathways.org%7Ca251c1ffaf674b5a316808d934ea66e6%7C6e76b0bf73044c7eb144a9f2e9ff9343%7C0%7C0%7C637599003611640215%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=nyrLkXeCvCQ3iLYCiJo%2BGF7w%2F07tOyeK74IbwGXR%2Bw8%3D&reserved=0
Source: Updated Invoices.pdf	Initial sample: https://cloud.degoo.com/share/yEamRoo0VDj2ZJXd1fAFww
Source: Updated Invoices.pdf	Initial sample: https://nam02.safelinks.protection.outlook.com/?url=http%3a%2f%2fwww.facebook.com%2fdisruptpoverty&data=04%7c01%7ceblack%40empathways.org%7ca251c1ffaf674b5a316808d934ea66e6%7c6e76b0bf73044c7eb144a9f2e9ff9343%7c0%7c0%7c637599003611640215%7cunknown%7ctwfpbgzsb3d8eyjwijoimc4wljawmdailcjqijoiv2lumziilcjbtii6ik1hawwilcjxvci6mn0%3d%7c1000&sdata=jaxfg3g5ufjeknn%2fpqye3ydgek9d8j5i3a%2bbwquegqe%3d&reserved=0
Source: Updated Invoices.pdf	Initial sample: https://cloud.degoo.com/share/yeamroo0vdj2zjxd1fafww

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\Local\Temp\acrord32_sbx

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File opened: C:\Windows\SysWOW64\Msftedit.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: Updated Invoices.pdf	Initial sample: PDF keyword /JS count = 0
Source: Updated Invoices.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Updated Invoices.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Updated Invoices.pdf

Initial sample: PDF keyword obj count = 51

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: AcroRd32.exe, 00000001.00000000.353147317.000000000B92A000.00000004.00000001.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllU

Source: AcroRd32.exe, 00000001.00000000.358765567.0000000005A10000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: AcroRd32.exe, 00000001.00000000.358765567.0000000005A10000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: AcroRd32.exe, 00000001.00000000.358765567.0000000005A10000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: AcroRd32.exe, 00000001.00000000.358765567.0000000005A10000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: AcroRd32.exe, 00000001.00000000.358765567.0000000005A10000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Spearphishing Link1	Windows Management Instrumentation	Path Interception	Process Injection2	Masquerading1	OS Credential Dumping	Security Software Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection2	LSASS Memory	Process Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	File and Directory Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Updated Invoices.pdf	0%	Virustotal		Browse
Updated Invoices.pdf	2%	ReversingLabs

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
www.googleoptimize.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.osmf.org/region/target#http://www.osmf.org/layout/renderer#http://www.osmf.org/layout/abs	0%	URL Reputation	safe
http://www.osmf.org/region/target#http://www.osmf.org/layout/renderer#http://www.osmf.org/layout/abs	0%	URL Reputation	safe
http://www.osmf.org/region/target#http://www.osmf.org/layout/renderer#http://www.osmf.org/layout/abs	0%	URL Reputation	safe
http://www.osmf.org/region/target#http://www.osmf.org/layout/renderer#http://www.osmf.org/layout/abs	0%	URL Reputation	safe
https://app.degoo	0%	Avira URL Cloud	safe
http://cipa.jp/exif/1.0/	0%	URL Reputation	safe
http://cipa.jp/exif/1.0/	0%	URL Reputation	safe
http://cipa.jp/exif/1.0/	0%	URL Reputation	safe
http://cipa.jp/exif/1.0/	0%	URL Reputation	safe
http://www.osmf.org/default/1.0%http://www.osmf.org/mediatype/default	0%	URL Reputation	safe
http://www.osmf.org/default/1.0%http://www.osmf.org/mediatype/default	0%	URL Reputation	safe
http://www.osmf.org/default/1.0%http://www.osmf.org/mediatype/default	0%	URL Reputation	safe
http://www.osmf.org/default/1.0%http://www.osmf.org/mediatype/default	0%	URL Reputation	safe
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/i	0%	Avira URL Cloud	safe
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/	0%	Avira URL Cloud	safe
https://ims-na1.adobelogin.comMth	0%	Avira URL Cloud	safe
https://app.degoo1307723363Root	0%	Avira URL Cloud	safe
http://www.npes.org/pdfx/ns/id/	0%	URL Reputation	safe
http://www.npes.org/pdfx/ns/id/	0%	URL Reputation	safe
http://www.npes.org/pdfx/ns/id/	0%	URL Reputation	safe
http://www.osmf.org/drm/default	0%	URL Reputation	safe
http://www.osmf.org/drm/default	0%	URL Reputation	safe
http://www.osmf.org/drm/default	0%	URL Reputation	safe
http://www.empathways.orgC	0%	Avira URL Cloud	safe
http://www.osmf.org/elementId%http://www.osmf.org/temporal/embedded$http://www.osmf.org/temporal/dyn	0%	URL Reputation	safe
http://www.osmf.org/elementId%http://www.osmf.org/temporal/embedded$http://www.osmf.org/temporal/dyn	0%	URL Reputation	safe
http://www.osmf.org/elementId%http://www.osmf.org/temporal/embedded$http://www.osmf.org/temporal/dyn	0%	URL Reputation	safe
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/5	0%	Avira URL Cloud	safe
https://app.degooRoot	0%	Avira URL Cloud	safe
http://www.osmf.org/subclip/1.0	0%	URL Reputation	safe
http://www.osmf.org/subclip/1.0	0%	URL Reputation	safe
http://www.osmf.org/subclip/1.0	0%	URL Reputation	safe
http://ns.useplus.org/ldf/xmp/1.0/	0%	URL Reputation	safe
http://ns.useplus.org/ldf/xmp/1.0/	0%	URL Reputation	safe
http://ns.useplus.org/ldf/xmp/1.0/	0%	URL Reputation	safe
http://iptc.org/std/Iptc4xmpExt/2008-02-29/	0%	URL Reputation	safe
http://iptc.org/std/Iptc4xmpExt/2008-02-29/	0%	URL Reputation	safe
http://iptc.org/std/Iptc4xmpExt/2008-02-29/	0%	URL Reputation	safe
http://www.osmf.org/layout/anchor	0%	URL Reputation	safe
http://www.osmf.org/layout/anchor	0%	URL Reputation	safe
http://www.osmf.org/layout/anchor	0%	URL Reputation	safe
http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/	0%	URL Reputation	safe
http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/	0%	URL Reputation	safe
http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/	0%	URL Reputation	safe
http://www.empathways.orgIk	0%	Avira URL Cloud	safe
https://api.echosign.comRL/wo	0%	Avira URL Cloud	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
http://crl.mi	0%	URL Reputation	safe
http://crl.mi	0%	URL Reputation	safe
http://crl.mi	0%	URL Reputation	safe
http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/m#	0%	Avira URL Cloud	safe
https://www.google.%/ads/ga-audiences	0%	URL Reputation	safe
https://www.google.%/ads/ga-audiences	0%	URL Reputation	safe
https://www.google.%/ads/ga-audiences	0%	URL Reputation	safe
http://www.osmf.org/layout/padding%http://www.osmf.org/layout/attributes	0%	URL Reputation	safe
http://www.osmf.org/layout/padding%http://www.osmf.org/layout/attributes	0%	URL Reputation	safe
http://www.osmf.org/layout/padding%http://www.osmf.org/layout/attributes	0%	URL Reputation	safe
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/y	0%	Avira URL Cloud	safe
http://www.empathways.org	0%	Avira URL Cloud	safe
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/	0%	Avira URL Cloud	safe
http://www.quicktime.com.Acrobat	0%	URL Reputation	safe
http://www.quicktime.com.Acrobat	0%	URL Reputation	safe
http://www.quicktime.com.Acrobat	0%	URL Reputation	safe
http://iptc.org/std/Iptc4xmpExt/2008-02-29/em#TxN	0%	Avira URL Cloud	safe
http://www.adobe.	0%	URL Reputation	safe
http://www.adobe.	0%	URL Reputation	safe
http://www.adobe.	0%	URL Reputation	safe
http://ns.useplus.org/ldf/xmp/1.0/8-02-29/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.de	142.250.184.227	true	false		high
app.degoo.com	104.18.229.238	true	false		high
rest-api.degoo.com	104.18.229.238	true	false		high
stats.l.doubleclick.net	74.125.140.156	true	false		high
degoo.com	104.18.228.238	true	false		high
s82i.app.link	13.224.193.100	true	false		high
custom.bnc.lt	52.52.240.3	true	false		high
www.googleoptimize.com	142.250.186.78	true	false	1%, Virustotal, Browse	unknown
cloud.degoo.com	unknown	unknown	false		high
stats.g.doubleclick.net	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Reputation
https://app.degoo.com/share/yEamRoo0VDj2ZJXd1fAFww?_branch_match_id=936917171307723363	false	high
https://app.degoo.com/shared?_branch_match_id=936917171307723363	false	high
https://app.degoo.com/moments?_branch_match_id=936917171307723363	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://stats.g.doubleclick.net/g/collect	js[1].js.27.dr	false		high
https://app.degoo.com/shared?_branch_match_id=936917171307723363	~DF70FA6F493C9B0CC3.TMP.26.dr	false		high
https://app.degoo.com/moments?_branch_match_id=936917171307723363	~DF70FA6F493C9B0CC3.TMP.26.dr	false		high
https://app.degoo.com/shared?_branch_match_id=936917171307723363&	~DF70FA6F493C9B0CC3.TMP.26.dr	false		high
https://app.degoo.com/shared?_branch_match_id=93691717	{FE9C8DC0-D5EA-11EB-90E5-ECF4BB570DC9}.dat.26.dr	false		high
https://app.degoo.com/shared?_branch_match_id=936917171307723363d=936917171307723363	~DF70FA6F493C9B0CC3.TMP.26.dr	false		high
https://app.degoo.com/moments?_branch_match_id=9369171anch_match_id=93691717130772336371307723363d=9	{FE9C8DC0-D5EA-11EB-90E5-ECF4BB570DC9}.dat.26.dr	false		high
http://www.aiim.org/pdfa/ns/schema#	AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	false		high
http://www.osmf.org/region/target#http://www.osmf.org/layout/renderer#http://www.osmf.org/layout/abs	AcroRd32.exe, 00000001.00000000.338567460.0000000007E90000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://app.degoo.com/moments?_branch_match_id=9369171	{FE9C8DC0-D5EA-11EB-90E5-ECF4BB570DC9}.dat.26.dr	false		high
http://www.aiim.org/pdfa/ns/id/G	AcroRd32.exe, 00000001.00000000.349982598.000000000A982000.00000004.00000001.sdmp	false		high
https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fecono	AcroRd32.exe, 00000001.00000000.351193414.000000000B769000.00000004.00000001.sdmp, AcroRd32.exe, 00000001.00000000.349973117.000000000A96E000.00000004.00000001.sdmp, Updated Invoices.pdf	false		high
https://app.degoo	{FE9C8DC0-D5EA-11EB-90E5-ECF4BB570DC9}.dat.26.dr	false	Avira URL Cloud: safe	unknown
http://cipa.jp/exif/1.0/	AcroRd32.exe, 00000001.00000000.349982598.000000000A982000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.osmf.org/default/1.0%http://www.osmf.org/mediatype/default	AcroRd32.exe, 00000001.00000000.338567460.0000000007E90000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://app.degoo.com/moments?_branch_match_id=936917171307723363d=936917171307723363T771	~DF70FA6F493C9B0CC3.TMP.26.dr	false		high
https://www.youtube.com/iframe_api	js[1].js.27.dr	false		high
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/i	AcroRd32.exe, 00000001.00000000.354888538.000000000D1A2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.aiim.org/pdfa/ns/type#	AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	false		high
https://api.echosign.com	AcroRd32.exe, 00000001.00000000.355071246.000000000D3C7000.00000004.00000001.sdmp	false		high
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload/	AcroRd32.exe, 00000001.00000000.354888538.000000000D1A2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://ims-na1.adobelogin.comMth	AcroRd32.exe, 00000001.00000000.365175950.00000000095A2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://fontforge.sf.net/)	TitlingFBGothicMedium[1].eot.27.dr	false		high
https://app.degoo1307723363Root	{FE9C8DC0-D5EA-11EB-90E5-ECF4BB570DC9}.dat.26.dr	false	Avira URL Cloud: safe	unknown
http://www.npes.org/pdfx/ns/id/	AcroRd32.exe, 00000001.00000000.349982598.000000000A982000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://app.degoo.com/login?redirectUrl=%2Fmoments7171307723363d=93691717130772336336917171307723363	~DF70FA6F493C9B0CC3.TMP.26.dr	false		high
http://www.osmf.org/drm/default	AcroRd32.exe, 00000001.00000000.338567460.0000000007E90000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://app.degoo.com/share/yEamRoo0VDj2ZJXd1fAFww?_branch_match_id=936917171307723363	~DF70FA6F493C9B0CC3.TMP.26.dr	false		high
http://www.empathways.orgC	AcroRd32.exe, 00000001.00000000.351193414.000000000B769000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.osmf.org/elementId%http://www.osmf.org/temporal/embedded$http://www.osmf.org/temporal/dyn	AcroRd32.exe, 00000001.00000000.338567460.0000000007E90000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://stats.g.doubleclick.net/j/collect	analytics[1].js.27.dr	false		high
http://www.aiim.org/pdfa/ns/extension/	AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	false		high
http://www.aiim.org/pdfa/ns/type#ty#wx	AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	false		high
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/5	AcroRd32.exe, 00000001.00000000.353739458.000000000B9E7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://app.degooRoot	{FE9C8DC0-D5EA-11EB-90E5-ECF4BB570DC9}.dat.26.dr	false	Avira URL Cloud: safe	unknown
https://app.degoo.com/login?redirectUrl=%2Fmoments71	{FE9C8DC0-D5EA-11EB-90E5-ECF4BB570DC9}.dat.26.dr	false		high
https://app.degoo.com/assets/icons/favicon_round.ico	imagestore.dat.26.dr	false		high
http://www.osmf.org/subclip/1.0	AcroRd32.exe, 00000001.00000000.338567460.0000000007E90000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://app.degoo.com/login?redirectUrl=%2Fshared17171307723363.	~DF70FA6F493C9B0CC3.TMP.26.dr	false		high
http://www.aiim.org/pdfa/ns/property#	AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	false		high
http://ns.useplus.org/ldf/xmp/1.0/	AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com%2Fdisruptpoverty&data=	AcroRd32.exe, 00000001.00000000.350901535.000000000B685000.00000004.00000001.sdmp, AcroRd32.exe, 00000001.00000000.349973117.000000000A96E000.00000004.00000001.sdmp, Updated Invoices.pdf	false		high
http://www.aiim.org/pdfa/ns/id/	AcroRd32.exe, 00000001.00000000.349982598.000000000A982000.00000004.00000001.sdmp	false		high
https://cloud.degoo.com/share/yEamRoo0VDj2ZJXd1fAFwwRoot	{FE9C8DC0-D5EA-11EB-90E5-ECF4BB570DC9}.dat.26.dr	false		high
http://iptc.org/std/Iptc4xmpExt/2008-02-29/	AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.osmf.org/layout/anchor	AcroRd32.exe, 00000001.00000000.338567460.0000000007E90000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://app.degoo.com/share/yEamRoo0VDj2ZJXd1fAFww?_branch_match_id=936917171307723363anch_match_id=	{FE9C8DC0-D5EA-11EB-90E5-ECF4BB570DC9}.dat.26.dr	false		high
https://degoo.com/download	en[1].json.27.dr	false		high
https://lh3.googleusercontent.com	en[1].htm.27.dr	false		high
http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/	AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://app.degoo.com/login?redirectUrl=%2Fmoments7171307723363d=9369171713077233630	~DF70FA6F493C9B0CC3.TMP.26.dr	false		high
http://www.aiim.org/pdfe/ns/id/	AcroRd32.exe, 00000001.00000000.349982598.000000000A982000.00000004.00000001.sdmp	false		high
https://app.degoo.com/login?redirectUrl=%2Fmoments	~DF70FA6F493C9B0CC3.TMP.26.dr	false		high
http://www.empathways.orgIk	AcroRd32.exe, 00000001.00000000.354948292.000000000D257000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://cloud.degoo.com/share/yEamRoo0VDj2ZJXd1fAFww	AcroRd32.exe, 00000001.00000000.349982598.000000000A982000.00000004.00000001.sdmp, ~DF70FA6F493C9B0CC3.TMP.26.dr	false		high
https://app.degoo.com/login?redirectUrl=%2Fshared	~DF70FA6F493C9B0CC3.TMP.26.dr	false		high
http://www.aiim.org/pdfa/ns/field#y#l/1.0/	AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	false		high
https://api.echosign.comRL/wo	AcroRd32.exe, 00000001.00000000.354948292.000000000D257000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://cct.google/taggy/agent.js	js[3].js.27.dr, js[1].js.27.dr, optimize[1].js.27.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.aiim.org/pdfa/ns/type#Font#	AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	false		high
http://crl.mi	AcroRd32.exe, 00000001.00000000.353350335.000000000B949000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://app.degoo.com/share/yEamRoo0VDj2ZJXd1fAFww?_branch_match_id=936917171307723363Root	{FE9C8DC0-D5EA-11EB-90E5-ECF4BB570DC9}.dat.26.dr	false		high
https://app.degoo.com/login?redirectUrl=%2Fshared17171307723363b	~DF70FA6F493C9B0CC3.TMP.26.dr	false		high
http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/m#	AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://nam02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.empathways.org%2F&data=04%7C01%	AcroRd32.exe, 00000001.00000000.351193414.000000000B769000.00000004.00000001.sdmp, AcroRd32.exe, 00000001.00000000.349973117.000000000A96E000.00000004.00000001.sdmp, Updated Invoices.pdf	false		high
http://www.aiim.org/pdfa/ns/field#0/xmlns/f#	AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	false		high
https://app.degoo.com/login?redirectUrl=%2Fshared1717	{FE9C8DC0-D5EA-11EB-90E5-ECF4BB570DC9}.dat.26.dr	false		high
https://www.google.%/ads/ga-audiences	analytics[1].js.27.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://www.aiim.org/pdfa/ns/field#	AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	false		high
http://www.osmf.org/layout/padding%http://www.osmf.org/layout/attributes	AcroRd32.exe, 00000001.00000000.338567460.0000000007E90000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://stats.g.doubleclick.net/g/collect?v=2&	js[1].js.27.dr	false		high
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/y	AcroRd32.exe, 00000001.00000000.351399815.000000000B7D2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.empathways.org	AcroRd32.exe, 00000001.00000000.354948292.000000000D257000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://app.degoo.com/login?redirectUrl=%2Fmoments7171307723363d=936917171307723363	~DF70FA6F493C9B0CC3.TMP.26.dr	false		high
https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/	AcroRd32.exe, 00000001.00000000.351399815.000000000B7D2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.quicktime.com.Acrobat	AcroRd32.exe, 00000001.00000000.353818798.000000000BAF0000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://ims-na1.adobelogin.com	AcroRd32.exe, 00000001.00000000.365175950.00000000095A2000.00000004.00000001.sdmp	false		high
http://iptc.org/std/Iptc4xmpExt/2008-02-29/em#TxN	AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://cloud.degoo.com/share/yEamRoo0VDj2ZJXd1fAFww)	AcroRd32.exe, 00000001.00000000.349973117.000000000A96E000.00000004.00000001.sdmp, Updated Invoices.pdf	false		high
https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fvimeo.com%2Fempathways&data=04%7C0	AcroRd32.exe, 00000001.00000000.351193414.000000000B769000.00000004.00000001.sdmp, AcroRd32.exe, 00000001.00000000.349973117.000000000A96E000.00000004.00000001.sdmp, Updated Invoices.pdf	false		high
http://www.adobe.	AcroRd32.exe, 00000001.00000000.355071246.000000000D3C7000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://app.degoo.com/assets/icons/favicon_round.ico~	imagestore.dat.26.dr	false		high
http://ns.useplus.org/ldf/xmp/1.0/8-02-29/	AcroRd32.exe, 00000001.00000000.350045863.000000000AA27000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://app.degoo.com/moments?_branch_match_id=936917171307723363d=9369171713077233630	~DF70FA6F493C9B0CC3.TMP.26.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
74.125.140.156	stats.l.doubleclick.net	United States	15169	GOOGLEUS	false
142.250.186.78	www.googleoptimize.com	United States	15169	GOOGLEUS	false
104.18.229.238	app.degoo.com	United States	13335	CLOUDFLARENETUS	false
52.52.240.3	custom.bnc.lt	United States	16509	AMAZON-02US	false
13.224.193.100	s82i.app.link	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	440459
Start date:	25.06.2021
Start time:	12:22:35
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Updated Invoices.pdf
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.winPDF@17/106@10/6
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .pdf Found PDF document Find and activate links Security Warning found Close Viewer Browsing link: https://app.degoo.com/moments?_branch_match_id=936917171307723363 Browsing link: https://app.degoo.com/shared?_branch_match_id=936917171307723363
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, RuntimeBroker.exe, backgroundTaskHost.exe, audiodg.exe, BackgroundTransferHost.exe, HxTsr.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe Excluded IPs from analysis (whitelisted): 52.147.198.201, 20.82.210.154, 204.79.197.200, 13.107.21.200, 104.42.151.234, 23.211.6.115, 80.67.82.80, 80.67.82.97, 23.211.4.250, 23.211.4.86, 13.107.5.88, 13.107.42.23, 40.126.31.3, 40.126.31.138, 40.126.31.142, 40.126.31.7, 20.190.159.131, 40.126.31.140, 40.126.31.9, 20.190.159.135, 20.82.209.183, 80.67.82.211, 80.67.82.235, 23.203.80.193, 142.250.184.227, 142.250.185.200, 142.250.186.110, 142.250.186.46, 40.112.88.60, 20.50.102.62, 152.199.19.161, 20.54.7.98, 20.54.104.15 Excluded domains from analysis (whitelisted): gstaticadssl.l.google.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, acroipm2.adobe.com, www.tm.a.prd.aadg.trafficmanager.net, e11290.dspg.akamaiedge.net, login.live.com, a122.dscd.akamai.net, www-bing-com.dual-a-0001.a-msedge.net, watson.telemetry.microsoft.com, www.google-analytics.com, www.bing.com, fs.microsoft.com, afdo-tas-offload.trafficmanager.net, dual-a-0001.a-msedge.net, acroipm2.adobe.com.edgesuite.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, ris.api.iris.microsoft.com, ssl.adobe.com.edgekey.net, www3.l.google.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, cs9.wpc.v0cdn.net, neu-consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, client-office365-tas.msedge.net, ocos-office365-s2s.msedge.net, config.edge.skype.com.trafficmanager.net, e4578.dscb.akamaiedge.net, store-images.s-microsoft.com-c.edgekey.net, e-0009.e-msedge.net, config-edge-skype.l-0014.l-msedge.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, l-0014.config.skype.com, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, iecvlist.microsoft.com, e12564.dspb.akamaiedge.net, go.microsoft.com, www.googletagmanager.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, config.edge.skype.com, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, www-google-analytics.l.google.com, fonts.gstatic.com, ie9comview.vo.msecnd.net, www-googletagmanager.l.google.com, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, login.msa.msidentity.com, skypedataprdcoleus16.cloudapp.net, ocos-office365-s2s-msedge-net.e-0009.e-msedge.net, a-0001.a-afdentry.net.trafficmanager.net, armmf.adobe.com, go.microsoft.com.edgekey.net, analytics.google.com, l-0014.l-msedge.net, skypedataprdcolwus16.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:23:30	API Interceptor	12x Sleep call for process: RdrCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
13.224.193.100	%F0%9F%93%A9-Tina_Cfisd_HP29VF.htm	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
s82i.app.link	https://cloud.degoo.com/e/drive-m9fnizsjxix1	Get hash	malicious	Browse	52.85.183.160
s82i.app.link	https://cloud.degoo.com/e/drive-nbwy2hgy9pup	Get hash	malicious	Browse	13.35.253.4
custom.bnc.lt	https://cloud.degoo.com/e/drive-m9fnizsjxix1	Get hash	malicious	Browse	54.183.40.17
custom.bnc.lt	https://cloud.degoo.com/e/drive-nbwy2hgy9pup	Get hash	malicious	Browse	52.52.137.17
www.google.de	DocuSign-June-SOA-Dues.261.htm	Get hash	malicious	Browse	142.250.184.227
	XqnM8G36Ih.exe	Get hash	malicious	Browse	142.250.184.195
	bmaphis@cardinaltek.com_16465506 AMDocAtt.HTML	Get hash	malicious	Browse	142.250.184.195
	VM_5823_05_24_2-2.html	Get hash	malicious	Browse	142.250.184.195
	HRXoZLG4ym.exe	Get hash	malicious	Browse	142.250.184.195
	Hngx5CdG2D.exe	Get hash	malicious	Browse	142.250.181.227
	muestra6999.exe	Get hash	malicious	Browse	142.250.181.227
	E1a92ARmPw.exe	Get hash	malicious	Browse	172.217.16.99
	crt9O3URua.exe	Get hash	malicious	Browse	172.217.16.99
	E1a92ARmPw.exe	Get hash	malicious	Browse	172.217.16.99
	Ref#Doc30504871 Wyg.htm	Get hash	malicious	Browse	172.217.16.99
	ManyToOneMailMerge Ver 18.2.dotm	Get hash	malicious	Browse	216.58.207.131
	Sleek_Free.exe	Get hash	malicious	Browse	216.58.207.131
	wzdu53.exe	Get hash	malicious	Browse	216.58.207.131
	teX5sUCWAg.exe	Get hash	malicious	Browse	142.251.36.227
	teX5sUCWAg.exe	Get hash	malicious	Browse	142.251.36.227
	SetupFA.exe	Get hash	malicious	Browse	172.217.20.3
	aydrxnitvo.exe	Get hash	malicious	Browse	172.217.23.67
	sP2AXSWC73.exe	Get hash	malicious	Browse	172.217.16.99
	0fXCUmAjNE.exe	Get hash	malicious	Browse	172.217.16.99

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AMAZON-02US	8f9b032ff6f56a685f4c6f9eb57784811d6c98aa83b0c.dll	Get hash	malicious	Browse	143.204.91.74
	9qFR0r9nR9.exe	Get hash	malicious	Browse	99.83.162.16
	Minutes of Meeting 22062021.exe	Get hash	malicious	Browse	52.58.78.16
	718421.xlsm	Get hash	malicious	Browse	143.204.91.74
	47mAsp9IER.exe	Get hash	malicious	Browse	54.77.19.84
	Zmxe2vaWgJ.exe	Get hash	malicious	Browse	3.143.65.214
	Wilson-McShane Corporation ACH.xlsx	Get hash	malicious	Browse	3.14.163.250
	Wilson-McShane Corporation ACH.xlsx	Get hash	malicious	Browse	18.220.131.96
	Ln11IgJVUM.dll	Get hash	malicious	Browse	13.225.75.73
	6c710694d270db91b550daf3177622514d2444e7484fb.dll	Get hash	malicious	Browse	13.225.75.73
	l9Rl1ElIfM.exe	Get hash	malicious	Browse	3.141.177.1
	AAC_19002.xlsx	Get hash	malicious	Browse	54.93.51.255
	h2GeNTLcFz.xls	Get hash	malicious	Browse	52.47.49.164
	h2GeNTLcFz.xls	Get hash	malicious	Browse	52.47.49.164
	PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe	Get hash	malicious	Browse	52.35.132.113
	uOGIhyiQuh.exe	Get hash	malicious	Browse	52.88.131.2
	VhKa9ebVyn.exe	Get hash	malicious	Browse	15.164.192.168
	A7DmPhc0bs.exe	Get hash	malicious	Browse	104.192.141.1
	Shipping Document DHL.exe	Get hash	malicious	Browse	52.14.32.15
	Invoice_634000.html	Get hash	malicious	Browse	18.195.84.53
AMAZON-02US	8f9b032ff6f56a685f4c6f9eb57784811d6c98aa83b0c.dll	Get hash	malicious	Browse	143.204.91.74
	9qFR0r9nR9.exe	Get hash	malicious	Browse	99.83.162.16
	Minutes of Meeting 22062021.exe	Get hash	malicious	Browse	52.58.78.16
	718421.xlsm	Get hash	malicious	Browse	143.204.91.74
	47mAsp9IER.exe	Get hash	malicious	Browse	54.77.19.84
	Zmxe2vaWgJ.exe	Get hash	malicious	Browse	3.143.65.214
	Wilson-McShane Corporation ACH.xlsx	Get hash	malicious	Browse	3.14.163.250
	Wilson-McShane Corporation ACH.xlsx	Get hash	malicious	Browse	18.220.131.96
	Ln11IgJVUM.dll	Get hash	malicious	Browse	13.225.75.73
	6c710694d270db91b550daf3177622514d2444e7484fb.dll	Get hash	malicious	Browse	13.225.75.73
	l9Rl1ElIfM.exe	Get hash	malicious	Browse	3.141.177.1
	AAC_19002.xlsx	Get hash	malicious	Browse	54.93.51.255
	h2GeNTLcFz.xls	Get hash	malicious	Browse	52.47.49.164
	h2GeNTLcFz.xls	Get hash	malicious	Browse	52.47.49.164
	PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe	Get hash	malicious	Browse	52.35.132.113
	uOGIhyiQuh.exe	Get hash	malicious	Browse	52.88.131.2
	VhKa9ebVyn.exe	Get hash	malicious	Browse	15.164.192.168
	A7DmPhc0bs.exe	Get hash	malicious	Browse	104.192.141.1
	Shipping Document DHL.exe	Get hash	malicious	Browse	52.14.32.15
	Invoice_634000.html	Get hash	malicious	Browse	18.195.84.53
CLOUDFLARENETUS	bCmk5BI0Dz.exe	Get hash	malicious	Browse	104.21.4.27
	v30WjYNdxc.exe	Get hash	malicious	Browse	104.21.40.195
	TN3OUeJdjW.exe	Get hash	malicious	Browse	104.21.46.30
	nKxGiM5OIQ.exe	Get hash	malicious	Browse	104.21.76.97
	9vLpclp5zt.exe	Get hash	malicious	Browse	104.21.40.195
	reutWc4khH.exe	Get hash	malicious	Browse	104.21.42.63
	8f9b032ff6f56a685f4c6f9eb57784811d6c98aa83b0c.dll	Get hash	malicious	Browse	104.20.185.68
	file.dll	Get hash	malicious	Browse	104.20.185.68
	EhmDFuSgv7.exe	Get hash	malicious	Browse	104.21.42.63
	fKis0LDEvF.exe	Get hash	malicious	Browse	104.21.26.175
	mj2C1DduDJ.exe	Get hash	malicious	Browse	104.21.42.63
	QzNbf2jnt5.exe	Get hash	malicious	Browse	104.21.42.63
	x3Jq3pIet8.exe	Get hash	malicious	Browse	104.21.42.63
	UG1gpOODiz.exe	Get hash	malicious	Browse	104.21.42.63
	6EUZng4opE.exe	Get hash	malicious	Browse	104.21.42.63
	P4H8tiLSAi.exe	Get hash	malicious	Browse	104.21.42.63
	0OF8kW42WL.exe	Get hash	malicious	Browse	104.21.42.63
	zqLODecqQV.exe	Get hash	malicious	Browse	104.21.42.63
	ATT96412.html	Get hash	malicious	Browse	104.18.10.207
	9qFR0r9nR9.exe	Get hash	malicious	Browse	104.21.61.102

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
9e10692f1b7f78228b2d4e424db3a98c	8f9b032ff6f56a685f4c6f9eb57784811d6c98aa83b0c.dll	Get hash	malicious	Browse	74.125.140.156 142.250.186.78 52.52.240.3 13.224.193.100 104.18.229.238
	file.dll	Get hash	malicious	Browse	74.125.140.156 142.250.186.78 52.52.240.3 13.224.193.100 104.18.229.238
	ATT96412.html	Get hash	malicious	Browse	74.125.140.156 142.250.186.78 52.52.240.3 13.224.193.100 104.18.229.238
	sf0X1hMF0g.doc	Get hash	malicious	Browse	74.125.140.156 142.250.186.78 52.52.240.3 13.224.193.100 104.18.229.238
	Wilson-McShane Corporation ACH.xlsx	Get hash	malicious	Browse	74.125.140.156 142.250.186.78 52.52.240.3 13.224.193.100 104.18.229.238
	1.exe	Get hash	malicious	Browse	74.125.140.156 142.250.186.78 52.52.240.3 13.224.193.100 104.18.229.238
	Ln11IgJVUM.dll	Get hash	malicious	Browse	74.125.140.156 142.250.186.78 52.52.240.3 13.224.193.100 104.18.229.238
	6c710694d270db91b550daf3177622514d2444e7484fb.dll	Get hash	malicious	Browse	74.125.140.156 142.250.186.78 52.52.240.3 13.224.193.100 104.18.229.238
	OQgRyt6hCF.exe	Get hash	malicious	Browse	74.125.140.156 142.250.186.78 52.52.240.3 13.224.193.100 104.18.229.238
	DocuSign-June-SOA-Dues.261.htm	Get hash	malicious	Browse	74.125.140.156 142.250.186.78 52.52.240.3 13.224.193.100 104.18.229.238
	Invoice 715320 paul@forthebiome.com.html	Get hash	malicious	Browse	74.125.140.156 142.250.186.78 52.52.240.3 13.224.193.100 104.18.229.238
	HSBC_Payment_slip_for Outstanding 001005l.htm	Get hash	malicious	Browse	74.125.140.156 142.250.186.78 52.52.240.3 13.224.193.100 104.18.229.238
	microA.exe	Get hash	malicious	Browse	74.125.140.156 142.250.186.78 52.52.240.3 13.224.193.100 104.18.229.238
	zw0w9vn3tl.exe	Get hash	malicious	Browse	74.125.140.156 142.250.186.78 52.52.240.3 13.224.193.100 104.18.229.238
	Fax_Payment_return906-906.htm	Get hash	malicious	Browse	74.125.140.156 142.250.186.78 52.52.240.3 13.224.193.100 104.18.229.238
	NzVaXoIDBZ.exe	Get hash	malicious	Browse	74.125.140.156 142.250.186.78 52.52.240.3 13.224.193.100 104.18.229.238
	dxFFmPpg8Q.exe	Get hash	malicious	Browse	74.125.140.156 142.250.186.78 52.52.240.3 13.224.193.100 104.18.229.238
	M7II8HTb0A.dll	Get hash	malicious	Browse	74.125.140.156 142.250.186.78 52.52.240.3 13.224.193.100 104.18.229.238
	#Ud83d#Udd12 ( 2 ) Secured Documents-Atlanticare.htm	Get hash	malicious	Browse	74.125.140.156 142.250.186.78 52.52.240.3 13.224.193.100 104.18.229.238
	20210621_064143.html	Get hash	malicious	Browse	74.125.140.156 142.250.186.78 52.52.240.3 13.224.193.100 104.18.229.238

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	615
Entropy (8bit):	5.660251618675483
Encrypted:	false
SSDEEP:	6:men9YOFLvEWdM9QK+Pti7Z+P41TK6tpen9YOFLvEWdM9Qn5VHi7Z+P41TK6tCenU:vDRM9tZiE8DRM9i5kZiE9DRM90ZiEW9
MD5:	D344AB70C4CDE4EC2D16A330E6A6D4D2
SHA1:	CA8047835219244E5475048B0184216D1FA918BE
SHA-256:	30FD4332784A16C1CDF1B3F75CEE5FFCAB319F3771EF61DF39CBF31DB8DBD554
SHA-512:	3ED625059C17D36590B9AB6BF32305903BFC0625F40E564307BFA1605FD6173A66C011584C45C1C7AD88A53F4B6EB3DFA3E815CC8AEBEF584555D0AA8977A9B2
Malicious:	false
Reputation:	low
Preview:	0\r..m......M..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/plugin.js .!C.\2$/....."#.D.U.M.5.A....d.{v.^.G...d.W.:...P..k%..A..Eo...................A..Eo.................0\r..m......M..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/plugin.js ...l\2$/....."#.D...O.5.A....d.{v.^.G...d.W.:...P..k%..A..Eo...................A..Eo......:<..........0\r..m......M..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/plugin.js .j.\2$/....."#.D.R.P.5.A....d.{v.^.G...d.W.:...P..k%..A..Eo...................A..Eo......L...........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.640969061704273
Encrypted:	false
SSDEEP:	6:mi9NqEYOFLvEkvsl/Fi8Be7Ywcr1TK6tM9XMi9NqEYOFLvEkaoz8Be7Ywcr1TK6f:V9z0l/A9PQS39z6oz9PQu9zPE9PQA
MD5:	B2287BD7216F1B66D0633EB3212764A3
SHA1:	4675158DDFBB48B74D77849DBB8259A1D0ED2F2C
SHA-256:	9BAFAE897E83DF2C88100B2E1A3835A7EE5F9E0D3CFAB5C0988325A572D2623B
SHA-512:	D22C3BA554C13F2D7E2DA66C1CCE809A3E00F035355BCFBE64D5D9C5BD61157FE606557901A5161FA8B7CC3E7AFFBEF229ABBFEF121D63A066E24C6432BB4FA3
Malicious:	false
Reputation:	low
Preview:	0\r..m............,....._keyhttps://rna-resource.acrobat.com/init.js ..#.[2$/....."#.D.c.M.5.A.1.x.'.vI..\|Z..o...+.4....0..A..Eo...................A..Eo........a........0\r..m............,....._keyhttps://rna-resource.acrobat.com/init.js ..SY\2$/....."#.D..nO.5.A.1.x.'.vI..\|Z..o...+.4....0..A..Eo...................A..Eo......K...........0\r..m............,....._keyhttps://rna-resource.acrobat.com/init.js ...\2$/....."#.D.FP.5.A.1.x.'.vI..*\|Z..o...+.4....0..A..Eo...................A..Eo.......".j........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	5.608895659094535
Encrypted:	false
SSDEEP:	12:DyeRVFAFjVFAFpplUo6jYyeRVFAFjVFAFc4BplUo6j9TyeRVFAFjVFAF03pG+pl8:tB4v4ppSBsB4v4c4BpSBXB4v4GpG+pSB
MD5:	39C8A2A0E5C81628D172BDBA5755D502
SHA1:	8DC3C19450F26881AC5339983D5673016E4FB90E
SHA-256:	A3DD832B1E3BA5DB3151D09D3B1276B596862118CD658154B51D1898E0F8F7F8
SHA-512:	5ED67F6831BAF6D26B73B91B450AE977B395B831F575B642F3E7B1CE75B1468E2ED8D6ABCCB69DA0EB38AA744A8076D8136B0DE49A7724BB90C4F83E49B836F7
Malicious:	false
Reputation:	low
Preview:	0\r..m......v...n......._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/selector.js .n..[2$/....."#.D...M.5.A..hvDO.N.t@.....n....... ....A..Eo...................A..Eo........7........0\r..m......v...n......._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/selector.js ..l\2$/....."#.D>..O.5.A..hvDO.N.t@.....n....... ....A..Eo...................A..Eo........ol........0\r..m......v...n......._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/selector.js ...\2$/....."#.D(..P.5.A..hvDO.N.t@.....n....... ....A..Eo...................A..Eo.................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	464
Entropy (8bit):	5.655316773780846
Encrypted:	false
SSDEEP:	6:mNtVYOFLvEWdFCi5RsdCfwciWulHyA1TK6t2feNtVYOFLvEWdFCi5Rs4+6ciWulZ:IbRkiDnoNWusseQbRkiDS6NWuss
MD5:	D6951152A919CED75375806CD8FE81DD
SHA1:	705FB434819354FEA6FB14E3F29C8DA6D8195C61
SHA-256:	D86C7335AF99ADEAF0B397DF72A5757F77D16601A8ADF490288A133E194EA29D
SHA-512:	817EB9D8B00F8E465D16C88634C98D2D5737CEDCB344F97A3CE3951C31355EE30A6E61428063294E5E071E9BC892CBC044F8FEF7E132075D1832C86BC3A0CD1D
Malicious:	false
Reputation:	low
Preview:	0\r..m......h.....'....._keyhttps://rna-resource.acrobat.com/static/js/plugins/aicuc/js/plugins/rhp/exportpdf-rna-tool-view.js .{E.\2$/....."#.D.'.N.5.A..8 P..a...R..Y....7.@..2Dm{..A..Eo...................A..Eo........#*........0\r..m......h.....'....._keyhttps://rna-resource.acrobat.com/static/js/plugins/aicuc/js/plugins/rhp/exportpdf-rna-tool-view.js .RPr\2$/....."#.D.x.O.5.A..8 P..a...R..Y....7.@..2Dm{..A..Eo...................A..Eo......A...........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.5481146451803705
Encrypted:	false
SSDEEP:	6:m+yiXYOFLvEWd7VIGXVuMGUVyh9PT41TK6t:pyixRuMV41TE
MD5:	68A572C945AB6E01E09D41649EC8E216
SHA1:	39DA516BC47BFF2A6274AFDAF5E2EFC1C066FF73
SHA-256:	50DF1C88DA0EB4BDCABD80BC9A2CB1D956B1762409C086F9A157B88F400E3037
SHA-512:	0634ABF5E436F56846ED20131CB8508E17ED0FBD4FAF1A267F90267BED03B4FA118E1AB303E978252F8CFD48A9BB65EB38EC8685638CCBA068BED8C67438ED89
Malicious:	false
Preview:	0\r..m......R...kP]g...._keyhttps://rna-resource.acrobat.com/static/js/plugins/app-center/js/selector.js ..D.\2$/....."#.DrP.P.5.Ak.Q.....-_..y.....O...>..1....A..Eo...................A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.615883494970555
Encrypted:	false
SSDEEP:	6:mvYOFLvEWdhwjQtofNLZIl6P41TK6tY6/l:0RhkffNLZC6
MD5:	B5A439F2344A8441480A284E3FBB56A4
SHA1:	2100359EDFA74593C48B4E90D5AC9FD16A9B8C87
SHA-256:	BB097C9FDD54E75DCAB9222FC0BFD302D208ADDDDDD7F9B92601C4B6192911E7
SHA-512:	A31F442F8E11A95108A85724DF3EE4B4EF6F8720933836665B73B48D9FB6F46B2DBCA44EF9A9E3A85B756CDDDD3735BCC303A6FE2510991C1CFF7A19603CF105
Malicious:	false
Preview:	0\r..m......X.....V....._keyhttps://rna-resource.acrobat.com/static/js/plugins/sign-services-auth/js/plugin.js .y..\2$/....."#.D...P.5.A.].>....uUf..N...k......c..l.A..Eo...................A..Eo......4...........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	5.552478452492033
Encrypted:	false
SSDEEP:	3:m+lZd8RzYOCGLvHkWBGKuKjXKX7KoQRA/KVdKLuVLC+ZQPcyxMtv9EWm1TK5kt6s:mJYOFLvEWdGQRQOdQpN6g1TK6tD
MD5:	6EDCB966B63EDBB0D4651118C01B49C3
SHA1:	9CE1ED71DA0E095CC5B20AA8941A6E96DF7D1D1D
SHA-256:	276C7ACF6B7DA66F0F2472BB601C39079C87738AEB402A5B46E8902C83E3377B
SHA-512:	8EF1667C5190AE89E66A7751F856C45918ADC142168947874366936537A4822640B0F50A44CA040355B6C576E9F84700F753D45EE05B84EC123D9710A23CB5DE
Malicious:	false
Preview:	0\r..m......Q..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-computer/js/plugin.js ....\2$/....."#.DW..P.5.A..c..y/L....\|y.n..C/I.....X7-ne.A..Eo...................A..Eo.......D.,........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	5.597858737178671
Encrypted:	false
SSDEEP:	12:Z5MLhw5MuR/EP5Mh5MuR/E75MNy6l5MuR/EM:ZSL++uR/EPSh+uR/E7SNy6l+uR/E
MD5:	13E447963E80DD6FE5477B1EB917B55D
SHA1:	DE923A7FDB725E18D137B1B4A0034C8A27171B35
SHA-256:	DB5AC83AF7468521361EA5DA21A8627ADC797B3897CE4AE328084708A13642C0
SHA-512:	6258D6A4B6DF1F4313D03A792F836AB9E9BCF14F028C48B23D6EB0698B69B9B599AE5128E64FF18A2078A9B637155F45D7D8932922471CB4321FA56435210A8E
Malicious:	false
Preview:	0\r..m......3....<lb...._keyhttps://rna-resource.acrobat.com/base_uris.js ._).[2$/....."#.DL..M.5.A.y...L<?W.Xi..A\Q3...J.}...d..~G.A..Eo...................A..Eo......s.+2........0\r..m......3....<lb...._keyhttps://rna-resource.acrobat.com/base_uris.js ..WY\2$/....."#.D..nO.5.A.y...L<?W.Xi..A\Q3...J.}...d..~G.A..Eo...................A..Eo.......u.>........0\r..m......3....<lb...._keyhttps://rna-resource.acrobat.com/base_uris.js ...\2$/....."#.DG.FP.5.A.y...L<?W.Xi..A\Q3...J.}...d..~G.A..Eo...................A..Eo.......2.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\3a4ae3940784292a_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	214
Entropy (8bit):	5.488577394664874
Encrypted:	false
SSDEEP:	6:m4fPYOFLvEWdtulMD49gMby0zBUKSAA1TK6t1:pRrRMben
MD5:	FBCAB11304281FFF1694EFC6C2DEF3CD
SHA1:	1C30DAA097F10F43444F7144DB7B3229F44130A8
SHA-256:	D2EE3F016B25B71A42AEA4002B0AA4EF1B6A9F349B52CD0EEA1130FA97D6A4FA
SHA-512:	472DBB61C4797547C592A4B82AE3A013DAB84993967321518D9D3E911C58729DB6B199E1EAEB231553F87E54810A03AAA9CC731FDD00EC244C1EDD2CDCC0C9DB
Malicious:	false
Preview:	0\r..m......V..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/search-summary/js/selector.js ..\.\2$/....."#.D..P.5.AQ..E.=....=h`t..t..3%A.F$..w..A..Eo...................A..Eo......E.o.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	531
Entropy (8bit):	5.589583753768338
Encrypted:	false
SSDEEP:	12:KkXxKMSCva9NitUlUokXxKMSCvgm3tUlTCkXxKMSCvDictUlf:KkXxiCi2WUokXxiCom3WOkXxiCLicW
MD5:	380A8CD620F8BA7C53073AAB4AC60A5B
SHA1:	D10DEA3A46293A73DD825D3E1BA8BE3100827CDC
SHA-256:	A9104E3406F17CB7F1FE8BDE61ABA1BBDA4FAAA553D4E5BAAA452F62783BF273
SHA-512:	8EB27F66D03C696E5D40782BB5826A9014EF7ACED5DE6304B859068BBCA541CB78780E61AE7438D0943336FA412DBE5997B777BEE3B722795E26EF1E1564BB18
Malicious:	false
Preview:	0\r..m......1......5...._keyhttps://rna-resource.acrobat.com/plugins.js .@%.[2$/....."#.D...M.5.A.PU ....t^.....a.k..u.7.M.BW6#}..A..Eo...................A..Eo......vo..........0\r..m......1......5...._keyhttps://rna-resource.acrobat.com/plugins.js ..VY\2$/....."#.D..nO.5.A.PU ....t^.....a.k..u.7.M.BW6#}..A..Eo...................A..Eo......;?..........0\r..m......1......5...._keyhttps://rna-resource.acrobat.com/plugins.js ...\2$/....."#.D..FP.5.A.PU ....t^.....a.k..u.7.M.BW6#}..A..Eo...................A..Eo......<x.c........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	561
Entropy (8bit):	5.600062990208964
Encrypted:	false
SSDEEP:	6:mkl9YOFLvEWsfOLDQaQryM+VY1TK6thRkl9YOFLvEWsfOL2/YryM+VY1TK6tkEk/:5h6OL0aQqkXKh6OLKYqkybh6OLck7
MD5:	391A85D48A49072319274241BCBAC4AA
SHA1:	12B1999F0560E18E7E325732D5B1C45011BCE039
SHA-256:	DEBA2CE1E8E66D50001BD4467D796741360AE803E7461C36337F386ABBFC8FDB
SHA-512:	BDDB081AD23EEA2525329CE6E3AA8F40D8AD02F096BB6923EC1A299AC0E1B2DEA4EE2090649F0144DE5C97EEA557E20CFE9876526D99E6B9C833BB5EE8EA8AF3
Malicious:	false
Preview:	0\r..m......;...I......._keyhttps://rna-resource.acrobat.com/static/js/desktop.js ....[2$/....."#.D.f.M.5.A..q.O...j....._y..L^z...?..@N..A..Eo...................A..Eo.......W@.........0\r..m......;...I......._keyhttps://rna-resource.acrobat.com/static/js/desktop.js ..]f\2$/....."#.D.N.O.5.A..q.O...j....._y..L^z...?..@N..A..Eo...................A..Eo......<...........0\r..m......;...I......._keyhttps://rna-resource.acrobat.com/static/js/desktop.js ....\2$/....."#.D..vP.5.A..q.O...j....._y..L^z...?..@N..A..Eo...................A..Eo......._E.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	732
Entropy (8bit):	5.61968137791673
Encrypted:	false
SSDEEP:	12:URVFAFjVFAFZwSeKaTLnQleRVFAFjVFAFkS0d+wSeKaTLnfRVFAFjVFAF+XwSeK2:UB4v4ZwzXLnweB4v4z0d+wzXLnfB4v4F
MD5:	25536EFBBB1A9E4500A14B4FC4B2E1AF
SHA1:	BCC0C6C8984A0B42FA9D1F916897AFDD63C2A85E
SHA-256:	5D32D78CFAD6667F7C94499A9B186DDEE38F27B61B95B61ED28FF6660934B198
SHA-512:	08D326520505AD6375D4165A96DA56D4CB32FA263F12453EA3CCDADA752E35887FF910D36A35B6C48951D5C72A7F1E4B5F0936698E53C99D01797947E50FA5F3
Malicious:	false
Preview:	0\r..m......t...R.1<...._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/plugin.js .l..\2$/....."#.D...M.5.A......H...{...2../.k`..r4.C. .A..Eo...................A..Eo......7...........0\r..m......t...R.1<...._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/plugin.js ..7m\2$/....."#.D{..O.5.A......H...{...2../.k`..r4.C. .A..Eo...................A..Eo......a.t.........0\r..m......t...R.1<...._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/plugin.js ....\2$/....."#.D.].P.5.A......H...{...2../.k`..r4.C. .A..Eo...................A..Eo.......\..........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.518423690292057
Encrypted:	false
SSDEEP:	6:ms2VYOFLvEWdvBIEGdeXuXr1fIY11TK6tpll/:BsR2EsegdJP
MD5:	9D7AB2D42F5D60FB133D8B488FFAFB70
SHA1:	F97DACAFC8626A3B5F2A49FD7A05C700575F88C1
SHA-256:	EE4302CF93C62F9CB13A6B463A1CB318F40B6086495EFBA0483DFF5147F52A2D
SHA-512:	C227A9C2C272109740DB495453A4C79E2456DA022E1428337C1452D58B319D00A672CFC817015B614095504D7AC04ABCC00C7AFC445A0BFB2A174B0C3EF56D6D
Malicious:	false
Preview:	0\r..m......S...]......._keyhttps://rna-resource.acrobat.com/static/js/plugins/add-account/js/selector.js .3.\2$/....."#.D.P.5.A.A.o]@r..Q.....<w.....].n\....A..Eo...................A..Eo......%J..........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	202
Entropy (8bit):	5.651598293456174
Encrypted:	false
SSDEEP:	6:maVYOFLvEWdwAPCQgQX4B7OhKlvA1TK6t:RbR16hVBJk
MD5:	4CB34BD977DFFC76AD7BB768B14454E1
SHA1:	DA831568C43F4B86B7EB2298553CD268BEF307AC
SHA-256:	51F779A41432538DBCCEC4D597937316F25F0606E22BA85DAA052462FBBDAC60
SHA-512:	16950A79F49CE8FB16CB04528F0CB50C6F7F60859B2E460D189C94F4F31ABE7B75E0D2E2F88E1565E9E7ECD255F7BA047B269337EE5B04471942613079A36DC7
Malicious:	false
Preview:	0\r..m......J......{...._keyhttps://rna-resource.acrobat.com/static/js/plugins/home/js/plugin.js ....\2$/....."#.DS<.P.5.A..4T].....Tw.....(..b...EO....9.A..Eo...................A..Eo.................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.549183050461125
Encrypted:	false
SSDEEP:	6:ms2gEYOFLvEWdGQRQVuh5Y1QdFt1TK6t:B2geRHRQZ10
MD5:	04D30348D61912103C2935710B12E4FD
SHA1:	2B1805E2A7506C5AB3926429F6F0D1CC382EDC37
SHA-256:	7CACFC179853F3CBDDB29CFE5DBC0A0E678B71BF998F66960860A599DD111DA3
SHA-512:	47332DE10EFF74BCEFBF494A181611C4C47CDA425EFC4B1ADC73FE95D6A0BC66A4CBBB5EFC5AB29A4323DD9CB597A7E35EAB71963746DD50A8CD6C820CC5D6B6
Malicious:	false
Preview:	0\r..m......S...W.%z...._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-computer/js/selector.js ...\2$/....."#.Dp..P.5.A@..{o]...9o\|..qY....T....{..u.b..A..Eo...................A..Eo.......c.m........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	618
Entropy (8bit):	5.646358126916159
Encrypted:	false
SSDEEP:	12:WyeRlFRt1wrEyeRlbdt1wzvyyeRlpt1w:WJrfwrEJBfwz6Jhfw
MD5:	712F68DBB2C65EB2A8A4D50D41008844
SHA1:	0F745472EE4B927F916A43C208AC67F7CACF5C6C
SHA-256:	9447B224B499F6076AB38BF6B59F0128887CBA05BB56BEB33534A296F00499F5
SHA-512:	CF97DE284568134C49587C43E70569EC8A0206B7A521E8BDA7C7F55E92810CA91B4A969F4A93C944F96A1596DF0818202E9856108A3A46E47008548EF8418CBA
Malicious:	false
Preview:	0\r..m......N..../......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/plugin.js ....[2$/....."#.D(..M.5.A.t\a......x5.'OuE.C..@......x..A..Eo...................A..Eo........)W........0\r..m......N..../......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/plugin.js .!.j\2$/....."#.Dw0.O.5.A.t\a......x5.'OuE.C..@......x..A..Eo...................A..Eo.................0\r..m......N..../......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/plugin.js ....\2$/....."#.D..\|P.5.A.t\a......x5.'OuE.C..@......x..A..Eo...................A..Eo......^w.9........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.541500527275848
Encrypted:	false
SSDEEP:	3:m+lKcv8RzYOCGLvHkWBGKuKjXKoyNH/KPWFv9PJ8lYuGqJNqww6U+5m1TK5kt47:mnYOFLvEWdhwyuXPJHcrqwK+41TK6ts
MD5:	FDC4AD8C3AF97E8D2EEACD79B1554980
SHA1:	C49B144F1F53F43FB1DC09DD80C8B4CAF2ABCC39
SHA-256:	89A5F090A94E3DC56F1206327DE10211305DF104C7418A9972797DFCD3B6449C
SHA-512:	786F482C98C2FB4504077FD69350B9FC24F1D888A3D187CB407777ED86E0482A9904E69BCBDD91E5D4CCFFF671D6A55C526007FAD87BDCB524AD47C251EFF414
Malicious:	false
Preview:	0\r..m......Z.........._keyhttps://rna-resource.acrobat.com/static/js/plugins/sign-services-auth/js/selector.js ..9.\2$/....."#.D...P.5.A.......7...o..a=.98I......(3.$G.A..Eo...................A..Eo.......].K........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	690
Entropy (8bit):	5.654120501755197
Encrypted:	false
SSDEEP:	12:/RrROk/QB/YfLEtRrROk/dWpfLE9RrROk/wwIfLEP/:/PJ/U/Y4tPJ/u49PJ/wp4
MD5:	18FF31D9625C204A65730AA5B4886187
SHA1:	D4A6FC0CBC4363376788C828FF2632F39A50182A
SHA-256:	D140BEEF2E9C79ACCD8F6C9E48C7E460A408960A168DD4D8E574B6D789D28ED7
SHA-512:	6A7C0CEFB73BFC56C1D380A28C4D29890A6917CF85A50ABAB502DFB418337537995CFD9B4D6671E03D486C744F3DBEBE033239C887D8DB3FC3A93F3D592652CE
Malicious:	false
Preview:	0\r..m......f...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/selector.js ....[2$/....."#.D..M.5.A..~..rw.+[....!.)?..f.U..(=.=.A..Eo...................A..Eo......l..........0\r..m......f...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/selector.js ...j\2$/....."#.D...O.5.A..~..rw.+[....!.)?..f.U..(=.=.A..Eo...................A..Eo.......8..........0\r..m......f...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/selector.js ...\2$/....."#.D.p\|P.5.A..~..rw.+[....!.)?..f.U..(=.=.A..Eo...................A..Eo.................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	558
Entropy (8bit):	5.634097048564398
Encrypted:	false
SSDEEP:	6:mmDEYOFLvEWXI2r51QPLr1TK6tWmDEYOFLvEWXID7H1QPLr1TK6tolMmDEYOFLvr:xqTTCPLnDqT4DCPLn2BqTbZKCPLnCk
MD5:	629200F66D2BDAB873B32B5E434985BB
SHA1:	B0E7A688AA8C7B3DBBA65C69875A4D4ADFF5BD54
SHA-256:	21360327F0E70994D4FD24A417D3790CA67277A00892514780F98877A71C3B69
SHA-512:	C790D2046186CB48523F1B3C15F4C756F5CB99AB7CFBB2BC71B081A8215B6842E0EBA39F82711C17F012DC237C36DE361DCE53D04A3829C276EBCF00A51296A2
Malicious:	false
Preview:	0\r..m......:....f......_keyhttps://rna-resource.acrobat.com/static/js/config.js ....[2$/....."#.D.X.M.5.A..~]...%s..<...n.f..<.....1#..U..A..Eo...................A..Eo......`..<........0\r..m......:....f......_keyhttps://rna-resource.acrobat.com/static/js/config.js .8If\2$/....."#.DhY.O.5.A..~]...%s..<...n.f..<.....1#..U..A..Eo...................A..Eo..................0\r..m......:....f......_keyhttps://rna-resource.acrobat.com/static/js/config.js ..\2$/....."#.D..vP.5.A..~]...%s..<...n.f..<.....1#..U..A..Eo...................A..Eo.........Q........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	621
Entropy (8bit):	5.642792003155633
Encrypted:	false
SSDEEP:	6:m52YOFLvEWdMAuPsEJ41TK6tb2+52YOFLvEWdMAutsEJ41TK6tv52YOFLvEWdMAa:zRMtsDgbRMDsDgRMrhWsDA
MD5:	CA7FF1FED9B5675F81DED2F4DB641A34
SHA1:	04AB44C577FACB985A5AD6B8B622433B4581B54C
SHA-256:	C4B87DD084D11FAE2AE213FDEE43C5BFE88FA3BD175F20F4D9BD0AEA9A513C57
SHA-512:	D8AB0BAC318AD12519B5D6236A50897CFC30428B80E6A8B4667CB29A8336401E8CE8BCF94C9D2C5F7A955923C4FEC19E385ADFF9A8F6711DAD6819FE5CC35B37
Malicious:	false
Preview:	0\r..m......O...a.Y....._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/selector.js ....[2$/....."#.D.F.M.5.A..z._a...'.v.......4p3..1.']...A..Eo...................A..Eo......."..........0\r..m......O...a.Y....._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/selector.js .7_l\2$/....."#.D\..O.5.A..z._a...'.v.......4p3..1.']...A..Eo...................A..Eo......m.p.........0\r..m......O...a.Y....._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/selector.js .Y..\2$/....."#.Dr..P.5.A..z._a...'.v.......4p3..1.']...A..Eo...................A..Eo.................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	630
Entropy (8bit):	5.630570786311959
Encrypted:	false
SSDEEP:	12:6lJRrdgFoM4FUlJRIvyogFoMLlJRJtgFoM:YYFoMwyKvynFoMPj6FoM
MD5:	1A24E1AD5093E85B2F757FF496B799AF
SHA1:	4F653424FDF7BE24BEBDFB4B468AEB2D1854F944
SHA-256:	9E1A58650BF1263BAF7EB1748D1306D11BA57E610B428214B5B25657E03E9E8B
SHA-512:	9AE70144494D7AD3B4D716C223B54BAB9871E57621EB3A6CE259EBD44073F9BEB9B33D7CD79057F0B559EE04ED411373D51328123AC5968767BCF30B7853D217
Malicious:	false
Preview:	0\r..m......R....\|....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/selector.js .\..[2$/....."#.D9~.M.5.Ac}.H7M=M..-.....Ix..R.l...}Rl.$q.A..Eo...................A..Eo.................0\r..m......R....\|....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/selector.js ...l\2$/....."#.D[..O.5.Ac}.H7M=M..-.....Ix..R.l...}Rl.$q.A..Eo...................A..Eo.......\|.1........0\r..m......R....\|....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/selector.js ....\2$/....."#.DJ'.P.5.Ac}.H7M=M..-.....Ix..R.l...}Rl.$q.A..Eo...................A..Eo.................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	669
Entropy (8bit):	5.625242106610291
Encrypted:	false
SSDEEP:	12:F8hRrROk/aqOe2X8hRrROk/B4vOe2d8hRrROk/aoKOe2:UPJ/aw2CPJ/Bg2MPJ/aoQ2
MD5:	9557E68E5D86B1031B40A3A39B26423F
SHA1:	7E03F6A2B1F96C4D3E86AF745B52DBC278DD076C
SHA-256:	31A642A5F8404E703ADB9BE703E094AC7AA0C21ED5FAF158AB61C38C7745F3EB
SHA-512:	8354B6C6DAC14389848D750E795E2A0B925A6400EF42D2C07A6BB514E4C07B3A7C8EFDC8F0539EB1243707120D835224EC310C9946D281BD08235C987553BCA6
Malicious:	false
Preview:	0\r..m......_...h......_keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/selector.js ..z.[2$/....."#.D.\|.M.5.A..%.k.SZ..~W.....:)'B..ad......A..Eo...................A..Eo.......!.F........0\r..m......_...h......_keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/selector.js .$Hj\2$/....."#.DV..O.5.A..%.k.SZ..~W.....:)'B..ad......A..Eo...................A..Eo......Z...........0\r..m......_...h......_keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/selector.js ..).\2$/....."#.Dwd\|P.5.A..%.k.SZ..~W.....:)'B..ad......A..Eo...................A..Eo.......U]k........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	639
Entropy (8bit):	5.7074091908187095
Encrypted:	false
SSDEEP:	12:ehRcWGoirNJICP/llIhRcurNJICHghRc0hZrNJIC:ehNGfJICP//Ih5JICAhThzJIC
MD5:	4556A3DFD86EAA9A6FF3B5D6CD7D499F
SHA1:	075F4074AB776F702D7EDD0039416C43E4CC41A8
SHA-256:	A874C5B87C9ED6A379295521E64D460EBBB7C093E3DC42DA5CD89F22FAAF4FD0
SHA-512:	C94916182770B1E5B858A8BA7C036DB2E4A6EEF27546071286C8AD4439C7F04BFEB104CDEE63F02D150341DA5FA1B4C9FFD6914CEBA51348EE67260AD99B1D46
Malicious:	false
Preview:	0\r..m......U..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files-select/js/plugin.js .m..[2$/....."#.DP..M.5.A.;"./N_.,.:C..2....9L.H...3:...A..Eo...................A..Eo.......X..........0\r..m......U..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files-select/js/plugin.js .7.j\2$/....."#.D.[.O.5.A.;"./N_.,.:C..2....9L.H...3:...A..Eo...................A..Eo......;.%=........0\r..m......U..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files-select/js/plugin.js ....\2$/....."#.D..\|P.5.A.;"./N_.,.:C..2....9L.H...3:...A..Eo...................A..Eo......;.z.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	624
Entropy (8bit):	5.5802783784122205
Encrypted:	false
SSDEEP:	6:mOEYOFLvEWdrIhuuT/hZLzgm2d/1TK6tHh+OEYOFLvEWdrIhuuMPcwZLzgm2d/1l:0R+hRReoRtHRReVRJwRRe
MD5:	EBEF8E2B5339A1ACE4277D68514098B5
SHA1:	5EEB90F5BC976B380317763C1EE5FC99ACEE76FD
SHA-256:	0729E1CD8EE2D8EC389175D899618439E614C1D0D1EEAABEC1C5F3F6F70B3459
SHA-512:	869070ECD1F65F7E0FCB4882D863AD0F720B8744754A09C008EAD367777D0046849577800E5626E963DAC2F6B006471C7DD0A2032E99466BD3D97344225EA882
Malicious:	false
Preview:	0\r..m......P....r......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/selector.js ..g.[2$/....."#.DND.M.5.AZ.Z}Q..4.o....0+..[\|..n:..U.W.A..Eo...................A..Eo.......Q;.........0\r..m......P....r......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/selector.js .V.i\2$/....."#.DN'.O.5.AZ.Z}Q..4.o....0+..[\|..n:..U.W.A..Eo...................A..Eo......L...........0\r..m......P....r......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/selector.js ..&.\2$/....."#.D.2\|P.5.AZ.Z}Q..4.o....0+..[\|..n:*..U.W.A..Eo...................A..Eo........Y.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	564
Entropy (8bit):	5.646033812332476
Encrypted:	false
SSDEEP:	6:mAElVYOFLvEW1KBw2kx56uvp1TK6t0AElVYOFLvEW1KD5RKOCxkx56uvp1TK6tuc:6JJKByCJJKTW6/JJKc
MD5:	6161E123E5FCCC971AE78E3C786E603C
SHA1:	525EFA8EE9661CB4F8A968AD09CFE4144C4370EB
SHA-256:	6AD050F66EDE3A112DDFB80E32B08C326DE95A53A5E788076E47A5F2AB1C2400
SHA-512:	452C218A66D382A2C8684C00E05E73A80D1EAB6936C57468EE03FB8A917A51A93C9ECD7F002CA34DD5E551E7FD61E02F6CF20AC5B069FE4EAFEFAD2804300A4B
Malicious:	false
Preview:	0\r..m......<...)6......_keyhttps://rna-resource.acrobat.com/static/js/rna-main.js .W\.[2$/....."#.DV..M.5.Az?...SwC...^..y.....V..7R-O.....A..Eo...................A..Eo..................0\r..m......<...)6......_keyhttps://rna-resource.acrobat.com/static/js/rna-main.js ...\\2$/....."#.D.'.O.5.Az?...SwC...^..y.....V..7R-O.....A..Eo...................A..Eo......./..........0\r..m......<...)6......_keyhttps://rna-resource.acrobat.com/static/js/rna-main.js .Am.\2$/....."#.DPV]P.5.Az?...SwC...^..y.....V..7R-O.....A..Eo...................A..Eo......w. .........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	214
Entropy (8bit):	5.6479437440830464
Encrypted:	false
SSDEEP:	6:mWYOFLvEWdBJvvuQAqxhUDLYtmOZn1TK6t:xRBJZAHDcFZL
MD5:	83534C31B76B62DBDBE31055E4C5CF4E
SHA1:	2ED4E408CAF501611D64373670652090EF30B631
SHA-256:	1191F7E582A8F57F09FF945F8A5BDB323A630A2CC7D51FF3DA5D07A8ACC42479
SHA-512:	DB593A78006385AF461EF5B808878E87D991CFBAC6AD548A48296C112574174BED93DDD3FB8F989FEF2741EE609A4D7575375608684EE417DA268530F64C98D1
Malicious:	false
Preview:	0\r..m......V.....h....._keyhttps://rna-resource.acrobat.com/static/js/plugins/activity-badge/js/selector.js ....\2$/....."#.D..P.5.A....t.q..W.EZ....1...[.zC.7mD..A..Eo...................A..Eo.......@.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	633
Entropy (8bit):	5.605958997837306
Encrypted:	false
SSDEEP:	6:msRPYOFLvEWIa7zp7+CQHVPu1TK6t9sRPYOFLvEWIa7zp7BKB98VPu1TK6tNQ9eu:BPHBQHcAPH7KB98cA9ZPHTxkc
MD5:	4A72E911DDCDFA9AEE46DC9757934228
SHA1:	80CB1A1CA4209AEC9C0169950FDEE94266EA96A3
SHA-256:	7CC0FC363764B42BF8975CFEECA5DC5D70068C4408943A30326975A8A618BFBE
SHA-512:	62D2272E7CAA74E25BF2C2392EDBB6F36955FC7FE47D38255FDA0083967E58564AB373C74A5BB8BB72A746B340D72379576805D343F814BFDDE69BEED304D656
Malicious:	false
Preview:	0\r..m......S...{.j....._keyhttps://rna-resource.acrobat.com/static/js/libs/require/2.1.15/require.min.js ..W.[2$/....."#.DM1.M.5.A...L...Im.@.........E.nW...IP..A..Eo...................A..Eo......@..3........0\r..m......S...{.j....._keyhttps://rna-resource.acrobat.com/static/js/libs/require/2.1.15/require.min.js .HeY\2$/....."#.D..nO.5.A...L...Im.@.........E.nW...IP..A..Eo...................A..Eo.......p5.........0\r..m......S...{.j....._keyhttps://rna-resource.acrobat.com/static/js/libs/require/2.1.15/require.min.js ...\2$/....."#.DtzGP.5.A...L...Im.@.........E.nW...IP..A..Eo...................A..Eo......]pW.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf0ac66ae1eb4a7f_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.590450154760217
Encrypted:	false
SSDEEP:	6:mKPYOFLvEWdENU9QPyOJswiM3Y1TK6tN/:bJRT98iwr0
MD5:	0371E979A6E651AE4C464E710D654E6C
SHA1:	CD444BA3513B7BC38D165A83C39586EF1F67E57B
SHA-256:	E58392A828B1226B725B75D9747B3826D55009847DC90CAA41B7D32D51D80FB2
SHA-512:	6EDF15E39E598824491D7EA661A73BB115606F1E22D8DAE97520D2CB3E8A349463064A28740C77378B37F81640AAD21FDDC11CAFA90E02E476FEC53B4C515AD1
Malicious:	false
Preview:	0\r..m......P...Yft....._keyhttps://rna-resource.acrobat.com/static/js/plugins/uss-search/js/plugin.js ....\2$/....."#.D..P.5.A...M....m+lS..e.....<7.U.P8*.0K.A..Eo...................A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	modified
Size (bytes):	208
Entropy (8bit):	5.6197764310588205
Encrypted:	false
SSDEEP:	6:mQt6EYOFLvEWdccAHQvx7IRjBRCh/41TK6t:XRc9CxkDi/E
MD5:	7E222782DE8AEA8E952C452CB1FA6AC8
SHA1:	8FCFA3150836C052EA9C9BF703748B15E3627FAD
SHA-256:	0739F810FEAD50904F6A2BFDCCECB3E6EF8E712D39567B5CCF9F1B13AB7C8ABD
SHA-512:	E02B9F1BC7F87AAD19D7E34FF917B2C9FD35148CD54661A918E5CCB45B2D26669EE62CF8C2441A3BFCA18CB54F04A723BDFE0638E5EA7B7DDC26E26A20D6CEA1
Malicious:	false
Preview:	0\r..m......P...W3......_keyhttps://rna-resource.acrobat.com/static/js/plugins/scan-files/js/plugin.js ....\2$/....."#.D.V.P.5.APJm...0x.x..RD...BB!@5..<..]....A..Eo...................A..Eo......(..]........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d449e58cb15daaf1_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	462
Entropy (8bit):	5.625665227552093
Encrypted:	false
SSDEEP:	6:mqs6XYOFLvEWdFCi5mhu+bDTGn49VULlF4r1TK6tZ//Mqs6XYOFLvEWdFCi5mhut:bs6xRkiODEZLlF4n3xs6xRkiNLlF4n
MD5:	A91A4077B8CA66255E322DD1EB33D8F8
SHA1:	E0FB05B58CAA8B6968FC9A742E8D65FEB117294F
SHA-256:	377382EF4F1E448798E881FFBC313C3B4807707AF80CDDF3D185BD5C9F07734C
SHA-512:	7EF1C66C7D3D04152743CCE1C118269B978CACA3F80EA38A711BC0F8DCFAB8615F1F9EA02F5217B86726171315D6C0D2F6A571A84F14C090BEA3DBE6519DBA41
Malicious:	false
Preview:	0\r..m......g...~.I?...._keyhttps://rna-resource.acrobat.com/static/js/plugins/aicuc/js/plugins/rhp/exportpdf-rna-selector.js ..x.[2$/....."#.D...M.5.A.P...#4..l....5...5..).w.. .h.~..A..Eo...................A..Eo.......V..........0\r..m......g...~.I?...._keyhttps://rna-resource.acrobat.com/static/js/plugins/aicuc/js/plugins/rhp/exportpdf-rna-selector.js ...j\2$/....."#.DV,.O.5.A.P...#4..l....5...5..).w.. .h.~..A..Eo...................A..Eo........F*........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d88192ac53852604_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.473912772556887
Encrypted:	false
SSDEEP:	3:m+lPHYs8RzYOCGLvHkWBGKuKjXKXqjuSKPWFvDS/hWkQGC/Ccu1isLK5m1TK5ktI:mhYOFLvEWd/aFuUQV/N941TK6t6
MD5:	0F9036BEAFFED502A584A5F6431434C0
SHA1:	EF540C5D82D35B525DEEDEBC5A099838EC881113
SHA-256:	4E31B0B7B7A660C4BB0D9475D03F7C62C1C427FB39E0164525C7377372A6B503
SHA-512:	F088C45B6B0D0CAAE756E4F81B40AFCBE15345A9E966D14608EAF237093DB1C13E360299247AA1A3730194F150C2A3C94E18D7D18A1B2B2A3C1E836BB571B103
Malicious:	false
Preview:	0\r..m......W....w.m...._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-recent-files/js/selector.js ..t.\2$/....."#.D.c.P.5.A...a.f.m.i.o.p..3U5.....^...I.A..Eo...................A..Eo......tW..........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\de789e80edd740d6_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.519659352338565
Encrypted:	false
SSDEEP:	6:mR9YOFLvEWd7VIGXOdQe0CtBoBMqVd3G4K41TK6tBR:2DRuRgCsB9Vd2kh
MD5:	D408F60FAE2B670847F646F89B064854
SHA1:	9DF529591C14A16B236C019809C0B3F3577A67E9
SHA-256:	3369C158523B31BCF071F58C85F847C4F16109316CCF982D83569328D5AE1A16
SHA-512:	4A7435DA829B15123E25A5F850FFB73F3562C285AAC689405E22479D22C952B6B4DD47FC73EE4C529B69388F612D72C66E886AA9B557E266DCA3D7DC8DD2D931
Malicious:	false
Preview:	0\r..m......P...y.p....._keyhttps://rna-resource.acrobat.com/static/js/plugins/app-center/js/plugin.js ..E.\2$/....."#.D..P.5.A..y.$..$.v5j...T...z.]..._S....A..Eo...................A..Eo......=..4........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	624
Entropy (8bit):	5.570886393943717
Encrypted:	false
SSDEEP:	6:mkqYOFLvEWd8CAd9Q/l5s+tuuA424r1TK6t/MkqYOFLvEWd8CAd9QpuA424r1TK7:+RQQFrnV8RQtrnL2RQNjqZrn99l
MD5:	15FC9C60B663E6AE47E224A1C9CAF8F3
SHA1:	6DF79C53FAE171F595980123C1E0CC8B076DAAA5
SHA-256:	51B28EB63DD6F888F1191FB3DE7EC51D72B52EEFE0F6119F87D98186BC12C4F2
SHA-512:	347E9BC06DC8A77481BB29E93A2023D2F3FE02A4C7D4C5DC40E857DA932AA93E30171064593103C1F1320C918810E94D997569C27C9BACFD8C9633C012B3E286
Malicious:	false
Preview:	0\r..m......P...gT....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/plugin.js ..D.\2$/....."#.Dj..N.5.A#..@..k(v.8g..5.~_....]Pj...6.A..Eo...................A..Eo.........'........0\r..m......P...gT....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/plugin.js .95m\2$/....."#.D.2.O.5.A#..@..k(v.8g..5.~_....]Pj...6.A..Eo...................A..Eo.......!~p........0\r..m......P...gT....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/plugin.js ../.\2$/....."#.D..P.5.A#..@..k(v.8g..5.~_....]Pj.*..6.A..Eo...................A..Eo......f=..........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f4a0d4ca2f3b95da_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.547692351328707
Encrypted:	false
SSDEEP:	6:moXXYOFLvEWdENUAuIJzfGsyC8n1TK6t:xhRTmf97Q
MD5:	D57FFE5BFCC0EB669B716A385EE569DA
SHA1:	F5536455F4C85DFD1EAEBC96BEFFE016844E8FA3
SHA-256:	A850FB4717758C05766F2452AE4C666C6D3559DA35520C974BB5935C444643B7
SHA-512:	2341037F55670ACACBB6080732485DDDA789E0E2C4EA349B93AB5290B73993F193FFC2252E1B88BABD95BE6E02FA4B7AE4EC4BB06929D3F933CC377D5FA50A6B
Malicious:	false
Preview:	0\r..m......R..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/uss-search/js/selector.js ..7.\2$/....."#.D...P.5.A8.../...;.\\o....1..........+..A..Eo...................A..Eo......\f..........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	663
Entropy (8bit):	5.660418814472619
Encrypted:	false
SSDEEP:	12:nRrROk/V8Eom6RrROk/VcmYRrROk/VUrm:nPJ/Rd6PJ/rYPJ/aK
MD5:	A319203A0F4DEBD7E12D32AC360F726C
SHA1:	98908716180C8DA4DCA3B99DD52B6E17D5AF9845
SHA-256:	CF7DB08956CEE6242F8EAD49EE026002B51684A29A182E1E7A7942BF1935FC34
SHA-512:	C4F5B6968076F9D547255EA75ED72DB5B5126469E21AC3E9CE9F516B23E73093D0DD2E244E02711CD17B0E0DDA19F5A18A938B2943C571796BD18300147DDD08
Malicious:	false
Preview:	0\r..m......]......,...._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/plugin.js ....[2$/....."#.D.G.M.5.A ./.ev......N~..6.b.....$.j;:C...A..Eo...................A..Eo......e.[.........0\r..m......]......,...._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/plugin.js .0.j\2$/....."#.D.~.O.5.A ./.ev......N~..6.b.....$.j;:C...A..Eo...................A..Eo........y.........0\r..m......]......,...._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/plugin.js ...\2$/....."#.Dv.\|P.5.A ./.ev......N~..6.b.....$.j;:C...A..Eo...................A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.5525071618527635
Encrypted:	false
SSDEEP:	6:mZ/lXYOFLvEWdccAWuN3PoLAdm9741TK6t:qxRcHoLAdu7E
MD5:	CEC618D9939A880E9FC9F77F234FCDF3
SHA1:	10426AB0D8A50BF7AAA6C31BC49714980FA7C157
SHA-256:	25B87EE591B3CAAE0B932D1CC90C768F9BAD1D74CE3E4BEB9BCDB29E1042FBCA
SHA-512:	3F9D39BECA46A13D3CDE2D36420ACFE899FBE3035ADEFC63C4ED58DF284C34F3514AF55966E6B755CCC67CADB6AF818BBA3CD5BEC0A5B91883A08B622635A585
Malicious:	false
Preview:	0\r..m......R...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/scan-files/js/selector.js ...\2$/....."#.Dc).P.5.A...U...I.>P...X...x..0U.~;m.x.k.A..Eo...................A..Eo......J5.A........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.578131230365596
Encrypted:	false
SSDEEP:	3:m+lUg18RzYOCGLvHkWBGKuKjXKrAUWiKPWFvUQguoZPp6shoq+Nem1TK5kt8a/:mMOYOFLvEWdwAPVuToxcJn1TK6tx/
MD5:	FD401EF6075502EAD0A9661A1F81220A
SHA1:	7996123A5EEA1337F9BB650A786CAB4D6C33C53C
SHA-256:	EB5DA64720F938BE3B5501A33306BBD6950D50F6A512951D4AAF9E5B662A57BB
SHA-512:	837C06A7A9D831E2B890240436DA39F0F20AFB408DE67399EB94EBBD3C17F7859FFDE280B8993E29F14D638820A34FEEF57CF244AF3CA996115D81BCEEBAB9F6
Malicious:	false
Preview:	0\r..m......L....Ey....._keyhttps://rna-resource.acrobat.com/static/js/plugins/home/js/selector.js ..5.\2$/....."#.D7..P.5.A.....k....F..D..O.n;[.1m.....=..A..Eo...................A..Eo.......i}.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fdd733564de6fbcb_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	212
Entropy (8bit):	5.6168724588287
Encrypted:	false
SSDEEP:	3:m+lUDflllla8RzYOCGLvHkWBGKuKjXKBRSJvBCvlKLuVc4/uQ9JZN/hcfsBXI+8f:m3PXYOFLvEWdBJvYQyzhcsBXIh1TK6t
MD5:	38C2E137A535D1B74F1A32FCA3703F91
SHA1:	60AC09D74977D572870A8E4016D2E3830BCBDC60
SHA-256:	5BF6D3B6633B962330109D83A4D270BCEB144899655A4364DF39A97A904F5BAD
SHA-512:	D9D9DDD73267017AC23EBA550A55CFFD2596DCAF5B4679E0B7FFAE070EA5612393869A2E9CD0F4DDA89AF661D64C54A7BE9FAEFD8614A70586D9A66911CA4A6C
Malicious:	false
Preview:	0\r..m......T......z...._keyhttps://rna-resource.acrobat.com/static/js/plugins/activity-badge/js/plugin.js ...\2$/....."#.D...P.5.A...k..`..N3.... ..d..$[.....{.A..Eo...................A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	684
Entropy (8bit):	5.639693349442807
Encrypted:	false
SSDEEP:	12:3RrROk/s7elcIRrROk/s1lckRrROk/sjc:3PJ/DOIPJ/nkPJ/H
MD5:	4419DA49BFC2C314ABC54DC4766E2EE4
SHA1:	DB9EFAE3C50DE6A8F6072754C6B511376585382C
SHA-256:	9883DF708B3923DE5B7624F7FB4FFAD8603D2148E845D92016EA43A4B04ECEDF
SHA-512:	BF0E13774B46D000D5FEEA87A05D76A08716EFFB30F9287EE6BA72C3D39647B9A4B485D421CE02426740637EAC9AF29D3E857266A4CDE4D184C3D1636EEAE094
Malicious:	false
Preview:	0\r..m......d...<.s....._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/plugin.js ..!.[2$/....."#.D...M.5.A.....9Q].8O.z....=..:.N.{....N{.A..Eo...................A..Eo.........t........0\r..m......d...<.s....._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/plugin.js ...j\2$/....."#.DQ.O.5.A.....9Q].8O.z....=..:.N.{....N{.A..Eo...................A..Eo.......[R.........0\r..m......d...<.s....._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/plugin.js ...\2$/....."#.DY.}P.5.A.....9Q].8O.z....=..:.N.{....N{.A..Eo...................A..Eo.........E........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\temp-index Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	2016
Entropy (8bit):	5.310498040955297
Encrypted:	false
SSDEEP:	24:0I2bYdB8J6MbkeljKqRomCARFO7sOMM/785bvVH:t2kdhMkCqmCARFO59/Mbl
MD5:	FA0B56758E136FEAA7E33CD999D46B63
SHA1:	F684C6BD59AA7EFEC2221C6FD8294E1817F65C79
SHA-256:	F3AF47AE5D82DA57622A2C92C794D3B306865CBC647857721307B4D253F705C0
SHA-512:	CB057A54AD5692B54E7B604A502F988F8F144D948D5E078D08C854F2FA94558618DC5062D427C733132B8492BAE366946E986535AD052DCB70EAF9CC8B2EFC2C
Malicious:	false
Preview:	......goy retne....'........'............;.y~A.@..................@...................oB...................#...(@..................k7A.@..................D.4.@...............[.i..%.@..............<...W..J................,+..._.#@...............J..j...@................6<\|...................A?.2:..@...............+.{..'@..............)....J:@................2q....@................P....V@..............+.U.!..V@.................P[. q@..............!...0.o@...............u\]..q@.....................@....................@...............o..k..@..............^.~..z.@..................o.@..............Gy.'.h.@..............F..=z;.@................3...@...............v...q..@...............C..M..@................a.....................~.,.4>.@...............&.S....@...............@..x.@..............=....m..@...............;/...@...................q.@.................MV3..@..............:..N.A..@..............Z............X.oy retne

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.203508426527555
Encrypted:	false
SSDEEP:	6:mTlfMq2P92nKuAl9OmbnIFUtpcl7FZZmwPcl7FzkwO92nKuAl9OmbjLJ:sxMv4HAahFUtpcZ/Pcz5LHAaSJ
MD5:	6B448B0F6AB1BDBAA11E2049E05DE5BC
SHA1:	2F53744EB185CD88843E08C36EC036D39CB169E5
SHA-256:	C0E06D5C8EF4724143D510B8912AA26EE5B577B727F03EE2D7C671C7810AAC63
SHA-512:	E21D8270B9F84853796A63101386951EA99A516394E81889BDA68A1A85F63B045350AC40402E85F81C1B938E64F1D354BF4C291FB3F5C7E0C5D1450C631E8543
Malicious:	false
Preview:	2021/06/25-12:23:35.773 1ac4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2021/06/25-12:23:35.775 1ac4 Recovering log #3.2021/06/25-12:23:35.775 1ac4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.0084423731585201
Encrypted:	false
SSDEEP:	24:T13rz13r+fUrjUVJjUVJjUVJjUVJjUVJjUVJjUVJ:T13/13KUvUvUvUvUvUvUvU
MD5:	20C2D53F3F6BF479288D699773FA372A
SHA1:	D18859D4EF1A2B4F96A6ACD1F09AB61AAAEB323A
SHA-256:	D6C5C9640C916DF6010AF982C733684606233C1632676FE69EA946B53C438E0F
SHA-512:	4A2A80FEAFDD414C93E701D268262C8F065DDFEC45211DA8A0A30762731DB0E7A21A44E9CEE09375C731C512652D5CFE20EE7821769E35AB95DF2563AB4493A5
Malicious:	false
Preview:	VLnk.....?.......+.}.^1.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-210625205103Z-191.bmp Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PC bitmap, Windows 3.x format, 117 x -152 x 32
Category:	dropped
Size (bytes):	71190
Entropy (8bit):	0.4163242950456716
Encrypted:	false
SSDEEP:	96:sPdsQPUJs0q+kBJ/PYQSOSll/zIaLK+EIX:IsQ0sB+kBBrSll/0ux
MD5:	84DB926B0625A31F7220A0F5F6B7F523
SHA1:	D3BC38716EF9475F1CC22DDE4FD4E7E6A17F6746
SHA-256:	63A29821929354B86A6B3A3F63126FDBB501F1CAABC0686678E1C43FFC1CE3AF
SHA-512:	3C94D21FE8C9C622AB8ED5F24866B1675A23E0F1055EA62B835226A2F98270C15FD7D9B5C7467CC136BC5A172F5DB5FC5CB7B5FF4C5C60DEE5B5E25F2AF292D8
Malicious:	false
Preview:	BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3024000
Category:	modified
Size (bytes):	32768
Entropy (8bit):	3.386650937878586
Encrypted:	false
SSDEEP:	96:iR49IVXEBodRBkQqOhFVCsL49IVXEBodRBkR+qOhAVCs749IVXEBodRBkl+qOh28:iGedRBeedRBjedRBHedRBI
MD5:	A75FE9AE9AC75F49248E5394B33EE33F
SHA1:	5E9722406535449EF8089F16A3AB0EC7258E939B
SHA-256:	855F5EE0D627B6DFCE06A0706CEE17A520DE8015E994AA4638BB2E0F0F92C34B
SHA-512:	D0ECA1E084CB2918EC7EFB2564784F48C3E786327978099854A124087BE6E80B4776C2A315784B26A2F964C1C7033F34BDB5B008A8882D82695959B86D2DA430
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................$.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	data
Category:	dropped
Size (bytes):	34928
Entropy (8bit):	3.200011130530873
Encrypted:	false
SSDEEP:	96:H7OhFVCPq949IVXEBodRBknqOhFVCsCLR49IVXEBodRBkLh+qOhAVCsWd49IVXE7:HGiedRBFLGedRB5CedRBYyedRBJ
MD5:	9E13E927D1D7BB19EC77F68B0D6C8182
SHA1:	014594906D9EC5C68C3522F4E77C29AC050480C4
SHA-256:	8CA8CB00B1793F5B3D87B1987DF65114770D89F9E01E6326A0DA0BF9297FABDA
SHA-512:	49E501F77BD8A358A2D57B9344871F15A399C6602EF8522FCC54889E2280AC8E39873621FCDB81D60BF099E50CCC757041728F6BFA4682BCBCF445D60BD4A673
Malicious:	false
Preview:	.............1.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................X...h...y................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.6224 Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	157443
Entropy (8bit):	5.172039478677
Encrypted:	false
SSDEEP:	1536:amNTjRlaRlQShhp2VpMKRhWa11quVJzlzofqG9Z0ADWp1ttawvayKLWbVG3+2:RNj3aRlQShhp2VpMKRhWa11quVJX2
MD5:	A2C6972A1A9506ACE991068D7AD37098
SHA1:	BF4D2684587CF034BCFC6F74CED551F9E5316440
SHA-256:	0FB687D20C49DDBADD42ABB489C3B492B5A1893352E2F4B6AA1247EFE7363F65
SHA-512:	4D03884CA5D1652A79E6D55D8F92F4D138C47D462E05C3E6A685DA6742E98841D9C63720727203B913A179892C413BFB33C05416E1675E0CF80DA98BE90BA5E4
Malicious:	false
Preview:	%!Adobe-FontList 1.16.%Locale:0x409..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Marlett.FamilyName:Marlett.StyleName:Regular.MenuName:Marlett.StyleBits:0.WeightClass:500.WidthClass:5.AngleClass:0.FullName:Marlett.WritingScript:Roman.WinName:Marlett.FileLength:27724.NameArray:0,Win,1,Marlett.NameArray:0,Mac,4,Marlett.NameArray:0,Win,1,Marlett.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:ArialMT.FamilyName:Arial.StyleName:Regular.MenuName:Arial.StyleBits:0.WeightClass:400.WidthClass:5.AngleClass:0.FullName:Arial.WritingScript:Roman.WinName:Arial.FileLength:1036584.NameArray:0,Win,1,Arial.NameArray:0,Mac,4,Arial.NameArray:0,Win,1,Arial.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Arial-BoldMT.FamilyName:Arial.StyleName:Bold.MenuName:Arial.StyleBits:2.WeightClass:700.WidthClass:5.AngleClass:0.FullName:Arial Bold.WritingScript:Roman.WinName:Arial Bold.FileLength:980756.NameArray:0,Win,1,Arial.NameArray:0,Mac,4,Arial Bold.NameAr

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin Download File
Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	data
Category:	dropped
Size (bytes):	63598
Entropy (8bit):	5.433041226997456
Encrypted:	false
SSDEEP:	768:PCbGNFYGpiyVFiCUZYzIo5uAht0voXD3xuwJxllIAyYyu:J0GpiyVFiBYso5uA/0GJxlmAyK
MD5:	72EE5D90D54A011F5EA7CC6C4DE171D3
SHA1:	0DD7413D374B530F1AF4019C4BC18DA0BADE6D01
SHA-256:	93CC81A2F3C3732CDE0ED40E2283794DFEB1ECB0BEC403953FC79F433B3B3C89
SHA-512:	AB95C4EA10F563841054A39EF940ABA6868C900C58A5CD6F53B9731F5D21ABD85E238DB9D4F01D8A4651DD9DCBBFE210206A3F8501CDF1B886ED8D9CD603A8D3
Malicious:	false
Preview:	4.382.88.FID.2:o:........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.94.FID.2:o:........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.82.FID.2:o:........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.93.FID.2:o:........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.107.FID.2:o:........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.103.FID.2:o:........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.116.FID.2:o:........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.75.FID.2:o:........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.89.FID.2:o:........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.85.FID.2:o:........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.98.FID.2:o:........:F:Arial-B

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\DURNCK2N\app.degoo[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	100
Entropy (8bit):	4.635854381449572
Encrypted:	false
SSDEEP:	3:D90aK1ryRtFwsIKgqJVqYJW+5wbgRM9qSeRMKb:JFK1rUFczqfqYx5w0RMleRlb
MD5:	817F1D6EE0FE2E47BDE877810B61D119
SHA1:	A71514BED962166B0A814FDFC6AD7A3C2F73356D
SHA-256:	FE50697465DDADE8EF5DC29ABD1F551A23E135724E40D1A6A090F144091A2358
SHA-512:	40084A8E8DE9415E114B2BB6EB72E1BACF44C6A8BF6C2EC83D49BB0511753B5F9B2D04880A2356A0FF0F154218112DBB91F53F8845E96A70F02B4ED9C3A3C8F8
Malicious:	false
Preview:	<root></root><root><item name="DarkMode" value="false" ltime="3281492432" htime="30894583" /></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FE9C8DBE-D5EA-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	32856
Entropy (8bit):	1.8469418051745814
Encrypted:	false
SSDEEP:	192:riZpZPf2PuWPktPZfPPtPCLWPTPEPVtPqy3:re/mdoxdb7MH9
MD5:	12ED7EF430AE7F09812AD3FF07E000C6
SHA1:	3C3E3BBED201C268FF57059879ACAB6A9E04D9AA
SHA-256:	1F880F324ACD5D83B120A63A09751AF836F87C53BE3CAC4773EE585210FF6451
SHA-512:	F56D75953C197599E3E97C79741063896AEB27BBBFD9ED9FE585EE4030EC3BFD093199876DC2CE886EEC4729CFD7CBAE233E55A59808D2E79926B5E520927BE1
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{05FEA67E-D5EB-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	16984
Entropy (8bit):	1.565954387180827
Encrypted:	false
SSDEEP:	48:IwJGcprcGwpaVEG4pQf2GrapbSYGQpKiG7HpRa7TGIpG:rPZUQK6wBSgANTaA
MD5:	5533F15632A49AEE3B2F84B0777FB2D7
SHA1:	5599022AE8F2CC33B8815CFE77B4F299BA497D36
SHA-256:	E69724EFC4041D353FAE2DB5A0C617B0C0A70E840DD157528775498A77B9C9F1
SHA-512:	4D55161D4BFBCFA80AF104F52F9FA102B22C612AA9A0D7489F541E342C2328AE382C5B56AE70547318F999DDF2E050A6793D8724CEDDCD6B6E0900A86549D0B1
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{FE9C8DC0-D5EA-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	modified
Size (bytes):	76922
Entropy (8bit):	2.3070141085755242
Encrypted:	false
SSDEEP:	384:rVhe0FwbhFciGNzw+YgYGhaztoQT42f6Mphdz5OOada7jdc6naKAp:/6ni
MD5:	ABDAD81DAA743DE991457FC26C02D3C4
SHA1:	246F6F3A2A0E8402215F385EE741C3B06E2A12D2
SHA-256:	678669C01AF28EC766260573BDB97C9044ECE7882C5907C0F88AD13605B04019
SHA-512:	E9C19B1ED4893DC8728A9019AB0AE6D2379760E9E193ECD098ADDFF2BB7EA0C0397E2B33057635317382202A408F0280AA7B2A2DDEEC32A553D73527D8D28254
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\dikxvqf\imagestore.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	15524
Entropy (8bit):	3.604356852110322
Encrypted:	false
SSDEEP:	384:82/f/W/3RZ/P/3RZ/b+8/d/C/e/gs7LlJ/n/n/n/9/n/n/n/G3l/6/C/n/n/n/no:rHOn3nVF6Gb///1///KSq////P////jc
MD5:	72491054523EE7A095B0EEA315A4A732
SHA1:	8B427E2CA09DB4ABE46DA80398F8F2B04EC3285F
SHA-256:	5FF2FB532F842615702D84C39B7C8D67E804346FDAE129E88FAC55EDDA5EF08A
SHA-512:	EE132686F526EEAB997C24FA26E888F7775236998DBD2892FE7C30864AF2B9FAEDB5342FB73C743283989D5A9441889CCE9AD4404A2874F0A67ADFA6CBE8B489
Malicious:	false
Preview:	4.h.t.t.p.s.:././.a.p.p...d.e.g.o.o...c.o.m./.a.s.s.e.t.s./.i.c.o.n.s./.f.a.v.i.c.o.n._.r.o.u.n.d...i.c.o..%........00.... ..%......(...0...`..... ......$..................................................................................%%(.%%(1%%(s%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(s%%(1%%(.........................................................................................................................%%(1%%(s%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(s%%(1........................................................................................................%%(1%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(1........................................................................................%%(.%%(s%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(.%%(s%%(.............................................................................%%(1%%(.%%(.%%(.%%(.%%(.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\16-es5.d6a596f49720b05b2db9[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	68406
Entropy (8bit):	5.371802643113107
Encrypted:	false
SSDEEP:	768:XC5lZ0Cvaae0CiLGSiVN2lUJM4J+pJMV7ZJxG/88nDMVyBYFXmG8JpYzxjF0YtRu:GJXGSiVQqyPajFLoNtduY
MD5:	0C221CE1148748E409F52F768A1120A9
SHA1:	1ABA21515B4351417E45C245C0760947722ADA2C
SHA-256:	D1AB383CD5D48F966783A859A87DB368F3F206A71968BAB19A894026FC9D598C
SHA-512:	EA5E17F4EC15FAE8D67835E374E470FD3C2FA3EA3381240AA03E3EA886EE2AEF4B32AEEB3C40B2FFCD6989AD6AE24697F13E9F141BF5B3123776305CD9EFAFA4
Malicious:	false
IE Cache URL:	https://app.degoo.com/16-es5.d6a596f49720b05b2db9.js
Preview:	(function(){var _templateObject;function _taggedTemplateLiteral(e,t){return t\|\|(t=e.slice(0)),Object.freeze(Object.defineProperties(e,{raw:{value:Object.freeze(t)}}))}function _get(e,t,n){return(_get="undefined"!=typeof Reflect&&Reflect.get?Reflect.get:function(e,t,n){var r=_superPropBase(e,t);if(r){var i=Object.getOwnPropertyDescriptor(r,t);return i.get?i.get.call(n):i.value}})(e,t,n\|\|e)}function _superPropBase(e,t){for(;!Object.prototype.hasOwnProperty.call(e,t)&&null!==(e=_getPrototypeOf(e)););return e}function _createForOfIteratorHelper(e,t){var n;if("undefined"==typeof Symbol\|\|null==e[Symbol.iterator]){if(Array.isArray(e)\|\|(n=_unsupportedIterableToArray(e))\|\|t&&e&&"number"==typeof e.length){n&&(e=n);var r=0,i=function(){};return{s:i,n:function(){return r>=e.length?{done:!0}:{done:!1,value:e[r++]}},e:function(e){throw e},f:i}}throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}v

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\21-es5.ca35ca0c249dbfb7ef97[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	68423
Entropy (8bit):	5.46993406155363
Encrypted:	false
SSDEEP:	768:dCKd1ZlKks5boa63CpJqfCR0GgqOgfhgG6ZggCqJmgC20Otdugdf7+WA0Q4:Nzle5boa63CqaRZ/x68WdfzG4
MD5:	C3483CEE597EF77178AD3AD0AC9E2173
SHA1:	B282D5868F6C936E74370BCADDE7F93B26060900
SHA-256:	0325B89D5315835898CE512D0E5A356059FA0BE04610FB2A8E5D5D6705CD0CEF
SHA-512:	AB80B3CD713E3F64294EA1EE367775E95B9909D73EDE649C575EC6BE617EFDDC6F8F498D77ECF7B851734D63013791460517EA88179226FCC9C980CB729FA812
Malicious:	false
IE Cache URL:	https://app.degoo.com/21-es5.ca35ca0c249dbfb7ef97.js
Preview:	!function(){var e,t,n,i,o,r,a,c,s,u,l,d,f,b,h,g,p,m,v,O,y,k,C,w,M,_,j,P,S,x,R,I;function A(e,t){return t\|\|(t=e.slice(0)),Object.freeze(Object.defineProperties(e,{raw:{value:Object.freeze(t)}}))}function E(e,t){return function(e){if(Array.isArray(e))return e}(e)\|\|function(e,t){if("undefined"==typeof Symbol\|\|!(Symbol.iterator in Object(e)))return;var n=[],i=!0,o=!1,r=void 0;try{for(var a,c=e[Symbol.iterator]();!(i=(a=c.next()).done)&&(n.push(a.value),!t\|\|n.length!==t);i=!0);}catch(s){o=!0,r=s}finally{try{i\|\|null==c.return\|\|c.return()}finally{if(o)throw r}}return n}(e,t)\|\|function(e,t){if(!e)return;if("string"==typeof e)return L(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n\|\|"Set"===n)return Array.from(e);if("Arguments"===n\|\|/^(?:Ui\|I)nt(?:8\|16\|32)(?:Clamped)?Array$/.test(n))return L(e,t)}(e,t)\|\|function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-arra

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\TitlingFBGothicNormalRegular[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PostScript Type 1 font program data
Category:	downloaded
Size (bytes):	29762
Entropy (8bit):	7.829614470608759
Encrypted:	false
SSDEEP:	768:1IrrPbRbWlamjrJi7k0yFSMNabanhvO0OYLET8a:1Ir5ClamjrJiAmMNabeAmLEga
MD5:	133D61834D724B585D2310BFFD83F704
SHA1:	231AA05FADE4ADE01859B4507CA4416B3A044C5C
SHA-256:	18D42468E84D2B7466FA0284994F6CBA992548D312DFBFEB519A0D833CE5DC97
SHA-512:	DFFE890429B7600AD6A950E4C63125789CCD7FEFB34E97B5AC18B7845538F2297784B9F9F8E9EF61C2F374029187FEBE36EF61FCCCC32265F85984F7D082E5F3
Malicious:	false
IE Cache URL:	https://app.degoo.com/assets/fonts/TitlingFBGothicNormalRegular.eot?
Preview:	......%!PS-AdobeFont-1.0: TitlingGothicFBNormal-Regular 001.000.%%Title: TitlingGothicFBNormal-Regular.%Version: 001.000.%%CreationDate: Fri Jan 3 16:35:27 2020.%%Creator: www-data.%Copyright: [c] Copyright 2003-2004, The Font Bureau, Inc. Designed by.%Copyright: David Berlow. All rights reserved..% Generated by FontForge 20170924 (http://fontforge.sf.net/).%%EndComments..10 dict begin./FontType 1 def./FontMatrix [0.001 0 0 0.001 0 0 ]readonly def./FontName /TitlingGothicFBNormal-Regular def./FontBBox {-114 -200 1442 981 }readonly def./PaintType 0 def./FontInfo 10 dict dup begin. /version (001.000) readonly def. /Notice ([c] Copyright 2003-2004, The Font Bureau, Inc. Designed by David Berlow. All rights reserved.) readonly def. /FullName (TitlingGothicFB Normal Regular) readonly def. /FamilyName (TitlingGothicFB Normal Regular) readonly def. /Weight (Regular) readonly def. /FSType 8 def. /ItalicAngle 0 def. /isFixedPitch false def. /UnderlinePosition -133 def. /UnderlineThickness 20

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\common-es5.e76a48dd0ae2eec1803e[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	44961
Entropy (8bit):	5.352989598324481
Encrypted:	false
SSDEEP:	768:jCuCZFCnmeyW3rqQUQvtf2TTDKibzvfbJ2xFZ4DkoVdd7MIGJSg5GSOi:8cUWqQUVX7J84zd7Vi
MD5:	8504EFAA12ECD299EE46EA2DE18159AF
SHA1:	483A93162412474074FCEC0ED9EBBBCA2C81139C
SHA-256:	C66323246EACC29E0D27A57839060C652697D4267F5F280170F7F9AF39A592A8
SHA-512:	E1B90AF7E409CF3644A4A6A85052715DBD88F684B1436B31AC2324D5E0EEF44A0716E3E921C9E7DCBC9438EEC4EE22B8A759B0AAB7ED6F2548F84D10E921DEA1
Malicious:	false
IE Cache URL:	https://app.degoo.com/common-es5.e76a48dd0ae2eec1803e.js
Preview:	!function(){var a,e,n,i,t;function o(a){return function(a){if(Array.isArray(a))return s(a)}(a)\|\|function(a){if("undefined"!=typeof Symbol&&Symbol.iterator in Object(a))return Array.from(a)}(a)\|\|c(a)\|\|function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function r(a,e){var n;if("undefined"==typeof Symbol\|\|null==a[Symbol.iterator]){if(Array.isArray(a)\|\|(n=c(a))\|\|e&&a&&"number"==typeof a.length){n&&(a=n);var i=0,t=function(){};return{s:t,n:function(){return i>=a.length?{done:!0}:{done:!1,value:a[i++]}},e:function(a){throw a},f:t}}throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}var o,r=!0,l=!1;return{s:function(){n=a[Symbol.iterator]()},n:function(){var a=n.next();return r=a.done,a},e:function(a){l=!0,o=a},f:function(){try{r\|\|null==n.return\|\|n.return()}finally{if(l)th

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\favicon[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	6964
Entropy (8bit):	5.500549062706611
Encrypted:	false
SSDEEP:	192:Ataq3SSO3a66hgKRNjyIHbIKmAcu2Ge/WnKyeU80RG4J71n07r099:V4NjyIHkLA/2GeunKpU80g4vH
MD5:	529C70243CF7AE518B9B7CA329D9FC69
SHA1:	6132CCAC710D53F6B462403D20BA1BF555CF08D3
SHA-256:	F5659E4A0DB8E33EEEF9EF9A162287A89A014E91679670550A1B7AF2CF812287
SHA-512:	B0DEEA681DFD7C4A8E08FA5EA907FDD4DD653E0282D297731D2E542185180DA9853493E0087937A3197D203B93FC7371B5BEBFC073B962C0341E5612C0D5F6AD
Malicious:	false
Preview:	<!doctype html>..<html lang="en">..<head>..<meta charset="utf-8">..<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1.0, user-scalable=no">..<meta name="Description" content="Welcome to Degoo Web App. Expect more. Rediscover your memories with premium cloud storage. On Android, iOS and web.">..<meta name="msapplication-TileColor" content="#282525">..<meta name="msapplication-square70x70logo" content="assets/icons/ms-icon-70x70.png"/>..<meta name="msapplication-square144x144logo" content="assets/icons/ms-icon-144x144.png"/>..<meta name="msapplication-square150x150logo" content="assets/icons/ms-icon-150x150.png"/>..<meta name="msapplication-square310x310logo" content="assets/icons/ms-icon-310x310.png"/>..<meta name="theme-color" content="#282525">..<title>Degoo Cloud</title>..<base href="/">..<link href="assets/icons/favicon_round.ico" rel="icon" type="image/x-icon">..<link rel="manifest" href="manifest.webmanifest">..<link rel="preconnect" href="https://

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\main-es2015.3a32fff22d01d0551325[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	400373
Entropy (8bit):	5.25113430384996
Encrypted:	false
SSDEEP:	6144:dKa62FZc9OmVCIS5pMbu8ANrSsU9cgVTdjc92rLRpojgZ8lR:dKv2Hc/VjmpsFarTQh2jgZ8T
MD5:	7A2C5551944963D0ACB2D1E94BF225D6
SHA1:	FD191CC1768350089A81E3DD099DADFA331FA45E
SHA-256:	BE97224BF947DB96620ED2A2F46758D727F79B5CA643C0CD48B16FCD199CCEE0
SHA-512:	0E94777D68E421D6A88625C508F86F8A491800599D96152D2F50844F3FBA37C64571B4B7664C65A8644EE5FD4F39552401BA948299F9F53D5224684D972EE700
Malicious:	false
IE Cache URL:	https://app.degoo.com/main-es2015.3a32fff22d01d0551325.js
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[156],{0:function(t,e,n){t.exports=n("zUnb")},"2QA8":function(t,e,n){"use strict";n.d(e,"a",function(){return r});const r=(()=>"function"==typeof Symbol?Symbol("rxSubscriber"):"@@rxSubscriber_"+Math.random())()},"2Vo4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("XNiG"),s=n("9ppp");class i extends r.a{constructor(t){super(),this._value=t}get value(){return this.getValue()}_subscribe(t){const e=super._subscribe(t);return e&&!e.closed&&t.next(this._value),e}getValue(){if(this.hasError)throw this.thrownError;if(this.closed)throw new s.a;return this._value}next(t){super.next(this._value=t)}}},"2fFW":function(t,e,n){"use strict";n.d(e,"a",function(){return s});let r=!1;const s={Promise:void 0,set useDeprecatedSynchronousErrorHandling(t){if(t){const t=new Error;console.warn("DEPRECATED! RxJS was set to use deprecated synchronous error handling behavior by code at: \n"+t.stack)}else r&&console.log("RxJS: Back to a be

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\main-es5.3a32fff22d01d0551325[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	474875
Entropy (8bit):	5.247623758858276
Encrypted:	false
SSDEEP:	6144:+ZDx9jBEJ9csE7TwK0BpLrgBUaDvJ4Xopnc/daLArd:mDx9jBXOKQhoxidaLAh
MD5:	1A0FC7252D9B5132D4629984569FCDC7
SHA1:	9141BF5B8A1FBBD947EB30230D25587712684B69
SHA-256:	28C50A68FF8714062C30FFDBA679DCA5A8EDF05904FE440A965592AC44A2D82B
SHA-512:	0C5557F8677FCA32F2CBADDB63551D65C809381FC697DE304652E4C4B7A108FF13157D6C17C0E2C49C33885F7828C45F9AFF14E6F20E7633D9CC48F15847E0A1
Malicious:	false
IE Cache URL:	https://app.degoo.com/main-es5.3a32fff22d01d0551325.js
Preview:	(function(){var _templateObject,_templateObject2,_templateObject3,_templateObject4,_templateObject5,_templateObject6;function _taggedTemplateLiteral(e,t){return t\|\|(t=e.slice(0)),Object.freeze(Object.defineProperties(e,{raw:{value:Object.freeze(t)}}))}function _toArray(e){return _arrayWithHoles(e)\|\|_iterableToArray(e)\|\|_unsupportedIterableToArray(e)\|\|_nonIterableRest()}function _slicedToArray(e,t){return _arrayWithHoles(e)\|\|_iterableToArrayLimit(e,t)\|\|_unsupportedIterableToArray(e,t)\|\|_nonIterableRest()}function _nonIterableRest(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}function _iterableToArrayLimit(e,t){if("undefined"!=typeof Symbol&&Symbol.iterator in Object(e)){var n=[],r=!0,i=!1,a=void 0;try{for(var o,s=e[Symbol.iterator]();!(r=(o=s.next()).done)&&(n.push(o.value),!t\|\|n.length!==t);r=!0);}catch(u){i=!0,a=u}finally{try{r\|\|null==s.return\|\|s.return()}finally{if(i)t

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\moments[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	6964
Entropy (8bit):	5.500549062706611
Encrypted:	false
SSDEEP:	192:Ataq3SSO3a66hgKRNjyIHbIKmAcu2Ge/WnKyeU80RG4J71n07r099:V4NjyIHkLA/2GeunKpU80g4vH
MD5:	529C70243CF7AE518B9B7CA329D9FC69
SHA1:	6132CCAC710D53F6B462403D20BA1BF555CF08D3
SHA-256:	F5659E4A0DB8E33EEEF9EF9A162287A89A014E91679670550A1B7AF2CF812287
SHA-512:	B0DEEA681DFD7C4A8E08FA5EA907FDD4DD653E0282D297731D2E542185180DA9853493E0087937A3197D203B93FC7371B5BEBFC073B962C0341E5612C0D5F6AD
Malicious:	false
IE Cache URL:	https://app.degoo.com/moments?_branch_match_id=936917171307723363
Preview:	<!doctype html>..<html lang="en">..<head>..<meta charset="utf-8">..<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1.0, user-scalable=no">..<meta name="Description" content="Welcome to Degoo Web App. Expect more. Rediscover your memories with premium cloud storage. On Android, iOS and web.">..<meta name="msapplication-TileColor" content="#282525">..<meta name="msapplication-square70x70logo" content="assets/icons/ms-icon-70x70.png"/>..<meta name="msapplication-square144x144logo" content="assets/icons/ms-icon-144x144.png"/>..<meta name="msapplication-square150x150logo" content="assets/icons/ms-icon-150x150.png"/>..<meta name="msapplication-square310x310logo" content="assets/icons/ms-icon-310x310.png"/>..<meta name="theme-color" content="#282525">..<title>Degoo Cloud</title>..<base href="/">..<link href="assets/icons/favicon_round.ico" rel="icon" type="image/x-icon">..<link rel="manifest" href="manifest.webmanifest">..<link rel="preconnect" href="https://

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\more_horizontal[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	249
Entropy (8bit):	4.760373949068108
Encrypted:	false
SSDEEP:	6:tvKIiad4mc4sl3HnKWBqlLgV2bvQEv/XyY:tvG1HnKuqlLNboECY
MD5:	CF2D7B5CFF622A53EFCBB737FD619FAE
SHA1:	6881851C91776CD336D480348A995ADE987A3774
SHA-256:	9D54024320770693B4C6713246FB2557F170D4637A50D8BA3ED009EC7C723906
SHA-512:	0EA62B8F83DD3886E465640DB9116FFC23EC800FBB6E9A4C0B1927C889E5A145F53F2C09D29EDC16CB1B790CBA1E34DD0EA440A207308C744FBA6875AB7FFEE6
Malicious:	false
IE Cache URL:	https://app.degoo.com/assets/icons/more_horizontal.svg
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><title>more_horizontal</title><path d="M18,10a2,2,0,1,1-2,2A2,2,0,0,1,18,10Zm-4,2a2,2,0,1,0-2,2A2,2,0,0,0,14,12ZM8,12a2,2,0,1,0-2,2A2,2,0,0,0,8,12Z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\polyfills-es5.7aa6f0422e5af3047d89[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	138423
Entropy (8bit):	5.3585611230682915
Encrypted:	false
SSDEEP:	1536:1Az2H7W2/RWAVf9OSdg1wtvIQKVwXTIxt0ToBFvLcWS:A4WIW+MSdgEO8TmUv
MD5:	FD54789BD2D94308271FB5AC28FE965F
SHA1:	A4FBF2D173B5D6FFA060B965885FAAACDA57151A
SHA-256:	CBF730F72B60486CCCB864D63443B4CCC96F17519293EFE80201ACCC947865A9
SHA-512:	7AEE93A1B1188F33F387998CCF9940730610269C0F66043267E10ACDBCA8DD351CFBE3C89556EB5725DCF7392F0CC560B5114757264526628D09675B4001DC3C
Malicious:	false
IE Cache URL:	https://app.degoo.com/polyfills-es5.7aa6f0422e5af3047d89.js
Preview:	!function(){function t(t,n){var r;if("undefined"==typeof Symbol\|\|null==t[Symbol.iterator]){if(Array.isArray(t)\|\|(r=function(t,n){if(!t)return;if("string"==typeof t)return e(t,n);var r=Object.prototype.toString.call(t).slice(8,-1);"Object"===r&&t.constructor&&(r=t.constructor.name);if("Map"===r\|\|"Set"===r)return Array.from(t);if("Arguments"===r\|\|/^(?:Ui\|I)nt(?:8\|16\|32)(?:Clamped)?Array$/.test(r))return e(t,n)}(t))\|\|n&&t&&"number"==typeof t.length){r&&(t=r);var o=0,i=function(){};return{s:i,n:function(){return o>=t.length?{done:!0}:{done:!1,value:t[o++]}},e:function(t){throw t},f:i}}throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}var a,c=!0,u=!1;return{s:function(){r=t[Symbol.iterator]()},n:function(){var t=r.next();return c=t.done,t},e:function(t){u=!0,a=t},f:function(){try{c\|\|null==r.return\|\|r.return()}finally{if(u)throw a}}}}function e(t,e){(null==e\|\|e>t.length)&&(e=t.length);f

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\runtime-es5.2d1a57c7b33e86d357e7[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	6965
Entropy (8bit):	5.125515550388224
Encrypted:	false
SSDEEP:	96:EAt5pX/fL7Dj12yMWpQY/v+wGPuhWB5yHNLuOxPGy9uQGpZlfaHzTxrvX6lZo:pJ/f3LvQYX0GA5epoQ4fy6lZo
MD5:	B3150E275B7F9DB693B57D3875A249FB
SHA1:	60A06CBEFDA2C0963FC86B814BDA5427EFF5BB83
SHA-256:	CF0D856A09BFF864768DF4959CD328E7C684A453D4BE6C66839FB778AB10235E
SHA-512:	5FEBC8869B6124205F87530D7794AA1252D072003892ABE082D07602A3A8278510C856FD5CF7E611ED5CF90FC55337EBE0D51BA91ECD9985FB3B002AA6119194
Malicious:	false
IE Cache URL:	https://app.degoo.com/runtime-es5.2d1a57c7b33e86d357e7.js
Preview:	!function(e){function d(d){for(var c,r,t=d[0],n=d[1],o=d[2],i=0,l=[];i<t.length;i++)r=t[i],Object.prototype.hasOwnProperty.call(f,r)&&f[r]&&l.push(f[r][0]),f[r]=0;for(c in n)Object.prototype.hasOwnProperty.call(n,c)&&(e[c]=n[c]);for(u&&u(d);l.length;)l.shift()();return b.push.apply(b,o\|\|[]),a()}function a(){for(var e,d=0;d<b.length;d++){for(var a=b[d],c=!0,t=1;t<a.length;t++)0!==f[a[t]]&&(c=!1);c&&(b.splice(d--,1),e=r(r.s=a[0]))}return e}var c={},f={20:0},b=[];function r(d){if(c[d])return c[d].exports;var a=c[d]={i:d,l:!1,exports:{}};return e[d].call(a.exports,a,a.exports,r),a.l=!0,a.exports}r.e=function(e){var d=[],a=f[e];if(0!==a)if(a)d.push(a[2]);else{var c=new Promise(function(d,c){a=f[e]=[d,c]});d.push(a[2]=c);var b,t=document.createElement("script");t.charset="utf-8",t.timeout=120,r.nc&&t.setAttribute("nonce",r.nc),t.src=function(e){return r.p+""+({0:"common"}[e]\|\|e)+"-es5."+{0:"e76a48dd0ae2eec1803e",1:"fb77717eef84a855f24e",2:"511349fb0dc623a7f5f1",3:"6fafd7d5e2c855df19ba",4:"22

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\selection[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1657
Entropy (8bit):	3.8244831669781223
Encrypted:	false
SSDEEP:	24:tu1xi4reBc7XEGCBiz8T72UeyJRZiAjg3gMgzQ7UYi:00BoEZBiz8/fLiWg3gMgX/
MD5:	914B5C6F4665482BD5ABC952FF0A499F
SHA1:	EC1443A49E10D1234358635B9CCB20332593F6C4
SHA-256:	23D99CDDA8C272C56AE9B37E1D7FE1232AB81B0CB75D6F9E33FB616D11A8427E
SHA-512:	AD57D53956529E46A898EB38F293A680189B5F54787E0FE827202C32D8B335858E336A5E1E1C075B8FC56971FA102F5BDE233AE30D1F5AB4F3749E29A887D66E
Malicious:	false
IE Cache URL:	https://app.degoo.com/assets/icons/selection.svg
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><title>selection</title><path d="M9,19.5v1a.5.5,0,0,1-.5.5h-1a.5.5,0,0,1-.5-.5v-1a.5.5,0,0,1,.5-.5h1A.5.5,0,0,1,9,19.5Zm3.5-.5h-1a.5.5,0,0,0-.5.5v1a.5.5,0,0,0,.5.5h1a.5.5,0,0,0,.5-.5v-1A.5.5,0,0,0,12.5,19ZM13,3.5a.5.5,0,0,0-.5-.5h-1a.5.5,0,0,0-.5.5v1a.5.5,0,0,0,.5.5h1a.5.5,0,0,0,.5-.5ZM8.5,3h-1a.5.5,0,0,0-.5.5v1a.5.5,0,0,0,.5.5h1A.5.5,0,0,0,9,4.5v-1A.5.5,0,0,0,8.5,3ZM4.71,3A2,2,0,0,0,3,4.71a.23.23,0,0,0,.06.2A.25.25,0,0,0,3.27,5H4.5A.5.5,0,0,0,5,4.5V3.27a.25.25,0,0,0-.09-.19A.23.23,0,0,0,4.71,3ZM4.5,7h-1a.5.5,0,0,0-.5.5v1a.5.5,0,0,0,.5.5h1A.5.5,0,0,0,5,8.5v-1A.5.5,0,0,0,4.5,7Zm0,4h-1a.5.5,0,0,0-.5.5v1a.5.5,0,0,0,.5.5h1a.5.5,0,0,0,.5-.5v-1A.5.5,0,0,0,4.5,11Zm0,4h-1a.5.5,0,0,0-.5.5v1a.5.5,0,0,0,.5.5h1a.5.5,0,0,0,.5-.5v-1A.5.5,0,0,0,4.5,15Zm0,4H3.27a.25.25,0,0,0-.19.09.23.23,0,0,0-.06.2A2,2,0,0,0,4.71,21a.23.23,0,0,0,.2-.06A.25.25,0,0,0,5,20.73V19.5A.5.5,0,0,0,4.5,19Zm16.23,0H19.5a.5.5,0,0,0-.5.5v

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\2-es5.511349fb0dc623a7f5f1[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	34205
Entropy (8bit):	5.3267158216849495
Encrypted:	false
SSDEEP:	384:gltIvn7FF95I+MMbSgg0lfg5GDpjz4SnXQPvpZ6petj+Nxv95BF034:gltc7F+Rgg0lfg523gPvAetjKTQ4
MD5:	D4750A3C46D475A2661A5ABDB2C870A6
SHA1:	2FD67103F22F0AD6DFC07C7945932D89F8C5D024
SHA-256:	3F5E76C3A929F4A157B436163EE20AE18A88316019BE1E82299593AC7949CABF
SHA-512:	5A5F300DA54D60DB317A2E29C96338952C643873878EEFB3BACB80168CB5F57E1273FF8452211F658F16F4B19093A4C643981D2008048B8AAF7C82B928AC690E
Malicious:	false
IE Cache URL:	https://app.degoo.com/2-es5.511349fb0dc623a7f5f1.js
Preview:	!function(){function t(t,e){if(!(t instanceof e))throw new TypeError("Cannot call a class as a function")}function e(t,e){for(var i=0;i<e.length;i++){var n=e[i];n.enumerable=n.enumerable\|\|!1,n.configurable=!0,"value"in n&&(n.writable=!0),Object.defineProperty(t,n.key,n)}}(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[2],{SYYg:function(i,n,r){"use strict";function s(t,e){return function(i,n){e(i,n,t)}}r.d(n,"a",function(){return g}),r.d(n,"b",function(){return _});var o=r("fXoL"),l=r("ofXK"),a=r("aCrv"),h=["header"],c=["container"],u=["content"],d=["invisiblePadding"],f=["*"];function p(){return{checkResizeInterval:1e3,modifyOverflowStyleOfParentScroll:!0,resizeBypassRefreshThreshold:5,scrollAnimationTime:750,scrollDebounceTime:0,scrollThrottlingTime:0,stripedTable:!1}}var m,v,g=((v=function(){function i(e,n,r,s,a,h){t(this,i),this.element=e,this.renderer=n,this.zone=r,this.changeDetectorRef=s,this.window=window,this.executeRefreshOutsideAngularZone=!1,this._enableUnequalChildrenS

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\3-es5.6fafd7d5e2c855df19ba[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	14674
Entropy (8bit):	5.497185601528754
Encrypted:	false
SSDEEP:	192:7Oy5R6div22XYPsxEWGZFnGGDp2UxNoukVzDxMR6qHF4dSk8U29W/MP98zTsx:P5R60v22IPsxsD2uKxMhe29W/MP3
MD5:	37327B4889B7D2129B0AE56C383B0CB3
SHA1:	4848D28F38530403EB34652768549FB5A458E688
SHA-256:	6E07F30458C1C85C40658CCA1B3A2F2DC65B0275E66EFBD37273A3B91A8C92F4
SHA-512:	FE0920DC33D70434D9CD54EA1E0AD74ADF35D3208F8F100BCB56F835682A1FD71A7CA4C2801E758144E4D9EE5E313A4B8CDBC805AAF4B06FC95ACA59229F19E7
Malicious:	false
IE Cache URL:	https://app.degoo.com/3-es5.6fafd7d5e2c855df19ba.js
Preview:	!function(){var e,n,t,o,r,i,c,a,s,l,g,d,u,b;function f(e,n){return n\|\|(n=e.slice(0)),Object.freeze(Object.defineProperties(e,{raw:{value:Object.freeze(n)}}))}function p(e,n){for(var t=0;t<n.length;t++){var o=n[t];o.enumerable=o.enumerable\|\|!1,o.configurable=!0,"value"in o&&(o.writable=!0),Object.defineProperty(e,o.key,o)}}(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[3],{"O6+7":function(v,h,m){"use strict";m.d(h,"a",function(){return E});var w=m("fXoL"),C=m("Cfvw"),y=m("AytR"),_=m("wtrT"),P=m("Y9WU"),S=m("Tra1"),O=m("Vjhi"),k=m("Muv9"),R=m("KEmJ"),M=m("ofXK"),x=m("3Pt+"),I=m("N/yi"),L=function(e,n,t,o){return new(t\|\|(t=Promise))(function(r,i){function c(e){try{s(o.next(e))}catch(n){i(n)}}function a(e){try{s(o.throw(e))}catch(n){i(n)}}function s(e){var n;e.done?r(e.value):(n=e.value,n instanceof t?n:new t(function(e){e(n)})).then(c,a)}s((o=o.apply(e,n\|\|[])).next())})};function T(e,n){if(1&e&&(w.Sb(0,"h1"),w.Hc(1),w.Rb()),2&e){var t=w.ic(2);w.Cb(1),w.Ic(t.header)}}var z=function(e

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\4-es5.22602f6f8c55ac0f6c34[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	36123
Entropy (8bit):	5.548169175528782
Encrypted:	false
SSDEEP:	384:i9B5g1VDoh53P51J9yCjF9oaO8mQHaybtT:LDoznSCLsQHayl
MD5:	ADB21C3463C56A56103AD148DBA1CF5E
SHA1:	C224018114D79496A9B320F22E0969E77D3E3A97
SHA-256:	C1DED7122CD068FD34DA458E342432E02885F87DC59B65E94B2DF0988DF57716
SHA-512:	406943CFB06C12A7421EA32EF0644314DB02D27C59753AA4E8DBFFB008FD7C25A1029914718EF48BB0DA7F829F60D4981DF36B850F5F19B9B3F5D0047AAEB81F
Malicious:	false
IE Cache URL:	https://app.degoo.com/4-es5.22602f6f8c55ac0f6c34.js
Preview:	!function(){var e,t,n,i,o,c,r,s,a,d,l,f,m,u,g,b;function h(e,t){return t\|\|(t=e.slice(0)),Object.freeze(Object.defineProperties(e,{raw:{value:Object.freeze(t)}}))}function v(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}function p(e,t){for(var n=0;n<t.length;n++){var i=t[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(e,i.key,i)}}function k(e,t,n){return t&&p(e.prototype,t),n&&p(e,n),e}(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[4],{"+5PK":function(u,g,b){"use strict";b.d(g,"a",function(){return fe}),b("EItx");var p=b("aFie"),y=b("quSY"),C=b("l7P3"),O=b("o5wj"),j=b("qB55"),M=b("dV0J"),w=b("wtrT"),I=b("O6+7"),S=b("CzQJ"),P=b("Y9WU"),x=b("cSqV"),_=b("KEmJ"),R=b("LM6c"),D=b("fXoL"),T=b("twue"),z=b("3Pt+"),E=b("ofXK"),N=b("TFMq"),A=b("ZjxN"),G=b("D05a");function B(e,t){if(1&e&&(D.Sb(0,"p",17),D.Hc(1),D.jc(2,"timeago"),D.Rb()),2&e){var n=D.ic();D.nc("title",n.title),D.Cb(1),D.Ic(D.kc(2,2,null=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\7-es5.8973bb01a146cfceb6c0[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	21280
Entropy (8bit):	5.135550704467276
Encrypted:	false
SSDEEP:	384:4fCr0fkHMkqkkkDkH6zktgRTkBknkaUkmk+kPkOkzkvkI/kWkS58ypApt/o:4fCskskqkkkDkmktgJkBknkaUkmk+kPh
MD5:	14A095085DAC3BDBB4AA60056423A688
SHA1:	D119DFE1DEED4D0E8429BDB25828E0FCD28D34DF
SHA-256:	095DDC7BCBD1D52A042AAC52691200E043FF37BBF1332099880730BF4A22E800
SHA-512:	9509F4B907A09734A41A89181EFD272DDE66491D169AA895743DF7A0A1574011AF9A12607C71A0BC27ACF0E122CB116761310314A3C4085F6421DE051E9CC2A6
Malicious:	false
IE Cache URL:	https://app.degoo.com/7-es5.8973bb01a146cfceb6c0.js
Preview:	!function(){function t(t,e,n){return e in t?Object.defineProperty(t,e,{value:n,enumerable:!0,configurable:!0,writable:!0}):t[e]=n,t}function e(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Super expression must either be null or a function");t.prototype=Object.create(e&&e.prototype,{constructor:{value:t,writable:!0,configurable:!0}}),e&&n(t,e)}function n(t,e){return(n=Object.setPrototypeOf\|\|function(t,e){return t.__proto__=e,t})(t,e)}function r(t){var e=function(){if("undefined"==typeof Reflect\|\|!Reflect.construct)return!1;if(Reflect.construct.sham)return!1;if("function"==typeof Proxy)return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],function(){})),!0}catch(t){return!1}}();return function(){var n,r=i(t);if(e){var a=i(this).constructor;n=Reflect.construct(r,arguments,a)}else n=r.apply(this,arguments);return o(this,n)}}function o(t,e){return!e\|\|"object"!=typeof e&&"function"!=typeof e?function(t){if(void 0===t)throw new ReferenceError("this has

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\PDF[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1752
Entropy (8bit):	5.137751727719721
Encrypted:	false
SSDEEP:	24:t4iGq3xJYnRoB1iqAnL/L5legWTEc5+N3GZYPP9XsS0cYH4EBg9fVINf7oT6jjre:wqbYnRy1VAnvGb+3GZYyS0rH4E+WeRM+
MD5:	4DFD8102C3C10D85A8A84B5EF2DCD380
SHA1:	606621945A4D462284623BC7401B04C28DC7DA1E
SHA-256:	AD2C6F5B69E9A6B73B99244FB1C7589E333013FB2267DC15B539D0FA71C983C6
SHA-512:	3AB6B596F6F73E15C636A3130E3B516F17A3B6432931E68225331FCE7F0D4CBD5DA4DA6BD22442865681B27A41D451B84109B4C02215D139C1BBA7C03539CE2A
Malicious:	false
IE Cache URL:	https://app.degoo.com/assets/icons/PDF.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="195" height="245.211" viewBox="0 0 195 245.211">.. <g id="Group_1" data-name="Group 1" transform="translate(-94 -57)">.. <g id="file_outlined" transform="translate(94 57)">.. <path id="Icon_color" data-name="Icon color" d="M170.628,0H24.372A24.474,24.474,0,0,0,0,24.519v131.93a37.109,37.109,0,0,0,10.727,25.986L62.4,234.419a36.665,36.665,0,0,0,25.831,10.792h82.4A24.474,24.474,0,0,0,195,220.692V24.519A24.474,24.474,0,0,0,170.628,0ZM24.372,147.124V24.519H170.628V220.692H97.5V159.384a12.237,12.237,0,0,0-12.186-12.259Z" transform="translate(195 245.211) rotate(180)" fill="#000000"/>.. </g>.. <g id="degoo_logo_white" transform="translate(131 182.524)">.. <path id="Path_2" data-name="Path 2" d="M778.229,316.332h0c-.049-18.818-14.956-34.054-33.346-34.083h-.016c-18.4.03-33.309,15.291-33.331,34.121h0a19.965,19.965,0,1,1-19.959-20.423h0a19.832,19.832,0,0,1,16.509,8.959,39.5,39.5,0,0,1,6.647-13.054,32.76,32.76,0,0,0-36.191-6.9,34.12

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\TitlingFBGothicMedium[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PostScript Type 1 font program data
Category:	downloaded
Size (bytes):	29989
Entropy (8bit):	7.829674681413827
Encrypted:	false
SSDEEP:	768:xuIrPGLSoNgJUgTVIRD+/FuUufJtSsLDsL/WYlp0q:xuIrOTGmgTVh/FL4JTcLtlN
MD5:	DDC9A169820DCABBBA52F02E98E7CCB6
SHA1:	B960DA0539D07E99B1E33C7F354F6BC4A232EFD2
SHA-256:	A5CF1A2B98EC72EF6EEF59362F67C9CFD6B679040BE799E904C14E95C89E0594
SHA-512:	5F598DDA009D57F2A09B3684648B97C26CAB45B2E58D82CA2F311BAB8047603443001EF6B77C32E18D7AEF9247C57D482D593329A020F02F716D80DBF206C1E8
Malicious:	false
IE Cache URL:	https://app.degoo.com/assets/fonts/TitlingFBGothicMedium.eot?
Preview:	......%!PS-AdobeFont-1.0: TitlingGothicFBNormal-Medium 001.000.%%Title: TitlingGothicFBNormal-Medium.%Version: 001.000.%%CreationDate: Fri Dec 27 12:29:40 2019.%%Creator: www-data.%Copyright: [c] Copyright 2003-2004, The Font Bureau, Inc. Designed by.%Copyright: David Berlow. All rights reserved..% Generated by FontForge 20170924 (http://fontforge.sf.net/).%%EndComments..10 dict begin./FontType 1 def./FontMatrix [0.001 0 0 0.001 0 0 ]readonly def./FontName /TitlingGothicFBNormal-Medium def./FontBBox {-120 -200 1490 996 }readonly def./PaintType 0 def./FontInfo 10 dict dup begin. /version (001.000) readonly def. /Notice ([c] Copyright 2003-2004, The Font Bureau, Inc. Designed by David Berlow. All rights reserved.) readonly def. /FullName (TitlingGothicFB Normal Medium) readonly def. /FamilyName (TitlingGothicFB Normal Medium) readonly def. /Weight (Medium) readonly def. /FSType 8 def. /ItalicAngle 0 def. /isFixedPitch false def. /UnderlinePosition -133 def. /UnderlineThickness 20 def.en

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\TitlingFBGothicNormalRegular[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, CFF, length 21652, version 1.0
Category:	downloaded
Size (bytes):	21652
Entropy (8bit):	7.982745786059205
Encrypted:	false
SSDEEP:	384:DDOPmrVUO86VN4d49rc6TDP46oc4+OQ2j46R1WOAQ0LwDuEcxZ6qw4Bq44N:vOeRUDWHrXH9XWvZ17AQmGihBGN
MD5:	AF09F7704EDFA7FD5FF9A01973B53C54
SHA1:	2A6FC3CBB0A884D5B7FCD15DE4D1E01B3804EB79
SHA-256:	2AE6F94431238BC8A37E4855237A7691E28B65C6E1DCA207BF056165F78B9731
SHA-512:	205764D3845F26740F404256A81CCA4BDBA6B4CF36D2AD2D71FEE35A997F75F6CDEA9A296C4141F1809003BB2F69079965AA519D1C9F221E9D09F45AF17833CF
Malicious:	false
IE Cache URL:	https://app.degoo.com/assets/fonts/TitlingFBGothicNormalRegular.woff
Preview:	wOFFOTTO..T.......{.........................CFF ...(..3;..?@..zyFFTM..R.........[o.EGDEF..;d...9...B.!..GPOS..<....[..(b).\.GSUB..;..........OS/2.......X...`..C9cmap...d.......F$}.Ahead...0...3...6..}~hhea...d... ...$....hmtx..R....x....F.&.maxp..............P.name............W.#post........... .t..x.c`d``....7..6_..._.E....9......`].\|...``....z8...x.c`d``V.o.p......}...."(.........P.....x.c`f.c.....................2001.2..(........^.P.........Y...........Ar._..0(.!3.yR..x..T.n.F.=.^6b.y.E.....IQ..I.. .. .#H..h...C..%.$-A.n.E[.+...........~A......;..D..3..qf... .o``.{._56p..R.-4.o5.`.5..O+.h\.g..5...K.....4....5..n....n.........Z.....q.O.o...7q.1...../Ja.....5.....?..5....M...+..u...4n.....o.........-...Ss5..W..4._.H............&...x..g/..).X!C...(.a.r`j..>....\|..1Sv.8....gi.\|...l.".B2>s.....PyKz'..T>...>..jUF-...<.....\|..q!..u...X.a:+..i&..}.h.X.H..h&C....Cq(.$]Z.~...$...e..!.0.A%1.........!5....0.NJ.O.j..'\gt..$.....8....8.^"...i...K.g..z~.....s7.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\degoo_logo_white[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1784
Entropy (8bit):	4.604195499287587
Encrypted:	false
SSDEEP:	48:EGZ+3RZJjoKePCsxZqTgeiEPC2MyVI6JUlhKK1dsy:3ZqRot1ZqTlRPC/yVClh11my
MD5:	51664FA1B944FC69CA552A54A0281A79
SHA1:	B2240AABDFC4E54E7792C4A6EF769EC46337A9BB
SHA-256:	DE8DCA3436ECC6ED8C6BAC1FAE914A221EBD006B55BB705D80FC7CEE700C8483
SHA-512:	92E38513E0471D2DE437374EA896E74AD6A862456A1560CC4DAF798CFD0A9857DC8761B9F5F14998D61E0028237AF647854677B806203BA1B7743F118766CA87
Malicious:	false
IE Cache URL:	https://app.degoo.com/assets/images/degoo_logo_white.svg
Preview:	<svg id="Lager_1" data-name="Lager 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1119.77244 733.43885">.. <defs>.. <style>.. .cls-1 {.. fill: #fff;.. }.. </style>.. </defs>.. <title>degoo_logo_master</title>.. <path class="cls-1" d="M275.87939,231.849v64.97748l-3.74133-2.39579a79.01567,79.01567,0,1,0,36.55411,66.602V231.849ZM229.64207,407.27058a46.23762,46.23762,0,1,1,46.23732-46.23792A46.29005,46.29005,0,0,1,229.64207,407.27058Z"/>.. <path class="cls-1" d="M943.23833,361.35954H943.236A79.32083,79.32083,0,0,0,864.03765,282.251v-.00134l-.026.00067-.0116-.00031v.00061a79.28975,79.28975,0,0,0-79.16284,79.196h-.00012A47.4057,47.4057,0,1,1,737.43145,314.045v-.00024a47.39086,47.39086,0,0,1,39.20984,20.795,90.93367,90.93367,0,0,1,15.78784-30.29986,79.14157,79.14157,0,0,0-134.19861,56.91064h.00037a79.29744,79.29744,0,0,0,79.20032,79.20075v.00012l.00219-.00006.002.00006v-.00012a79.30861,79.30861,0,0,0,79.19628-79.20044h.00049a47.44926,47.44926,0,1,1,8.02857,26.3

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\en[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	6964
Entropy (8bit):	5.500549062706611
Encrypted:	false
SSDEEP:	192:Ataq3SSO3a66hgKRNjyIHbIKmAcu2Ge/WnKyeU80RG4J71n07r099:V4NjyIHkLA/2GeunKpU80g4vH
MD5:	529C70243CF7AE518B9B7CA329D9FC69
SHA1:	6132CCAC710D53F6B462403D20BA1BF555CF08D3
SHA-256:	F5659E4A0DB8E33EEEF9EF9A162287A89A014E91679670550A1B7AF2CF812287
SHA-512:	B0DEEA681DFD7C4A8E08FA5EA907FDD4DD653E0282D297731D2E542185180DA9853493E0087937A3197D203B93FC7371B5BEBFC073B962C0341E5612C0D5F6AD
Malicious:	false
IE Cache URL:	https://app.degoo.com/assets/i18n/translations/en.json
Preview:	<!doctype html>..<html lang="en">..<head>..<meta charset="utf-8">..<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1.0, user-scalable=no">..<meta name="Description" content="Welcome to Degoo Web App. Expect more. Rediscover your memories with premium cloud storage. On Android, iOS and web.">..<meta name="msapplication-TileColor" content="#282525">..<meta name="msapplication-square70x70logo" content="assets/icons/ms-icon-70x70.png"/>..<meta name="msapplication-square144x144logo" content="assets/icons/ms-icon-144x144.png"/>..<meta name="msapplication-square150x150logo" content="assets/icons/ms-icon-150x150.png"/>..<meta name="msapplication-square310x310logo" content="assets/icons/ms-icon-310x310.png"/>..<meta name="theme-color" content="#282525">..<title>Degoo Cloud</title>..<base href="/">..<link href="assets/icons/favicon_round.ico" rel="icon" type="image/x-icon">..<link rel="manifest" href="manifest.webmanifest">..<link rel="preconnect" href="https://

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\en[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	downloaded
Size (bytes):	13316
Entropy (8bit):	4.921919586986266
Encrypted:	false
SSDEEP:	384:mtruDDRrseRoKou9jpaU3Y7XjGBycQmwy9m:MuFse+KopSMO2
MD5:	9840F49EB3A1070717E99CF3407196ED
SHA1:	09C311A8DC745314B201D6BED695C941A4267D1C
SHA-256:	471762C53615F3DF6B3604C46E2B7F2F995D7B627356E011E1E0FF88ACB136A2
SHA-512:	F600291411BB78ED76A2919ABEE977870C20BA3F21C63DEF407BBF48245A296A986B10F11CBFE4A2744B8B87227B772541A4D03D64102E09C4455E984E4A3823
Malicious:	false
IE Cache URL:	https://app.degoo.com/assets/i18n/en.json
Preview:	{.. "page-not-found.header": "Oh no!",.. "page-not-found.text": "We can't find the page you're looking for",.. "page-not-found.button": "Go back home",.. "landing-page.title": "WELCOME ONLINE!",.. "landing-page.search": "Search on Google",.. "text.search": "Search",.. "landing-page.description": "{$START_BOLD_TEXT}Instabridge{$CLOSE_BOLD_TEXT} is part of {$START_BOLD_TEXT}Degoo{$CLOSE_BOLD_TEXT},{$LINE_BREAK}a top secret cloud drive that helps you rediscover life's best memories.",.. "text.settings": "Settings",.. "text.upgrade": "Upgrade",.. "text.help": "Help",.. "text.log-out": "Log out",.. "text.moments": "Moments",.. "text.files": "Files",.. "text.shared": "Shared",.. "text.cancel": "Cancel",.. "text.add": "Add",.. "text.owner": "Owner",.. "text.remove": "Remove",.. "text.save": "Save",.. "text.or": "Or",.. "action.more": "More",.. "share-dialog.stop-share": "Stop sharing",.. "share-dialog.error.no-link": "Share link not available",.. "text.no-files": "No f

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\js[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	94152
Entropy (8bit):	5.504503601041568
Encrypted:	false
SSDEEP:	1536:lcfFo2Ao0GfIo9OLrd1m4KC4l3Z0M5qPBFv7e+z/PBCrv38h1S9rRTFW/iG1:lcf22Ao0oOL51m7u/PBA+QD8QY
MD5:	0E169B34F335FFC53E838623A808BCCC
SHA1:	0B27C00EF029CC525C90CFB6DBC17B25D5D2B625
SHA-256:	DB3F7D288AC4D659078F9C76071D778E99867F824621A9DBDDD8F8C94B123AFE
SHA-512:	AAA30DADE5A35F94B1334980457D2723D2E60A65FDC9105A2128FF37671D6A15FA9A27DEF311AA07DF42771E9D7C06CD68FABAB34CB258A2141725CB2C55ABA2
Malicious:	false
IE Cache URL:	https://www.googletagmanager.com/gtag/js?id=UA-36877698-1
Preview:	.// Copyright 2012 Google Inc. All rights reserved..(function(){..var data = {."resource": {. "version":"1",. . "macros":[{. "function":"__e". },{. "function":"__c",. "vtp_value":"undefined". }],. "tags":[{. "function":"__rep",. "vtp_containerId":"UA-36877698-1",. "vtp_remoteConfig":["map"],. "tag_id":1. },{. "function":"__zone",. "vtp_childContainers":["list",["map","publicId","G-668MSHBNLB"]],. "tag_id":3. }],. "predicates":[{. "function":"_eq",. "arg0":["macro",0],. "arg1":"gtm.js". }],. "rules":[. [["if",0],["add",0,1]]].},."runtime":[].....};../.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var ca,da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ea=function(a){var b="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];return b?b.call(a):{next:da(a)}},fa="function"==typeof Object.create?Object.create:fun

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\visible_outlined[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	449
Entropy (8bit):	4.661556302593657
Encrypted:	false
SSDEEP:	12:tvG1+vqg9j0jDMLQfuHtsjZjbuoaFUPaatpBBzG7:tu1MP9j0jwLKuijZjbuo2UPaI8
MD5:	C62B163D3ABF261A765C42A6B5E599AD
SHA1:	602D8828C26E19093B648654992E4667F9D399FE
SHA-256:	4920DDA4DFEF944367595D6937E94A1AF06225CA2419D7DFC1E8E9C384A8EABA
SHA-512:	6E0BAAF8A6E35648D1FE0144DF406BB0C2EF4AFD43622FF3ABF62B58410B4FFAD52C2E4AD95F11D904AC8920B214982E71D654305F2657D2AA7AF2E91D1168BB
Malicious:	false
IE Cache URL:	https://app.degoo.com/assets/icons/visible_outlined.svg
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><title>visible_outlined</title><path d="M22,11.7v0A10.65,10.65,0,0,0,12,5a10.65,10.65,0,0,0-9.94,6.67h0A1,1,0,0,0,2,12a.81.81,0,0,0,.06.31h0A10.65,10.65,0,0,0,12,19a10.65,10.65,0,0,0,9.94-6.67h0A.81.81,0,0,0,22,12v0A.93.93,0,0,0,22,11.7ZM12,17a8.82,8.82,0,0,1-7.93-5,8.79,8.79,0,0,1,15.86,0A8.82,8.82,0,0,1,12,17Zm0-8a3,3,0,1,0,3,3A3,3,0,0,0,12,9Z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\yEamRoo0VDj2ZJXd1fAFww[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	6964
Entropy (8bit):	5.500549062706611
Encrypted:	false
SSDEEP:	192:Ataq3SSO3a66hgKRNjyIHbIKmAcu2Ge/WnKyeU80RG4J71n07r099:V4NjyIHkLA/2GeunKpU80g4vH
MD5:	529C70243CF7AE518B9B7CA329D9FC69
SHA1:	6132CCAC710D53F6B462403D20BA1BF555CF08D3
SHA-256:	F5659E4A0DB8E33EEEF9EF9A162287A89A014E91679670550A1B7AF2CF812287
SHA-512:	B0DEEA681DFD7C4A8E08FA5EA907FDD4DD653E0282D297731D2E542185180DA9853493E0087937A3197D203B93FC7371B5BEBFC073B962C0341E5612C0D5F6AD
Malicious:	false
IE Cache URL:	https://app.degoo.com/share/yEamRoo0VDj2ZJXd1fAFww?_branch_match_id=936917171307723363
Preview:	<!doctype html>..<html lang="en">..<head>..<meta charset="utf-8">..<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1.0, user-scalable=no">..<meta name="Description" content="Welcome to Degoo Web App. Expect more. Rediscover your memories with premium cloud storage. On Android, iOS and web.">..<meta name="msapplication-TileColor" content="#282525">..<meta name="msapplication-square70x70logo" content="assets/icons/ms-icon-70x70.png"/>..<meta name="msapplication-square144x144logo" content="assets/icons/ms-icon-144x144.png"/>..<meta name="msapplication-square150x150logo" content="assets/icons/ms-icon-150x150.png"/>..<meta name="msapplication-square310x310logo" content="assets/icons/ms-icon-310x310.png"/>..<meta name="theme-color" content="#282525">..<title>Degoo Cloud</title>..<base href="/">..<link href="assets/icons/favicon_round.ico" rel="icon" type="image/x-icon">..<link rel="manifest" href="manifest.webmanifest">..<link rel="preconnect" href="https://

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\1-es5.fb77717eef84a855f24e[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	93225
Entropy (8bit):	5.3602807170497595
Encrypted:	false
SSDEEP:	1536:h3FudYglJak5iYFcRgCOkzLbxSmk1D9OQ:ivd6dOeS1D99
MD5:	60ED269A08B6AC82C7DA19FEBD073676
SHA1:	D630E8EDE124C4B31B8D0F71CA26EE0F5A4125FB
SHA-256:	2EC2616F3176877F5232CA2539DB484CCE2E5B1ABE50B6F6A604161A941452E5
SHA-512:	BE611FE67055926168F2051A0DB1547DD9BC4419EC93D55A8A4FF347D766DAFBCC440F5CB1E8E63B40A055753E96E5B5FF5610C645C41AFC9ED3E4B2B15BF0F5
Malicious:	false
IE Cache URL:	https://app.degoo.com/1-es5.fb77717eef84a855f24e.js
Preview:	(function(){var _templateObject,_templateObject2,_templateObject3,_templateObject4,_templateObject5,_templateObject6,_templateObject7,_templateObject8,_templateObject9,_templateObject10,_templateObject11,_templateObject12;function _taggedTemplateLiteral(e,t){return t\|\|(t=e.slice(0)),Object.freeze(Object.defineProperties(e,{raw:{value:Object.freeze(t)}}))}function _createForOfIteratorHelper(e,t){var r;if("undefined"==typeof Symbol\|\|null==e[Symbol.iterator]){if(Array.isArray(e)\|\|(r=_unsupportedIterableToArray(e))\|\|t&&e&&"number"==typeof e.length){r&&(e=r);var n=0,i=function(){};return{s:i,n:function(){return n>=e.length?{done:!0}:{done:!1,value:e[n++]}},e:function(e){throw e},f:i}}throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}var o,s=!0,a=!1;return{s:function(){r=e[Symbol.iterator]()},n:function(){var e=r.next();return s=e.done,e},e:function(e){a=!0,o=e},f:function(){try{s\|\|null

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\10-es5.32399b69ed2981c2b4fa[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	27132
Entropy (8bit):	5.3255026233629765
Encrypted:	false
SSDEEP:	384:LCACEBzwCLyA2TQjTsjdE/jwhjDCNJOhaF4qeLl+YKSsq6x:LCACEBsxQjTs6jcWNJgzdLYYzE
MD5:	883159F0E78FD2E82F1A602F92E8B2EB
SHA1:	6A0C0A598049E94E40CD6AD60B52CB9A46324109
SHA-256:	66DFA5BDFEA1C5CCA27DEAFB962F7862D173091948BEB6DD60FCF55F514F9F15
SHA-512:	D714D8ECD8C6006EF77226EB471698E136DD2ECBB992D58FC49E209E12ED86434A3018BA7552000E5559D407AEB67731980A9E19AE1E393835DD1B4F41394394
Malicious:	false
IE Cache URL:	https://app.degoo.com/10-es5.32399b69ed2981c2b4fa.js
Preview:	!function(){var t,n;function e(t){return function(t){if(Array.isArray(t))return c(t)}(t)\|\|r(t)\|\|s(t)\|\|function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function i(t){return u(t)\|\|r(t)\|\|s(t)\|\|a()}function r(t){if("undefined"!=typeof Symbol&&Symbol.iterator in Object(t))return Array.from(t)}function o(t,n){return u(t)\|\|function(t,n){if("undefined"==typeof Symbol\|\|!(Symbol.iterator in Object(t)))return;var e=[],i=!0,r=!1,o=void 0;try{for(var a,s=t[Symbol.iterator]();!(i=(a=s.next()).done)&&(e.push(a.value),!n\|\|e.length!==n);i=!0);}catch(c){r=!0,o=c}finally{try{i\|\|null==s.return\|\|s.return()}finally{if(r)throw o}}return e}(t,n)\|\|s(t,n)\|\|a()}function a(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}function s(t,n){if(t){if("string"==typeof t)return c(t,n);var

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\11-es5.7652e18b6c939f8a43d8[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	19393
Entropy (8bit):	5.555339730955624
Encrypted:	false
SSDEEP:	384:l/BLOfnzD4YSCiyPiyniyrv7iohepYfhh0krryfjmi:l/BifnjiyPiyniyrv7ivp+trrG
MD5:	CB4DB6E821A66A28C7DF7654CE1BAF8E
SHA1:	9480726BD1BF7DF9CBE51E72255D436A7CEAD07B
SHA-256:	3D3562306C09B5AB3D58C3C138FA195779A5A3F5EDA7B60A8225CB15F855B723
SHA-512:	CCC219181266FF04D847DE82C5B2B684CF3DCA2CB2A814C7952C153404944F08FDE80B5C696DDFC850DB2CDCB4844C62443DCB148C86564E6A3AC0EEEAAD504F
Malicious:	false
IE Cache URL:	https://app.degoo.com/11-es5.7652e18b6c939f8a43d8.js
Preview:	!function(){var e,t,i,n,a,o,r,c,s,l,b,d,u,f,h,g,m,v,p,C,w;function S(e,t){return t\|\|(t=e.slice(0)),Object.freeze(Object.defineProperties(e,{raw:{value:Object.freeze(t)}}))}function x(e,t){for(var i=0;i<t.length;i++){var n=t[i];n.enumerable=n.enumerable\|\|!1,n.configurable=!0,"value"in n&&(n.writable=!0),Object.defineProperty(e,n.key,n)}}(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[11],{g0RJ:function(O,k,P){"use strict";P.r(k),P.d(k,"DetailsDialogComponent",function(){return le});var M=P("Vjhi"),R=P("Tra1"),_=P("TFMq"),y=P("UiDe"),T=P("dV0J"),I=P("l7P3"),z=P("quSY"),W=P("ZjxN"),$=P("kl1M"),E=P("8HAE"),j=P("hlzJ"),L=P("Y9WU"),D=P("wtrT"),H=P("fXoL"),G=P("ofXK"),N=P("b+he"),q=P("+5PK"),Q=P("EiEF"),X=["tabs"];function F(e,t){if(1&e&&(H.Qb(0),H.Sb(1,"p",16),H.Wb(2,29),H.Rb(),H.Sb(3,"p",18),H.Hc(4),H.Rb(),H.Pb()),2&e){var i=H.ic();H.Cb(4),H.Ic(i.size)}}function J(e,t){if(1&e&&(H.Sb(0,"p",18),H.Hc(1),H.Rb()),2&e){var i=H.ic();H.Cb(1),H.Ic(null==i.owner?null:i.owner.email)}}function U(e

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\6-es5.7e97c2d1d037f2fe5107[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	16910
Entropy (8bit):	5.374087932898982
Encrypted:	false
SSDEEP:	384:VCFCLVhtj/zCsDW6aJfJK6IlLHSuNoCq4glJRcF1uQ:VCFCx/zu6aTNIkCqnFQ
MD5:	38E3B4E283B1D028FCF953AA701A0F0E
SHA1:	E33A73496871F03B3B37F8A277CC2E94D27B06FC
SHA-256:	20CB900BB7E9883C54A37CBAE9D6640C63883652EBEF55BA98D86E508CE6D727
SHA-512:	AA5D0173BDC38704BCF65D48D5DEAD112F8AAEC1E95475C6CA835841BC0E20607F512A0C4CE51CC15859A6190DCC6F1CDB23756F25F32B5F79D60C5048D0DE05
Malicious:	false
IE Cache URL:	https://app.degoo.com/6-es5.7e97c2d1d037f2fe5107.js
Preview:	!function(){var e;function t(e,t){return function(e){if(Array.isArray(e))return e}(e)\|\|function(e,t){if("undefined"==typeof Symbol\|\|!(Symbol.iterator in Object(e)))return;var n=[],i=!0,r=!1,o=void 0;try{for(var l,c=e[Symbol.iterator]();!(i=(l=c.next()).done)&&(n.push(l.value),!t\|\|n.length!==t);i=!0);}catch(s){r=!0,o=s}finally{try{i\|\|null==c.return\|\|c.return()}finally{if(r)throw o}}return n}(e,t)\|\|i(e,t)\|\|function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function n(e){return function(e){if(Array.isArray(e))return r(e)}(e)\|\|function(e){if("undefined"!=typeof Symbol&&Symbol.iterator in Object(e))return Array.from(e)}(e)\|\|i(e)\|\|function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function i(e,t){if(e){if("string"==typeof e)return r(e,t);var n=Object.pr

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\8-es5.bd03ed89bd426622a2e1[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	36186
Entropy (8bit):	5.412586122486408
Encrypted:	false
SSDEEP:	384:bqTYOJjR2dkNXYJQEGuERrE0zJUgJlKJ3MNSWoIkVQ9q3qIKNbBYe54m1YziPzn0:cYOJ9DKPGbRrEt2acNp03Dk1YziDFk/
MD5:	549C0606C517D42EA4C9D5EA231D2074
SHA1:	97C73DA86CFEC2D19C54BFFC100CFA1B836B4FD9
SHA-256:	5F43A91CAA7AAEF62B0B7B50A5D32EBE36716C7AEEDB3365FB0CCBC5E292BF91
SHA-512:	A2020A830D926FCB69A9B344F04B7B6A7766B1871DFBE2AFA6B62013A6532E22C2E2D5D74A98ED8B8E3C1D590C96C8F92F787F9B5A4A9A0DE9D0FF36DA398F8E
Malicious:	false
IE Cache URL:	https://app.degoo.com/8-es5.bd03ed89bd426622a2e1.js
Preview:	!function(){var e,t,n,i,o,a,r,c,s,l,u,d,f,m,g,b,h,v,p,k,C,y,w,O,S,x,M,P;function _(e,t){return t\|\|(t=e.slice(0)),Object.freeze(Object.defineProperties(e,{raw:{value:Object.freeze(t)}}))}function R(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}function I(e,t){for(var n=0;n<t.length;n++){var i=t[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(e,i.key,i)}}function j(e,t,n){return t&&I(e.prototype,t),n&&I(e,n),e}(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[8],{"4o01":function(f,m,g){"use strict";g.d(m,"a",function(){return U});var b=g("fXoL"),h=(g("EItx"),g("aFie")),v=g("Y9WU"),p=g("TFMq"),k=g("p20J"),C=g("l7P3"),y=g("UiDe"),w=g("CzQJ"),O=g("ttTl"),S=g("hlzJ"),x=g("IzEk"),M=g("ZjxN"),P=g("kl1M"),I=g("eNdF"),A=g("RQim"),z=g("ofXK"),F=function(e,t,n,i){return new(n\|\|(n=Promise))(function(o,a){function r(e){try{s(i.next(e))}catch(t){a(t)}}function c(e){try{s(i.throw(e))}catch(t){a(t)}}function s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\Google_logo_2[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 22 x 24, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	590
Entropy (8bit):	7.3465667702958415
Encrypted:	false
SSDEEP:	12:6v/7cJCWV7kn6ptXDOe88jVN1IScOLCMhk9OjfljEb9Z7:62p1S6rIO+MhJpjEJZ7
MD5:	EF8FEB03D5354D61D754D1CD8E3C2B2B
SHA1:	8F95415B238C8B5E2BCF1D9A34EB0E3153C3D10A
SHA-256:	73C2B0C50FF3DC73E093D8BCEC208DC2963C5D8BD1CF92FABC80C0DCDE9DBACC
SHA-512:	24E728BE6A9E34CF469C93BDC8451277884F043B507993A3ECF6EEC459E994373C4966FC6DFAF690FB282494ACFF670F2996799961A8B3EB28F0E06FD62387FE
Malicious:	false
IE Cache URL:	https://app.degoo.com/assets/icons/Google_logo_2.png
Preview:	.PNG........IHDR..............`.y....PLTE...K..D..H..E._.PA.C5.E6.K<5.T.D67.U7.VI..>.U[.n.D6...C..C.........E8.......F8E..8.U9.V9.V.E9.L?8.T.L>.H:K...%.JJ...../7.U......D6.D67.UD..:.VC..B...E8:.W.D8A...E9.F9.H9.......H:4.UN.lB..4.S.C5...@..>..6.fL.Kj.?.R/.f(.....!.Y....>tRNS...G%...#...;............xdTTFD9'...................}tgaa\6...6X....IDAT(.u..v.0.E..Q0.c....zIo........$..x.~<K3#.^.[..sF.1..-!.+.fT..., 6..~XPB_0..A.Zj...1=.Y]._[....1?.X.aO..7w..... .#........\|.%_^.Q'.mH..)#..F\|...\|......RZ..)s..S...n.......\|eZ...B=..I..b.B~.z...9E...b........Bf...@.9{R.O.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\KFOmCnqEu92Fr1Mu4mxM[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 20332, version 1.1
Category:	downloaded
Size (bytes):	20332
Entropy (8bit):	7.970235088150752
Encrypted:	false
SSDEEP:	384:U0iwaxoOUPVkOJJSu6SsCKTIRDqG9oHKwZh98OSv+MsgkAOY:75mlUmOSu1guh+fZhLSxkAr
MD5:	DC3E086FC0C5ADDC09702E111D2ADB42
SHA1:	B1138B84FF19EAC5F43C4202297529D389BD09B7
SHA-256:	EA50AC7FDDB61A5CE248A7F8B3A31A98FE16285E076B16E6DA6B4E10910724BB
SHA-512:	10123C785C396CF0844751A014413ECF4D058AD0C00CAAEF5F8FFEF504C370F03EACD0B3C2A49211EEE0877B7AE7D0EF6E01264F04FC910C2660584B5E943BE0
Malicious:	false
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxM.woff
Preview:	wOFF......Ol.......x........................GDEF.......G...d....GPOS...............!GSUB................OS/2...L...P...`t...cmap...............#cvt .......T...T+...fpgm.......5....w.`.gasp...@............glyf...L..;...m.&.x.hdmx..H....m....'/./head..H....6...6.j.zhhea..H.... ...$....hmtx..H...........]uloca..Kp..........m,maxp..Mp... ... .4..name..M........t.U9.post..N`....... .m.dprep..Nt.......I.f..x...1..P......PB..U.=l.@..C)..N4C.\.51.3.......q.q.qu.O...OjC.cA......R.x...l\..F..3...N..q)..a\|.....^..33..c......p"y.iT....<Gg...!.3...T1...{.g0.u.y........m.\|.k..NF......mox.;...7&.Y..C.R_[.T.c..-.=...9:...aj.G...............O.Q".6...>...(?...~...._.2:..K4....S%...jbr).........e.U..-..X.3.ILQ....z..!.f:...<.W.#...e.c=...&6...lc;;..3<.s<....H.i2..N..t..)Ns...#`..".).[...._.T..T.....+l..=..O.....Z..F...r..eM.f.Y.....-...r.\.s6.r..,...:.<$..#.l..F.$.2#.e..].[.....yR...e.\|{..O..`)..U.0.e.50.Z.b../cM..i.&O._..+.Y.W...;z....j.p._.o..[CL.)n'.UGx..>).X..MJ..Fr..v

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\TitlingFBGothicMedium[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, CFF, length 21380, version 1.0
Category:	downloaded
Size (bytes):	21380
Entropy (8bit):	7.9821387559424934
Encrypted:	false
SSDEEP:	384:atczh2okPmBw9GL7L4RokJfrZNTJEQi2qa+DBDuQm62P/TV6PPBh6v:aczh1keBX4VfrZwUmFDI6S6PP8
MD5:	E429B025EEDA50ED68971AC59CB11435
SHA1:	5282254D17451DF0780A596F1A0FAA5678372D77
SHA-256:	A81396DB3682116433678102B4D1FA739D791C53EBB0B730E3C72EB03C1A69E3
SHA-512:	72F3B935B1959AB3C86A1D2BFDF562A3BCC0F873E94AB53F20412E6CAE1B41A5D40D68BC5303DE1DFA7EF49D15AD096CE39CF45B31332C4C0FC2379A201CC8CB
Malicious:	false
IE Cache URL:	https://app.degoo.com/assets/fonts/TitlingFBGothicMedium.woff
Preview:	wOFFOTTO..S.......{.........................CFF ...(..2q..?....FFTM..P.........[o.?GDEF..:....9...B.!..GPOS..;.......(.`P.AGSUB..:..........OS/2.......V...`..D!cmap...d.......F$}.Ahead...0...3...6..}.hhea...d... ...$.E..hmtx..Q.........m.!7maxp..............P.name...........d<./.post........... .t..x.c`d``.b....6_..._.E....9...w..`......``....T..(.x.c`d``V.o.p..........."(.........P.....x.c`f.c.....................2001.1..(........^.P......~31+..`8.\|...P#H....... d...d....x...O..F....mm.,K.....9.Z.Z.l9k+!..vC.YB..!.I..e.H..B...B?B?I..Bo...O.C.@..'Y..n..JH.w..3....i.0.\|..f._.G..n..\..@s.7j....Vj6).S.:.........j..f.....5o...K.....+...M.U..[fb.7.{....g\..-..\.............M.j.h^..?./.....7.e...2..w.7.c..-.......w>.b...O.r...#.....c..J...v...b..C.J...H...f....V..).a..(-..4.$`.J.cN.@YKZ'..P6....L..<U.s........lz...Q)..i..n....YZ..Y...x....E<L.@..b....+.$[X.^.....,d>...?d.....}...d61g....(.1.L.l...b....q....AV..p.W.d..O.#9.g....Cj&....Y..N_......nV.JE=.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\favicon_round[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	6964
Entropy (8bit):	5.500549062706611
Encrypted:	false
SSDEEP:	192:Ataq3SSO3a66hgKRNjyIHbIKmAcu2Ge/WnKyeU80RG4J71n07r099:V4NjyIHkLA/2GeunKpU80g4vH
MD5:	529C70243CF7AE518B9B7CA329D9FC69
SHA1:	6132CCAC710D53F6B462403D20BA1BF555CF08D3
SHA-256:	F5659E4A0DB8E33EEEF9EF9A162287A89A014E91679670550A1B7AF2CF812287
SHA-512:	B0DEEA681DFD7C4A8E08FA5EA907FDD4DD653E0282D297731D2E542185180DA9853493E0087937A3197D203B93FC7371B5BEBFC073B962C0341E5612C0D5F6AD
Malicious:	false
Preview:	<!doctype html>..<html lang="en">..<head>..<meta charset="utf-8">..<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1.0, user-scalable=no">..<meta name="Description" content="Welcome to Degoo Web App. Expect more. Rediscover your memories with premium cloud storage. On Android, iOS and web.">..<meta name="msapplication-TileColor" content="#282525">..<meta name="msapplication-square70x70logo" content="assets/icons/ms-icon-70x70.png"/>..<meta name="msapplication-square144x144logo" content="assets/icons/ms-icon-144x144.png"/>..<meta name="msapplication-square150x150logo" content="assets/icons/ms-icon-150x150.png"/>..<meta name="msapplication-square310x310logo" content="assets/icons/ms-icon-310x310.png"/>..<meta name="theme-color" content="#282525">..<title>Degoo Cloud</title>..<base href="/">..<link href="assets/icons/favicon_round.ico" rel="icon" type="image/x-icon">..<link rel="manifest" href="manifest.webmanifest">..<link rel="preconnect" href="https://

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\js[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	258333
Entropy (8bit):	5.507197353433546
Encrypted:	false
SSDEEP:	3072:lcf22Ao0oRL51m7u/PBA+QD8Qb3oti0MWA0aO+75wu9kPT01ak8CWfC:KPJ3G+ZxFFMWCz5uyak8CW6
MD5:	3A42851C8C0E762BF754624D3ECE9236
SHA1:	922B63BFD16F8899934F0637110338A4BD29D6EB
SHA-256:	D4DB2BD5F1AB02211B731EE832CD07C0D78906A4546BEB9FF8F4A3E99054E748
SHA-512:	EFAC71E01A53586A8EDA2F1D031F677063D3BA73133899C7003F2A4E25AFC36250E42F8383F47E8FB0C4AA8B2457C98EF4435D5204BAA097D74D45C267646B4F
Malicious:	false
Preview:	.// Copyright 2012 Google Inc. All rights reserved..(function(){..var data = {."resource": {. "version":"1",. . "macros":[{. "function":"__e". },{. "function":"__c",. "vtp_value":"undefined". }],. "tags":[{. "function":"__rep",. "vtp_containerId":"UA-36877698-1",. "vtp_remoteConfig":["map"],. "tag_id":1. },{. "function":"__zone",. "vtp_childContainers":["list",["map","publicId","G-668MSHBNLB"]],. "tag_id":3. }],. "predicates":[{. "function":"_eq",. "arg0":["macro",0],. "arg1":"gtm.js". }],. "rules":[. [["if",0],["add",0,1]]].},."runtime":[].....};../.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var ca,da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ea=function(a){var b="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];return b?b.call(a):{next:da(a)}},fa="function"==typeof Object.create?Object.create:fun

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\js[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	326778
Entropy (8bit):	5.502225458140129
Encrypted:	false
SSDEEP:	3072:U3oti0MWA0aO+75wu9kPT016l8CWfl3oti0MWA0aj+75wu9kPT016l8CWfC:rMWCz5uy6l8CWAMWC+5uy6l8CW6
MD5:	ACC5165D7FBF3AEFF96687B607D71225
SHA1:	F4DD609D59FDCDA6DC194396759D6760A4EDCEE1
SHA-256:	FE43A07038324D3E652E771DE47C08561816927A0D2D1E1EC34D296DBCE429B7
SHA-512:	02516817789EAD2FB35E18CDDF92D5F294D9AB48ED73BC858E86D846F8B1335710AF3A5F227B09AE9E80187977C3C99E83574016E1277D086E3C16CDDE584D03
Malicious:	false
IE Cache URL:	https://www.googletagmanager.com/gtag/js?id=G-668MSHBNLB&l=dataLayer&cx=c
Preview:	.// Copyright 2012 Google Inc. All rights reserved..(function(){..var data = {."resource": {. "version":"1",. . "macros":[{. "function":"__e". },{. "vtp_signal":1,. "function":"__c",. "vtp_value":1. },{. "function":"__c",. "vtp_value":"google.de". },{. "function":"__c",. "vtp_value":0. },{. "function":"__aev",. "vtp_varType":"URL",. "vtp_component":"IS_OUTBOUND",. "vtp_affiliatedDomains":["list"]. },{. "function":"__v",. "vtp_name":"gtm.triggers",. "vtp_dataLayerVersion":2,. "vtp_setDefaultValue":true,. "vtp_defaultValue":"". },{. "function":"__v",. "vtp_name":"gtm.elementId",. "vtp_dataLayerVersion":1. },{. "function":"__v",. "vtp_name":"gtm.elementClasses",. "vtp_dataLayerVersion":1. },{. "function":"__aev",. "vtp_varType":"URL",. "vtp_component":"URL_NO_FRAGMENT". },{. "function":"__aev",. "vtp_varType":"URL",.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\js[3].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	94152
Entropy (8bit):	5.504503601041568
Encrypted:	false
SSDEEP:	1536:lcfFo2Ao0GfIo9OLrd1m4KC4l3Z0M5qPBFv7e+z/PBCrv38h1S9rRTFW/iG1:lcf22Ao0oOL51m7u/PBA+QD8QY
MD5:	0E169B34F335FFC53E838623A808BCCC
SHA1:	0B27C00EF029CC525C90CFB6DBC17B25D5D2B625
SHA-256:	DB3F7D288AC4D659078F9C76071D778E99867F824621A9DBDDD8F8C94B123AFE
SHA-512:	AAA30DADE5A35F94B1334980457D2723D2E60A65FDC9105A2128FF37671D6A15FA9A27DEF311AA07DF42771E9D7C06CD68FABAB34CB258A2141725CB2C55ABA2
Malicious:	false
Preview:	.// Copyright 2012 Google Inc. All rights reserved..(function(){..var data = {."resource": {. "version":"1",. . "macros":[{. "function":"__e". },{. "function":"__c",. "vtp_value":"undefined". }],. "tags":[{. "function":"__rep",. "vtp_containerId":"UA-36877698-1",. "vtp_remoteConfig":["map"],. "tag_id":1. },{. "function":"__zone",. "vtp_childContainers":["list",["map","publicId","G-668MSHBNLB"]],. "tag_id":3. }],. "predicates":[{. "function":"_eq",. "arg0":["macro",0],. "arg1":"gtm.js". }],. "rules":[. [["if",0],["add",0,1]]].},."runtime":[].....};../.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var ca,da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ea=function(a){var b="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];return b?b.call(a):{next:da(a)}},fa="function"==typeof Object.create?Object.create:fun

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\optimize[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	91181
Entropy (8bit):	5.492156220444456
Encrypted:	false
SSDEEP:	1536:dkfFo2Ah0GfIo9tLrd1m4KCDdM5qPH/PBOLdU8h1S9ezSDHVw1316PZw41:dkf22Ah0otL51mE/PIq8qmTVm
MD5:	C46F39D4EC6959DBF19661A108FDD718
SHA1:	B1C20253ED782EA189E20A3ECC596CBEED3CB752
SHA-256:	FB26826FCBEEF908D84AC6267E99BB9F9E536EA374909134D42FE2D4B3749A34
SHA-512:	720559A7099A0CEA0255419D9A86B64C5F0D6BD2BDC9983A05134A04278E7DF737B939ECE3F97BD3C0A5F860D3FB34ACF35837219ADB84438BDA2172262BA0A5
Malicious:	false
IE Cache URL:	https://www.googleoptimize.com/optimize.js?id=OPT-M5H55H5
Preview:	.// Copyright 2012 Google Inc. All rights reserved..(function(){..var data = {."resource": {. "version":"1",. . "macros":[{. "function":"__e". },{. "function":"__dee". }],. "tags":[{. "function":"__asprv",. "vtp_globalName":"google_optimize",. "tag_id":6. }],. "predicates":[{. "function":"_eq",. "arg0":["macro",0],. "arg1":["macro",1]. },{. "function":"_eq",. "arg0":["macro",0],. "arg1":"optimize.callback". }],. "rules":[. [["if",0],["add",0]],. [["if",1],["add",0]]].},."runtime":[].....};../.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var ca,da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ea=function(a){var b="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];return b?b.call(a):{next:da(a)}},fa="function"==typeof Object.create?Object.create:function(a){var b=function(){};b.prototype=a;return new b},ha;.if("fu

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\shared[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	6964
Entropy (8bit):	5.500549062706611
Encrypted:	false
SSDEEP:	192:Ataq3SSO3a66hgKRNjyIHbIKmAcu2Ge/WnKyeU80RG4J71n07r099:V4NjyIHkLA/2GeunKpU80g4vH
MD5:	529C70243CF7AE518B9B7CA329D9FC69
SHA1:	6132CCAC710D53F6B462403D20BA1BF555CF08D3
SHA-256:	F5659E4A0DB8E33EEEF9EF9A162287A89A014E91679670550A1B7AF2CF812287
SHA-512:	B0DEEA681DFD7C4A8E08FA5EA907FDD4DD653E0282D297731D2E542185180DA9853493E0087937A3197D203B93FC7371B5BEBFC073B962C0341E5612C0D5F6AD
Malicious:	false
IE Cache URL:	https://app.degoo.com/shared?_branch_match_id=936917171307723363
Preview:	<!doctype html>..<html lang="en">..<head>..<meta charset="utf-8">..<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1.0, user-scalable=no">..<meta name="Description" content="Welcome to Degoo Web App. Expect more. Rediscover your memories with premium cloud storage. On Android, iOS and web.">..<meta name="msapplication-TileColor" content="#282525">..<meta name="msapplication-square70x70logo" content="assets/icons/ms-icon-70x70.png"/>..<meta name="msapplication-square144x144logo" content="assets/icons/ms-icon-144x144.png"/>..<meta name="msapplication-square150x150logo" content="assets/icons/ms-icon-150x150.png"/>..<meta name="msapplication-square310x310logo" content="assets/icons/ms-icon-310x310.png"/>..<meta name="theme-color" content="#282525">..<title>Degoo Cloud</title>..<base href="/">..<link href="assets/icons/favicon_round.ico" rel="icon" type="image/x-icon">..<link rel="manifest" href="manifest.webmanifest">..<link rel="preconnect" href="https://

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\12-es5.9e028dd918a756fc4c4b[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	77295
Entropy (8bit):	5.414051663855039
Encrypted:	false
SSDEEP:	1536:4ab2z2xUoj5KHqwUgXkqFWjfFtNu+f/WHj+NiI/vw+9h+IGM0y/:4QXVFHA6HGM0y/
MD5:	CBFD9C21D0DBDC221CB4E17BBB7304DD
SHA1:	9F0D0367C139A19CFD2F3E5128BB42BF5BA97040
SHA-256:	85A4FC6DCB16CF14A8323AF1D5D1D5E890CA08ADBC0EBEE8FBF531C35CE6130A
SHA-512:	541C0D94E79DB26FC5144A9758C11AD2A402FF88634F6B5900DD961DD6747A20799FC3C8716BECFCF08B45C9A886A9D9869A67E713D0A3E925BB8618869DC420
Malicious:	false
IE Cache URL:	https://app.degoo.com/12-es5.9e028dd918a756fc4c4b.js
Preview:	!function(){var e,t,i,n,o,r,c,l,s,a,u;function d(e){return function(e){if(Array.isArray(e))return f(e)}(e)\|\|function(e){if("undefined"!=typeof Symbol&&Symbol.iterator in Object(e))return Array.from(e)}(e)\|\|h(e)\|\|function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function h(e,t){if(e){if("string"==typeof e)return f(e,t);var i=Object.prototype.toString.call(e).slice(8,-1);return"Object"===i&&e.constructor&&(i=e.constructor.name),"Map"===i\|\|"Set"===i?Array.from(e):"Arguments"===i\|\|/^(?:Ui\|I)nt(?:8\|16\|32)(?:Clamped)?Array$/.test(i)?f(e,t):void 0}}function f(e,t){(null==t\|\|t>e.length)&&(t=e.length);for(var i=0,n=new Array(t);i<t;i++)n[i]=e[i];return n}function g(e,t){return t\|\|(t=e.slice(0)),Object.freeze(Object.defineProperties(e,{raw:{value:Object.freeze(t)}}))}function m(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}function b(e,t){fo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\14-es5.d903d1b6d548f4167cfc[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	49617
Entropy (8bit):	5.159862824500279
Encrypted:	false
SSDEEP:	384:S5C1tYMDIYoOroUK3jjTLEacCciTeCoLkiiotAW4YMV6zm3YzrQYMyepYMMF7AYy:S5CLK31clCQ0CBI9aDw
MD5:	2F362E8E91389AF7F9BFCF64E466BAA2
SHA1:	91B5D6E47710DFE85E355A6B9272843A5D132F40
SHA-256:	E177CD150B497B5CF7969AEFC919B25FAFCD1B16C3689099EB76C1269D1BE9DD
SHA-512:	0E125DA9DCD6A0CCA14C65F843A2E3999D2FA9BC3BA72BB8BD8DC5FB0E8B7316BD32A757CFDDA882FA1628F424C686C4ACDA93EAAA1FB0ADE25F61D2EFF4BA5D
Malicious:	false
IE Cache URL:	https://app.degoo.com/14-es5.d903d1b6d548f4167cfc.js
Preview:	!function(){function t(t,n){if("function"!=typeof n&&null!==n)throw new TypeError("Super expression must either be null or a function");t.prototype=Object.create(n&&n.prototype,{constructor:{value:t,writable:!0,configurable:!0}}),n&&e(t,n)}function e(t,n){return(e=Object.setPrototypeOf\|\|function(t,e){return t.__proto__=e,t})(t,n)}function n(t){var e=function(){if("undefined"==typeof Reflect\|\|!Reflect.construct)return!1;if(Reflect.construct.sham)return!1;if("function"==typeof Proxy)return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],function(){})),!0}catch(t){return!1}}();return function(){var n,o=r(t);if(e){var u=r(this).constructor;n=Reflect.construct(o,arguments,u)}else n=o.apply(this,arguments);return i(this,n)}}function i(t,e){return!e\|\|"object"!=typeof e&&"function"!=typeof e?function(t){if(void 0===t)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return t}(t):e}function r(t){return(r=Object.setPrototypeOf?Object.g

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\15-es5.4baeca7b92c976c03886[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	144044
Entropy (8bit):	5.20570449569264
Encrypted:	false
SSDEEP:	1536:yCW8i0SN+m9WAoB05wJ51cjkFXH7O3aK9kxn+Th4rIQda4CWRr0jtQKsvdvd9TBj:xiY05w5PFXH7On9kwcOgLz
MD5:	CE60BAB1396B0053C19A1F47A141E76C
SHA1:	3A9FAA3361A6AFBB3E91A89FA59FFFCC9931647A
SHA-256:	EFB7A08E1D19199B1F2280AA6D4427460C7496895A199336C414756EEF201E52
SHA-512:	304AF38EDED26FA609185084F9EFF792F4679F223622DC095013818606614E045D24110C35990ADD9D0851CC1F5B1FD5004EE3C5761D5D2E4ACCAC27CE623D9D
Malicious:	false
IE Cache URL:	https://app.degoo.com/15-es5.4baeca7b92c976c03886.js
Preview:	!function(){var e,n,t,r;function i(e,n){return n\|\|(n=e.slice(0)),Object.freeze(Object.defineProperties(e,{raw:{value:Object.freeze(n)}}))}function o(e){return u(e)\|\|I(e)\|\|k(e)\|\|c()}function a(e,n){return u(e)\|\|function(e,n){if("undefined"==typeof Symbol\|\|!(Symbol.iterator in Object(e)))return;var t=[],r=!0,i=!1,o=void 0;try{for(var a,c=e[Symbol.iterator]();!(r=(a=c.next()).done)&&(t.push(a.value),!n\|\|t.length!==n);r=!0);}catch(u){i=!0,o=u}finally{try{r\|\|null==c.return\|\|c.return()}finally{if(i)throw o}}return t}(e,n)\|\|k(e,n)\|\|c()}function c(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}function u(e){if(Array.isArray(e))return e}function s(e,n,t){return n in e?Object.defineProperty(e,n,{value:t,enumerable:!0,configurable:!0,writable:!0}):e[n]=t,e}function l(e,n,t){return(l="undefined"!=typeof Reflect&&Reflect.get?Reflect.get:function(e,n,t){var r=function(e,n){for(;!Object

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\17-es5.3fdeef79cd23a7668d7a[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	77657
Entropy (8bit):	5.489478624916342
Encrypted:	false
SSDEEP:	1536:IML9IsU8IsLQdVifKsksQS0aOwz4DRN46:EdViuXZwz4DH
MD5:	1A2E5DAEF17428D1C0043F533FE6445B
SHA1:	11F5E3FB3A5F1E6398225C209B2D141017EBB33E
SHA-256:	17B4AF20E49E8E3D5D56CC821D4D23D501FD299135EB951E7E7623A0CDC0D28E
SHA-512:	1242307B79A8AE2C1617FA000AD7B4EEDE703EE89817EA3BB5A0FA5383B1D31015A18FCB540E93D600A04D6CBED39694DDF48D206E8853C35A0A129204DFCFD2
Malicious:	false
IE Cache URL:	https://app.degoo.com/17-es5.3fdeef79cd23a7668d7a.js
Preview:	!function(){var e,t,i,n,o,a,s,r,c,l,h,u,d,m,f,p,g,v,b,w,y,O,C;function k(e,t){var i;if("undefined"==typeof Symbol\|\|null==e[Symbol.iterator]){if(Array.isArray(e)\|\|(i=function(e,t){if(!e)return;if("string"==typeof e)return M(e,t);var i=Object.prototype.toString.call(e).slice(8,-1);"Object"===i&&e.constructor&&(i=e.constructor.name);if("Map"===i\|\|"Set"===i)return Array.from(e);if("Arguments"===i\|\|/^(?:Ui\|I)nt(?:8\|16\|32)(?:Clamped)?Array$/.test(i))return M(e,t)}(e))\|\|t&&e&&"number"==typeof e.length){i&&(e=i);var n=0,o=function(){};return{s:o,n:function(){return n>=e.length?{done:!0}:{done:!1,value:e[n++]}},e:function(e){throw e},f:o}}throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}var a,s=!0,r=!1;return{s:function(){i=e[Symbol.iterator]()},n:function(){var e=i.next();return s=e.done,e},e:function(e){r=!0,a=e},f:function(){try{s\|\|null==i.return\|\|i.return()}finally{if(r)throw a}}}}fun

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\177-es5.ee754a0892c1737c2278[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	29386
Entropy (8bit):	5.485623647761954
Encrypted:	false
SSDEEP:	384:oCib/GXDtiDKfiAeFafLbJOQ/eCK0KKGzChAzMSxmhDJYHLQYMrw:oCoGXBZVD/eCKnKiCWzMgmhDJYrQY/
MD5:	F446338DA5DEFF4516C402526CEDB765
SHA1:	29D416892F04B5BA2420AD4027C28BB3C6C92E24
SHA-256:	86034BC9FA198F00347554BC17A8551F6E4DF8A5535A8C4B25937B79CFB94FF6
SHA-512:	685255FF6E697985FD9BAFCBB2493470461AA72C042C9DAB2EEFF55046DD5D497C084A9B8C4F587A6AED085DD43871ABE8D95E83FD13C6E152CB860321EE5300
Malicious:	false
IE Cache URL:	https://app.degoo.com/177-es5.ee754a0892c1737c2278.js
Preview:	!function(){var e,t,n,i,o,c,r,a,l,s,d,u,f,b,h,p,g,v,m,k,I,y,w,x,C;function S(e,t){return t\|\|(t=e.slice(0)),Object.freeze(Object.defineProperties(e,{raw:{value:Object.freeze(t)}}))}function M(e,t){return function(e){if(Array.isArray(e))return e}(e)\|\|function(e,t){if("undefined"==typeof Symbol\|\|!(Symbol.iterator in Object(e)))return;var n=[],i=!0,o=!1,c=void 0;try{for(var r,a=e[Symbol.iterator]();!(i=(r=a.next()).done)&&(n.push(r.value),!t\|\|n.length!==t);i=!0);}catch(l){o=!0,c=l}finally{try{i\|\|null==a.return\|\|a.return()}finally{if(o)throw c}}return n}(e,t)\|\|F(e,t)\|\|function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function F(e,t){if(e){if("string"==typeof e)return O(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n\|\|"Set"===n?Array.from(e):"Arguments"===n\|\|/^(?:Ui\|I)nt(?:8\|16\|32)(?:Clamped)?

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\5-es5.ebc456adb57648fe8f8b[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	25295
Entropy (8bit):	5.340206373870099
Encrypted:	false
SSDEEP:	384:Qi+5SrvYrv2DOXPsTDB/PaP8/sVXa6uQFgP2tYbMSUdZlJoyYkxFWlXeTueoB:QTSrv+UOXPiJQFg6YfU1NPG
MD5:	04BE9131F6D4C4E812D1F1FAEB19EF0F
SHA1:	359000249B03CA5676433203BB3DA4D07F875222
SHA-256:	4051DB91A6E4366F4A0E9378B9F548B5220F879DC331F0E6070B1818C85A2FC5
SHA-512:	A48683634EE4BF365B6B24D40F220AB554EBB42C7A30382DE4708CA3979B6028478F18F6979AB64F1BD05842C362AA65724F9195BEDA38B79AC7F954D1E71C02
Malicious:	false
IE Cache URL:	https://app.degoo.com/5-es5.ebc456adb57648fe8f8b.js
Preview:	!function(){var e,t,n,i,o,r,a,s;function c(e,t){return(c=Object.setPrototypeOf\|\|function(e,t){return e.__proto__=t,e})(e,t)}function l(e){var t=function(){if("undefined"==typeof Reflect\|\|!Reflect.construct)return!1;if(Reflect.construct.sham)return!1;if("function"==typeof Proxy)return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],function(){})),!0}catch(e){return!1}}();return function(){var n,i=d(e);if(t){var o=d(this).constructor;n=Reflect.construct(i,arguments,o)}else n=i.apply(this,arguments);return u(this,n)}}function u(e,t){return!t\|\|"object"!=typeof t&&"function"!=typeof t?function(e){if(void 0===e)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return e}(e):t}function d(e){return(d=Object.setPrototypeOf?Object.getPrototypeOf:function(e){return e.__proto__\|\|Object.getPrototypeOf(e)})(e)}function f(e,t){return t\|\|(t=e.slice(0)),Object.freeze(Object.defineProperties(e,{raw:{value:Object.freeze(t)}}))}function h(e,t){if

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\9-es5.a9ffeb6b842090408bd4[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	29780
Entropy (8bit):	5.434996543883915
Encrypted:	false
SSDEEP:	384:FwumZWJg7CWB2EbM9lbenfip5CqFAinMkiH+0pKl4LdXEHMeU:FwuQUgw9Cq9gWTI
MD5:	A609EEC8438F3461A066416739AB73CB
SHA1:	98772D33D89E13A77C2C4BFEEB8A6FBD280F14B8
SHA-256:	9A181486B4650CD3DF3AB1C5B51543E6B2D3B4BF3067020041509B773836CF5A
SHA-512:	AFB67CDB6657364F0E0BD688F7FB9FE14354E9BAA8A5D001588464224893AD620897A155C6992D47881BD6A2B0E90C30E628C9237F3F4891142E00B16A826145
Malicious:	false
IE Cache URL:	https://app.degoo.com/9-es5.a9ffeb6b842090408bd4.js
Preview:	!function(){var e,n,t,i,r,o,s,a,c,l,u,d,h,g,f,b,m,v,p,k,C,O,S;function y(e,n){return n\|\|(n=e.slice(0)),Object.freeze(Object.defineProperties(e,{raw:{value:Object.freeze(n)}}))}function w(e,n){if(!(e instanceof n))throw new TypeError("Cannot call a class as a function")}function _(e,n){for(var t=0;t<n.length;t++){var i=n[t];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(e,i.key,i)}}function x(e,n,t){return n&&_(e.prototype,n),t&&_(e,t),e}(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[9],{"b+he":function(S,_,P){"use strict";P.d(_,"a",function(){return Oe});var M=P("fXoL"),R=P("Tra1"),I=P("Vjhi"),j=P("aFie"),A=P("IzEk"),z=P("p20J"),L=P("TFMq"),T=P("Y9WU"),$=P("kl1M"),G=P("l7P3"),q=P("quSY"),F=P("ZjxN"),W=P("hlzJ"),U=P("8HAE"),N=P("dV0J"),B=P("eNdF"),E=P("CzQJ"),H=P("RQim"),D=P("I2id"),J=P("/WZB"),X=P("ofXK"),Q=P("3Pt+"),Y=P("ddPx");function Z(e,n){if(1&e&&(M.Sb(0,"p",6),M.Hc(1),M.Rb()),2&e){var t=M.ic();M.Cb(1),M.Ic(null==t.user?nu

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\analytics[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	49377
Entropy (8bit):	5.521008419138659
Encrypted:	false
SSDEEP:	768:/yR3fYFBCwsNDsP5XqY0TyPnHpl1TY3SoavyVv6PU+CgYUD0lgEw0stZK:/y9g1r5h0UHp/Y3SowCw0sy
MD5:	042B7183D8645F5CF9D0D6ACD5FF8358
SHA1:	447A98467EA31E253ECB63EE8564C8B5E1E77D58
SHA-256:	73D6A5EA11FB7BF6E6A6CCD44B1635D52C79B0A00623D0387C9DDDD4B7C68E89
SHA-512:	72AA2F221BB5EFEC3A9C0CBC2D01DEBD827361369F7E84AA613D4CA70838FF68EA2C3300167FB263A4F416A857BABF0354A1FF8B3EC669BF88452633981CA18F
Malicious:	false
IE Cache URL:	https://www.google-analytics.com/analytics.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self,p=function(a,b){a=a.split(".");var c=n;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};var q={},r=function(){q.TAGGING=q.TAGGING\|\|[];q.TAGGING[1]=!0};var t=function(a,b){for(var c in b)b.hasOwnProperty(c)&&(a[c]=b[c])},v=function(a){for(var b in a)if(a.hasOwnProperty(b))return!0;return!1};var x=/^(?:(?:https?\|mailto\|ftp):\|[^:/?#]*(?:[/?#]\|$))/i;var y=window,z=document,A=function(a,b){z.addEventListener?z.addEventListener(a,b,!1):z.attachEvent&&z.attachEvent("on"+a,b)};var B=/:[0-9]+$/,C=function(a,b,c){a=a.split("&");for(var d=0;d<a.length;d++){var e=a[d].split("=");if(decodeURIComponent(e[0]).replace(/\+/g," ")===b)return b=e.slice(1).join("="),c?b:decodeURIComponent(b).replace(/\+/g," ")}},F=function(a,b){b&&(b=String(b).toLowerCase());if("p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\baseline-add-24px[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	173
Entropy (8bit):	4.925402030564298
Encrypted:	false
SSDEEP:	3:tIsqDmJS4RKb5zMcBH8+hHiATcvXjXRHoNcHxIjIRLZV4+H4VNX1X3MHq09i:tI9mc4slzXdhC/O4U8rBSmK0Y
MD5:	CA3EFBF7E05BF999CF240B6CC2B75305
SHA1:	0DFC4CAAA410E38EFAC74A7C3D197F01DD4FDDD5
SHA-256:	CF891879DA78CEBA1A652F8C915A7569C29E46EE57896FAE8A681397AAF8E23A
SHA-512:	2F720976020E65C035B6F09176E8AD7B484F5043EEB1FB31BE8D2ACE6A244511084BCE282446C4D7622F25CA14FA711D8A9DE852E3119026CC37C09EBDA3E781
Malicious:	false
IE Cache URL:	https://app.degoo.com/assets/icons/baseline-add-24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"><path d="M19 13h-6v6h-2v-6H5v-2h6V5h2v6h6v2z"/><path d="M0 0h24v24H0z" fill="none"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\polyfills-es2015.04cb6cf2b00bfa357ac4[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	40184
Entropy (8bit):	5.232755590009762
Encrypted:	false
SSDEEP:	768:WHA8/V1qlMojI046ppiJtuNvErQuVWWUbnAmAt64nXGT/06ktxr2VukMwgPviz34:pMojlyVXbUitOT8
MD5:	FD725ADC68FC96A112431D0B21C8C4A9
SHA1:	5482E0CD4B62ED17675C6F62CC8A48AFC660442D
SHA-256:	35BED25C213352B180AFBBDDAE115F0CBC4A66FBA65DB68412EA1A7A28B65290
SHA-512:	9A2F0A1B5A6C18C298213651EDA2CF6E190D86C50B90952EBA5797C6E00CA7008F6DD1F4BA6F61724F3D2B8FC3BC746805D99C3630217E03AFB57545E39FD609
Malicious:	false
IE Cache URL:	https://app.degoo.com/polyfills-es2015.04cb6cf2b00bfa357ac4.js
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[157],{2:function(e,t,n){e.exports=n("hN/g")},"N/DB":function(e,t){const n="undefined"!=typeof globalThis&&globalThis,o="undefined"!=typeof window&&window,r="undefined"!=typeof self&&"undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope&&self,s="undefined"!=typeof global&&global,a=function(e,...t){if(a.translate){const n=a.translate(e,t);e=n[0],t=n[1]}let n=i(e[0],e.raw[0]);for(let o=1;o<e.length;o++)n+=t[o-1]+i(e[o],e.raw[o]);return n};function i(e,t){return":"===t.charAt(0)?e.substring(function(e,t){for(let n=1,o=1;n<e.length;n++,o++)if("\\"===t[o])o++;else if(":"===e[n])return n;throw new Error(`Unterminated $localize metadata block in "${t}".`)}(e,t)+1):e}(n\|\|s\|\|o\|\|r).$localize=a},eefC:function(e,t){self.fetch\|\|(self.fetch=function(e,t){return t=t\|\|{},new Promise(function(n,o){var r=new XMLHttpRequest,s=[],a=[],i={},c=function(){return{ok:2==(r.status/100\|0),statusText:r.statusText,status:r.status,url:r.response

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\runtime-es2015.2d1a57c7b33e86d357e7[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	6968
Entropy (8bit):	5.125308827579331
Encrypted:	false
SSDEEP:	96:EAt5pX/fLcDj12yMWpQY/v+wGPuhWB5yHNLuOxPGy9uQGpZlfaHzTxrvX6lZo:pJ/fgLvQYX0GA5epoQ4fy6lZo
MD5:	87039FBB6B2BCAD6BA2B772588022970
SHA1:	971B65C86561EB4D7964FF7962A09EA045D78096
SHA-256:	F6DCCAE9128F2A47483A03E07E663704F9AFF89FDC1814B930E82FFE5365B310
SHA-512:	E6F2B914D119C4D7DBDB11D1248DD34E9D03A2034F326A2F2936C503C9B4EAA1955D93E5DBA28B7CE73B2D8DB659CDBB662C85F68256C8D5E72240FCCE88FED4
Malicious:	false
IE Cache URL:	https://app.degoo.com/runtime-es2015.2d1a57c7b33e86d357e7.js
Preview:	!function(e){function d(d){for(var c,r,t=d[0],n=d[1],o=d[2],i=0,l=[];i<t.length;i++)r=t[i],Object.prototype.hasOwnProperty.call(f,r)&&f[r]&&l.push(f[r][0]),f[r]=0;for(c in n)Object.prototype.hasOwnProperty.call(n,c)&&(e[c]=n[c]);for(u&&u(d);l.length;)l.shift()();return b.push.apply(b,o\|\|[]),a()}function a(){for(var e,d=0;d<b.length;d++){for(var a=b[d],c=!0,t=1;t<a.length;t++)0!==f[a[t]]&&(c=!1);c&&(b.splice(d--,1),e=r(r.s=a[0]))}return e}var c={},f={20:0},b=[];function r(d){if(c[d])return c[d].exports;var a=c[d]={i:d,l:!1,exports:{}};return e[d].call(a.exports,a,a.exports,r),a.l=!0,a.exports}r.e=function(e){var d=[],a=f[e];if(0!==a)if(a)d.push(a[2]);else{var c=new Promise(function(d,c){a=f[e]=[d,c]});d.push(a[2]=c);var b,t=document.createElement("script");t.charset="utf-8",t.timeout=120,r.nc&&t.setAttribute("nonce",r.nc),t.src=function(e){return r.p+""+({0:"common"}[e]\|\|e)+"-es2015."+{0:"e76a48dd0ae2eec1803e",1:"fb77717eef84a855f24e",2:"511349fb0dc623a7f5f1",3:"6fafd7d5e2c855df19ba",4:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\styles.16a5ddeeaf4886b9be82[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	5446
Entropy (8bit):	5.047719788553925
Encrypted:	false
SSDEEP:	96:ybZheHvkoueLwdcaMAmB0ynE8MQoqUIjBg52Hyb6icqmsevoMt:yeHlLwdcaMAa0ynEWoTAO52Hyb6iJmsE
MD5:	DEB0824D1A81E7F734C948C6C54127DB
SHA1:	D400CF1449FEC2BE9D7A5386A6DA0380236734C8
SHA-256:	9C3A93E27A9CAFE277D4465B37951DE4B484B49D764ACE07B9DBD7F6E6612E56
SHA-512:	2920DF72CA957462B9D0DCD2AD5D0919DA480388CD36C4BAE4A77E59B668CA41EB9DEAEF41C0794D62B3E4D468ED3B0785AA8ECE40FC49A578D8B00888CEA7CE
Malicious:	false
IE Cache URL:	https://app.degoo.com/styles.16a5ddeeaf4886b9be82.css
Preview:	a,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,em,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,object,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,textarea,tfoot,th,thead,time,tr,tt,u,ul,var,video{margin:0;padding:0;border:0;font-size:inherit;font:inherit;font-family:Roboto,Arial,Helvetica,sans-serif;vertical-align:baseline}article,aside,details,figcaption,figure,footer,header,hgroup,menu,nav,section{display:block}body{line-height:1.4}ol,ul{list-style:none}blockquote,q{quotes:none}blockquote:after,blockquote:before,q:after,q:before{content:"";content:none}table{border-collapse:collapse;border-spacing:0}h1,h2,h3,h4,h5,h6{font-family:TitlingGothic,Roboto,Arial,Helvetica,sans-serif;line-height:1.1}::-webkit-scrollbar{width:.5em;height:.5rem}::-webkit-scrollbar-track{bac

C:\Users\user\AppData\Local\Temp\~DF4EB2E14E4B4E1C0D.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13077
Entropy (8bit):	0.5005986283627486
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9loPm9loPW9lWPc4qOB:kBqoIPBPHPc4l
MD5:	AA0DE884435A476A833B63EC3F97D376
SHA1:	75A730FFCD6A6AE18B29EBDFD1C4E9AF4F7B34EB
SHA-256:	4511FCF870DF32C4007857927C8E55683AB2A79E62C966C366F2A78042ED34C8
SHA-512:	01C9650F3CB8EF153D9E13E99D735C70F3CC45D1EF2ADD92E362E3D00E82BDC20B79CA514DB8354E7498DB51E68A45D09CA7770E0015FD31E4BAF6F070964A24
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF573CD1B95D483DA3.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	25441
Entropy (8bit):	0.27918767598683664
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lRx/9lRJ9lTb9lTb9lSSU9lSSU9laAa/9laA:kBqoxxJhHWSVSEab
MD5:	AB889A32AB9ACD33E816C2422337C69A
SHA1:	1190C6B34DED2D295827C2A88310D10A8B90B59B
SHA-256:	4D6EC54B8D244E63B0F04FBE2B97402A3DF722560AD12F218665BA440F4CEFDA
SHA-512:	BD250855747BB4CEC61814D0E44F810156D390E3E9F120A12935EFDF80ACA33C4777AD66257CCA4E4003FEF0741692894980B9298F01C4CDD2D8A9C7BB522FB6
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF70FA6F493C9B0CC3.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	81775
Entropy (8bit):	1.0992348170534751
Encrypted:	false
SSDEEP:	384:kBqoxKEYobwuUe8HXOyGXhJ+vy2p64xCcyTY2c6nk:BJ6nk
MD5:	2530609CDBF5A3B89B14E83595EA6CF9
SHA1:	322ACD62CEEAFE89BDDC96CD4A26FC1728E77940
SHA-256:	593ABDECE3B851D91E18BCF49B8507D402487EAEF56EDBFBE3A2E8BDFB566C91
SHA-512:	8D26610C3250109E34EBC006F1FB0C8C09045D692104BAC5148E682ACA325DFB7722E096CDC17465D8A461FDA1D034C163D6A30459F55D059D3205AB3F000743
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PDF document, version 1.7
Entropy (8bit):	7.903708595076054
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Updated Invoices.pdf
File size:	123871
MD5:	25f75ef8f84476257dfac7668b0925d8
SHA1:	b6895d09fb2ae7cf44c703791c7ba8d8b52daf32
SHA256:	193ed0025b1d72c693b96e1cde2936645aba62398ebfe8380d87b93e32d98e67
SHA512:	faf415f5b5729c3faeb54363e8b468662b1be5f90b74e3799dfe38f19067607529122a0da9ffbb812d1d252a90874362468cc0d253dc3b0737263e0002657bf5
SSDEEP:	3072:I12L97ibRx06Jv/eBI2rq+Fv/PyWwxYtK+b:I12Lhe7QI2/FvyWRKw
File Content Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en-US) /StructTreeRoot 37 0 R/MarkInfo<</Marked true>>/Metadata 98 0 R/ViewerPreferences 99 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 1/Kids[ 3 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0

File Icon


Icon Hash:	74ecccdcd4ccccf0

Static PDF Info

General
Header:	%PDF-1.7
Total Entropy:	7.903709
Total Bytes:	123871
Stream Entropy:	7.968781
Stream Bytes:	110978
Entropy outside Streams:	0.000000
Bytes outside Streams:	12893
Number of EOF found:	2
Bytes after EOF:

Keywords Statistics

Name	Count
obj	51
endobj	51
stream	16
endstream	16
xref	2
trailer	2
startxref	2
/Page	1
/Encrypt	0
/ObjStm	1
/URI	14
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5
25	f0c4bae8f0b2ccf0	05bb48d6a4b15875fb0f28fa7f1a045a
26	f0c0b2c0c0b2c0f0	0d2a0b281a8663a27a1f23ee38e5c526
28	f0ccb2b2b2b2d4f0	6cde1002d66337e05ce5b481be8c3919
29	f0c0b2c0c0b2c0f0	0d2a0b281a8663a27a1f23ee38e5c526
31	f0c4aae8a8b2c4f0	1d7f77ee8539ed0b6d7cb8e253a21895
32	f0c0b2c0c0b2c0f0	0d2a0b281a8663a27a1f23ee38e5c526
34	f0ccaae8e0a2ccf0	3ae50111570fa329f740f6388b8f0daf
35	f0c0b2c0c0b2c0f0	0d2a0b281a8663a27a1f23ee38e5c526

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 25, 2021 12:24:46.236676931 CEST	49731	443	192.168.2.5	52.52.240.3
Jun 25, 2021 12:24:46.237091064 CEST	49730	443	192.168.2.5	52.52.240.3
Jun 25, 2021 12:24:46.435642004 CEST	443	49731	52.52.240.3	192.168.2.5
Jun 25, 2021 12:24:46.436117887 CEST	49731	443	192.168.2.5	52.52.240.3
Jun 25, 2021 12:24:46.436505079 CEST	443	49730	52.52.240.3	192.168.2.5
Jun 25, 2021 12:24:46.436645031 CEST	49730	443	192.168.2.5	52.52.240.3
Jun 25, 2021 12:24:46.454041958 CEST	49731	443	192.168.2.5	52.52.240.3
Jun 25, 2021 12:24:46.454206944 CEST	49730	443	192.168.2.5	52.52.240.3
Jun 25, 2021 12:24:46.652951956 CEST	443	49731	52.52.240.3	192.168.2.5
Jun 25, 2021 12:24:46.653583050 CEST	443	49730	52.52.240.3	192.168.2.5
Jun 25, 2021 12:24:46.656352043 CEST	443	49730	52.52.240.3	192.168.2.5
Jun 25, 2021 12:24:46.656369925 CEST	443	49730	52.52.240.3	192.168.2.5
Jun 25, 2021 12:24:46.656378031 CEST	443	49730	52.52.240.3	192.168.2.5
Jun 25, 2021 12:24:46.656522036 CEST	49730	443	192.168.2.5	52.52.240.3
Jun 25, 2021 12:24:46.658019066 CEST	443	49731	52.52.240.3	192.168.2.5
Jun 25, 2021 12:24:46.658037901 CEST	443	49731	52.52.240.3	192.168.2.5
Jun 25, 2021 12:24:46.658051014 CEST	443	49731	52.52.240.3	192.168.2.5
Jun 25, 2021 12:24:46.659153938 CEST	49731	443	192.168.2.5	52.52.240.3
Jun 25, 2021 12:24:46.763381958 CEST	49730	443	192.168.2.5	52.52.240.3
Jun 25, 2021 12:24:46.763385057 CEST	49731	443	192.168.2.5	52.52.240.3
Jun 25, 2021 12:24:46.774843931 CEST	49731	443	192.168.2.5	52.52.240.3
Jun 25, 2021 12:24:46.964234114 CEST	443	49731	52.52.240.3	192.168.2.5
Jun 25, 2021 12:24:46.964339972 CEST	49731	443	192.168.2.5	52.52.240.3
Jun 25, 2021 12:24:46.964629889 CEST	443	49730	52.52.240.3	192.168.2.5
Jun 25, 2021 12:24:46.964807034 CEST	49730	443	192.168.2.5	52.52.240.3
Jun 25, 2021 12:24:47.003886938 CEST	443	49731	52.52.240.3	192.168.2.5
Jun 25, 2021 12:24:47.003987074 CEST	49731	443	192.168.2.5	52.52.240.3
Jun 25, 2021 12:24:47.093306065 CEST	49732	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.093606949 CEST	49733	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.132544994 CEST	443	49733	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.132646084 CEST	49733	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.133338928 CEST	49733	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.133414984 CEST	443	49732	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.133492947 CEST	49732	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.143681049 CEST	49732	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.173403025 CEST	443	49733	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.173517942 CEST	443	49733	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.173536062 CEST	443	49733	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.173552036 CEST	443	49733	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.173721075 CEST	49733	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.173734903 CEST	49733	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.175746918 CEST	443	49733	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.175767899 CEST	443	49733	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.175812006 CEST	49733	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.175842047 CEST	49733	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.183864117 CEST	443	49732	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.184077978 CEST	443	49732	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.184101105 CEST	443	49732	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.184117079 CEST	443	49732	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.184149027 CEST	49732	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.184176922 CEST	49732	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.186120987 CEST	443	49732	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.186137915 CEST	443	49732	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.186187983 CEST	49732	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.193591118 CEST	49733	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.193658113 CEST	49732	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.194713116 CEST	49732	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.194819927 CEST	49733	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.195305109 CEST	49732	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.232901096 CEST	443	49733	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.233191013 CEST	443	49733	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.233205080 CEST	443	49733	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.233246088 CEST	49733	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.233270884 CEST	49733	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.233851910 CEST	443	49733	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.233927965 CEST	443	49733	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.233982086 CEST	49733	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.234039068 CEST	49733	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.234123945 CEST	443	49732	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.234496117 CEST	443	49732	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.234529018 CEST	443	49732	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.234549999 CEST	49732	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.234576941 CEST	49732	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.235130072 CEST	443	49732	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.235301018 CEST	443	49732	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.235352993 CEST	49732	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.235517025 CEST	49732	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.235826969 CEST	443	49732	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.274492979 CEST	443	49733	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.276401043 CEST	443	49732	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.424544096 CEST	443	49732	13.224.193.100	192.168.2.5
Jun 25, 2021 12:24:47.424614906 CEST	49732	443	192.168.2.5	13.224.193.100
Jun 25, 2021 12:24:47.505187988 CEST	49734	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.505388975 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.543342113 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.543363094 CEST	443	49734	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.543442011 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.543488979 CEST	49734	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.544594049 CEST	49734	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.544658899 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.582607031 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.582631111 CEST	443	49734	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.585813046 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.585843086 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.585891008 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.585905075 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.591233015 CEST	443	49734	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.591262102 CEST	443	49734	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.591310978 CEST	49734	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.591348886 CEST	49734	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.608584881 CEST	49734	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.608711004 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.609169960 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.609308958 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.609343052 CEST	49734	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.646811962 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.646857977 CEST	443	49734	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.646971941 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.647052050 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.647063971 CEST	443	49734	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.647144079 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.647159100 CEST	443	49734	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.647192001 CEST	49734	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.647217989 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.647242069 CEST	443	49734	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.647274017 CEST	49734	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.647284031 CEST	443	49734	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.647341967 CEST	49734	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.648051977 CEST	49734	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.648089886 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.648164034 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.648264885 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.686177969 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.686216116 CEST	443	49734	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.687361956 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.687383890 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.687413931 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.687437057 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.689528942 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.836647987 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.836839914 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.836966038 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.837042093 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.837116003 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.837186098 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.837280989 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.874861002 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.875684977 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.899277925 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.899327040 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.899363995 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.899403095 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.899427891 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.899681091 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.899734020 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.899764061 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.899807930 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.899837017 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.900163889 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.900207043 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.900283098 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.901036978 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.901113987 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.901796103 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.901825905 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.901874065 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.901890039 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.901983023 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.902010918 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.902066946 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.902460098 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.902499914 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.902533054 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.902565002 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.903322935 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.903366089 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.903445005 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.904211044 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.904251099 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.904282093 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.904310942 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.905107021 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.905148029 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.905209064 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.905239105 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.906024933 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.906064987 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.906095982 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.906122923 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.906866074 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.906913996 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.906939983 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.906964064 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.907795906 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.907835007 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.907857895 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.907888889 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.909357071 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.909394026 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.909413099 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.909444094 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.911782980 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.911819935 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.911890030 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.913796902 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.913835049 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.913853884 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.913889885 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.914608955 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.914648056 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.914664984 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.914705992 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.914721966 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.914766073 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.937655926 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.937702894 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.937741995 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.937853098 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.937968016 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.938553095 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.938596010 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.938682079 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.938833952 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.939469099 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.939508915 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.939590931 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.940345049 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.940387011 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.940434933 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.940522909 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.941209078 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.941250086 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.941284895 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.941338062 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.942117929 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.942159891 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.942207098 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.942269087 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.942990065 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.943027973 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.943080902 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.943133116 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.943922043 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.943964005 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.943998098 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.944029093 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.944847107 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.944895029 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.944972038 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.945655107 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.945703030 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.945719957 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.945770979 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.946578026 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.946636915 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.946675062 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.946736097 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.947416067 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.947448015 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.947491884 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.947519064 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.948379040 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.948414087 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.948456049 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.948489904 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.949279070 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.949306965 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.949342012 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.949372053 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.950095892 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.950125933 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.950160027 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.950190067 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.950956106 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.950984001 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.951019049 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.951046944 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.951847076 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.951874018 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.951910973 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.951941013 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.952724934 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.952756882 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.952785015 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.952812910 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.953612089 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.953636885 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.953674078 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.953701973 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.954531908 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.954565048 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.954595089 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.954622984 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.955420971 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.955451965 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.955612898 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.956543922 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.956566095 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.956608057 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.956640959 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.957169056 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.957231045 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.957268000 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.957648993 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.958065033 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.958103895 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.958137035 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.958163023 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.958986998 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.959024906 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.959088087 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.976692915 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.976761103 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.976830006 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.976874113 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.977050066 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.977103949 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.977166891 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.977844954 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.977984905 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.978194952 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.978359938 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.978598118 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.978657007 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.978984118 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.979053974 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.979367971 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.979715109 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.979793072 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.980125904 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.980210066 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.980557919 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.980632067 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.980884075 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.980947971 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.981245041 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.981312037 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.981617928 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.981677055 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.982240915 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.982300997 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.982419014 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.982820988 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.982882977 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.983201981 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.983268023 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.983804941 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.983860016 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.983926058 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.984970093 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.985061884 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.985110998 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.985163927 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.985521078 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.985578060 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.985920906 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.985982895 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.986411095 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.986475945 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.986685038 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.986743927 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.987169981 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.987241983 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.987713099 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.988197088 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.988274097 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.988373041 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.988430023 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.989322901 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.989391088 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.989464045 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.989603043 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.989856005 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.990246058 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.990310907 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.990911007 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.990977049 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.991080999 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.991209984 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.991480112 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.991575956 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.991833925 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.991897106 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.992628098 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.992691994 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.992758989 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.992820024 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.993808985 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.993937969 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.994040012 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.994085073 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.994129896 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.994143009 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.994184017 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.994452953 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.994508028 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.994724035 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.994785070 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.995182991 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.995254040 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.995634079 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.995949030 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.996011972 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.996073008 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.996140003 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.996197939 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.996988058 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.997046947 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:47.997060061 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:47.997102976 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.014902115 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.014995098 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.015069962 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.015119076 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.015182018 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.015260935 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.015328884 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.015929937 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.016016960 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.016061068 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.016124964 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.016305923 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.016360044 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.016374111 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.016415119 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.016422033 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.016613960 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.017077923 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.017153978 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.017157078 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.017213106 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.017220020 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.017268896 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.017798901 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.017852068 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.017868996 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.017901897 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.017904043 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.017952919 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.018578053 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.018639088 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.018699884 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.018701077 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.018755913 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.019354105 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.019411087 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.019416094 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.019459009 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.019459963 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.019509077 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.020163059 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.020219088 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.020226955 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.020268917 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.020270109 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.020322084 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.020908117 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.020962954 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.020978928 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.021012068 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.021013021 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.021065950 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.021693945 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.021744967 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.021794081 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.021817923 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.021840096 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.022453070 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.022512913 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.022517920 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.022567987 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.022572994 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.022629023 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.023288012 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.023339987 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.023354053 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.023387909 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.023390055 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.023447990 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.024009943 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.024064064 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.024113894 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.024147034 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.024184942 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.024779081 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.024838924 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.024899006 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.024900913 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.024950981 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.025557995 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.025603056 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.025655031 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.025671005 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.025681019 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.025784016 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.026314020 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.026374102 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.026381969 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.026441097 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.026463032 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.026504993 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.027112007 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.027209044 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.027225971 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.027259111 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.027261972 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.027318001 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.027853012 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.027899027 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.027935028 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.027945042 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.027951956 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.028054953 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.028717995 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.028765917 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.028811932 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.028846979 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.028867006 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.028872967 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.029392004 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.029441118 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.029460907 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.029486895 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.029496908 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.029536963 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.030155897 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.030205011 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.030219078 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.030251026 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.030266047 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.030302048 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.030901909 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.030949116 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.030992985 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.031018972 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.031054020 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.031723022 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.031778097 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.031822920 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.031836987 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.031877995 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.032457113 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.032511950 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.032567024 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.032581091 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.032618999 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.033233881 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.033282995 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.033329010 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.033343077 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.033379078 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.034147024 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.034200907 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.034255981 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.034262896 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.034307957 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.034765005 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.034820080 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.034833908 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.034874916 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.034878016 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.034926891 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.035510063 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.035558939 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.035582066 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.035603046 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.035604954 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.035659075 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.036310911 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.036360979 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.036374092 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.036406994 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.036406994 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.036456108 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.037020922 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.037066936 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.037081003 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.037108898 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.037115097 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.037163019 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.037830114 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.037880898 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.037898064 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.037930965 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.037931919 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.037985086 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.038547993 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.038598061 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.038618088 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.038640976 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.038650036 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.038701057 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.039287090 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.039331913 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.039345980 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.039376020 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.039382935 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.040010929 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.040061951 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.040069103 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.040103912 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.040150881 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.040174007 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.040777922 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.040837049 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.445421934 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.448133945 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.487865925 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.515691042 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.515729904 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.515777111 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.515830040 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.515845060 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.515866041 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.515888929 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.515896082 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.515913963 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.532764912 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.532828093 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.532852888 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.532866001 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.532891035 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.532910109 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.619834900 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.683976889 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.684043884 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.684093952 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.690962076 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.766710997 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.766910076 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.767087936 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.767544031 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.767864943 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.768045902 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.768248081 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.768402100 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.768556118 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.770193100 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.770554066 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.771910906 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.774914980 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.781430960 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.795378923 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.796164989 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.796729088 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.797056913 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.804886103 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.805572987 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.805994034 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.806447029 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.810628891 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.819763899 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.828636885 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.828696012 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.828744888 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.828752995 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.828777075 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.828797102 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.828804970 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.828846931 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.828857899 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.828896046 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.828907967 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.828974009 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.829035997 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.829118967 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.829181910 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.829195976 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.829195976 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.829248905 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.829257011 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.829302073 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.829323053 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.829380989 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.829407930 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.829478979 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.829667091 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.829735041 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.829755068 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.829816103 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.829859018 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.829895020 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.829909086 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.829952955 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.829978943 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.830004930 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.830080032 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.830585003 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.830640078 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.830673933 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.830689907 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.830707073 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.830740929 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.830748081 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.830790997 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.830791950 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.830840111 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.830841064 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.830888987 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.831417084 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.831486940 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.831521988 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.831537962 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.831588030 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.831595898 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.831636906 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.831643105 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.831686974 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.831703901 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.831748009 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.832349062 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.832400084 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.832436085 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.832449913 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.832467079 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.832499981 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.832549095 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.832561970 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.832591057 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.832602978 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.832709074 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.833240032 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.833297014 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.833316088 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.833345890 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.833358049 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.833389997 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.833425999 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.833434105 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.833475113 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.833482981 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.833498955 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.833585024 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.834098101 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.834144115 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.834187984 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.834203005 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.834225893 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.834276915 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.834312916 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.834376097 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.834383011 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.834429979 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.834501028 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.834527016 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.835011005 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.835098028 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.835176945 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.835239887 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.835243940 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.835295916 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.835309029 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.835386992 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.835418940 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.835489035 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.835493088 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.835546970 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.835880995 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.835974932 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.836040974 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.836049080 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.836106062 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.836110115 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.836154938 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.836167097 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.836200953 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.836239100 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.836297989 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.836313963 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.836363077 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.836745977 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.836811066 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.836863041 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.836894989 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.836913109 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.836914062 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.836966038 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.836971045 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.837019920 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.837055922 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.837110043 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.837112904 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.837163925 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.837680101 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.837779045 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.837826967 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.837867975 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.837877989 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.837899923 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.837910891 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.837950945 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.837954044 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.837965012 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.838356972 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.838534117 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.838613033 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.838712931 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.838777065 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.838783026 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.838794947 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.838850975 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.838907957 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.838920116 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.838973045 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.839293003 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.839391947 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.839409113 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.839456081 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.839457035 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.839555025 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.839572906 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.839632988 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.839633942 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.839684963 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.839719057 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.839781046 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.840106010 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.840157986 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.840173960 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.840205908 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.840209961 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.840260029 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.840260983 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.840311050 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.840312004 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.840361118 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.840365887 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.840415001 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.840985060 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.841031075 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.841072083 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.841094971 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.841114998 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.841140985 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.841156006 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.841182947 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.841197014 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.841207027 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.841243029 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.841856003 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.841901064 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.841943026 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.841984987 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.841991901 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.842027903 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.842027903 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.842063904 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.842091084 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.842096090 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.842178106 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.842751980 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.842813969 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.842817068 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.842864990 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.842896938 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.842919111 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.842925072 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.842974901 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.843024969 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.843030930 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.843108892 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.849019051 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.849040031 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.849066019 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.849096060 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.849123955 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.849133015 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.849153042 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.849174976 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.849201918 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.849442959 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.849462032 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.849495888 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.849524021 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.849533081 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.849553108 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.849581003 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.849587917 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.849611998 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.849649906 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.850326061 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.850354910 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.850379944 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.850445986 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.850713968 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.850780010 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.852883101 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.852901936 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.852922916 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.852960110 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.852992058 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.863241911 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.863313913 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.863384008 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.863390923 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.863430977 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.863451958 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.863481045 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.863508940 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.863564968 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.863632917 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.863677979 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.863678932 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.863711119 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.863717079 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.863734961 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.863801956 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.871999025 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.872061968 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.872095108 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.872117043 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.872128010 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.872159958 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.872210026 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.872222900 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.872252941 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.872266054 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.872317076 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.872415066 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.872467995 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.872484922 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.872524977 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.872531891 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.872574091 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.872589111 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.872615099 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.872658968 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.872687101 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.873074055 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.873135090 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.873145103 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.873225927 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.873248100 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.873305082 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.873339891 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.873348951 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.873390913 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.873414040 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.873430014 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.873469114 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.873472929 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.873529911 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.874049902 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.874103069 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.874167919 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.874176025 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.874232054 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.874238014 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.874289989 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.874341011 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.874353886 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.874418020 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.874890089 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.874949932 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.874974966 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.875006914 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.875016928 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.875065088 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.875278950 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.875330925 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.875353098 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.875387907 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.875406027 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.875464916 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.875502110 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.875516891 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.875523090 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.875566006 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.875580072 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.875647068 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.876252890 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.876307964 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.876341105 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.876358986 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.876389980 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.876410007 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.876424074 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.876461983 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.876466036 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.876504898 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.876529932 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.876575947 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.877033949 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:48.877856016 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:48.892164946 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:48.922360897 CEST	49741	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:48.938786030 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:48.939547062 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:48.968391895 CEST	443	49741	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:48.968488932 CEST	49741	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:48.979325056 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.003957033 CEST	49741	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.026434898 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.035629988 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.035685062 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.035698891 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.035734892 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.035736084 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.035778046 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.035826921 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.048274040 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.048927069 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.049876928 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.051218033 CEST	443	49741	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.058507919 CEST	443	49741	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.058604002 CEST	49741	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.058613062 CEST	443	49741	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.058681965 CEST	443	49741	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.058693886 CEST	49741	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.058737040 CEST	443	49741	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.058811903 CEST	49741	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.076913118 CEST	49741	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.077363014 CEST	49741	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.096579075 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.096632957 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.096679926 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.096708059 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.096811056 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.097529888 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.097563028 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.104125023 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.112319946 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.112379074 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.112437963 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.112456083 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.112488985 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.112499952 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.112617970 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.115699053 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.115751982 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.115847111 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.119024038 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.119066954 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.119179010 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.122308969 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.122364044 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.122481108 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.122514963 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.124646902 CEST	443	49741	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.124706984 CEST	443	49741	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.124739885 CEST	49741	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.125384092 CEST	443	49741	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.125461102 CEST	49741	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.125624895 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.125659943 CEST	49741	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.125693083 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.144488096 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.144553900 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.144630909 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.146066904 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.146121025 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.146200895 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.149389982 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.149446964 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.149564981 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.149574995 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.160758972 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.160821915 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.160897017 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.162484884 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.162539959 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.162548065 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.162599087 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.165692091 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.165771961 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.165857077 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.169003963 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.169059038 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.169141054 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.172306061 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.172358990 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.172511101 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.175606966 CEST	443	49741	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.175666094 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.175704956 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.175944090 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.177789927 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:24:49.231282949 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:24:49.272929907 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.328072071 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.328133106 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.328248978 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.466773987 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.468115091 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.497741938 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.497912884 CEST	49742	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.506222963 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.522634983 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.522665977 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.522686958 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.522711039 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.522739887 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.522763968 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.522788048 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.522800922 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.522814035 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.522845030 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.522851944 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.522855997 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.523030043 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.523056030 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.523088932 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.523097038 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.523108006 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.523123026 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.523144960 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.523154974 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.523166895 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.523183107 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.523531914 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.523557901 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.523581028 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.523601055 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.523622990 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.523623943 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.523639917 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.523643970 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.523664951 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.523667097 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.523685932 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.523685932 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.523705006 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.523730040 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.524461985 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.524482965 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.524508953 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.524548054 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.524569035 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.528795004 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.528821945 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.528845072 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.528862953 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.528866053 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.528887033 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.528887987 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.528907061 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.528927088 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.528928995 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.528949022 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.528950930 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.528970957 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.528981924 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.529273033 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.529289961 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.529315948 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.529335976 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.529336929 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.529356003 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.529357910 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.529375076 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.529382944 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.529808044 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.529824972 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.529846907 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.529869080 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.529881001 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.529891014 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.529916048 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.529921055 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.529937983 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.529942036 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.529958963 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.529961109 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.529987097 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.530002117 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.530729055 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.530745029 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.530771017 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.530810118 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.530831099 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.535744905 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.535840034 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.536062956 CEST	443	49742	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.536129951 CEST	49742	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.569601059 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.569842100 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.570601940 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.570779085 CEST	49742	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.609692097 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.609949112 CEST	443	49742	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.610313892 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.616189003 CEST	443	49742	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.616281986 CEST	443	49742	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.616363049 CEST	49742	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.616547108 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.616615057 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.616647005 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.616693974 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.620665073 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.621118069 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.621273994 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.621381044 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.624876022 CEST	49742	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.625283957 CEST	49742	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.628628969 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.628684998 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.628741026 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.628777027 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.637307882 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.637352943 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.637392998 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.637433052 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.648838997 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.650309086 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.658616066 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.658905029 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.658931971 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.658962965 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.658999920 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.659029961 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.659106016 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.659215927 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.661729097 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.662933111 CEST	443	49742	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.663129091 CEST	443	49742	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.663172960 CEST	443	49742	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.663213968 CEST	49742	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.663244009 CEST	49742	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.663294077 CEST	443	49742	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.663337946 CEST	443	49742	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.663391113 CEST	49742	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.664585114 CEST	49742	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.689981937 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.701584101 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.725388050 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.725440025 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.725471020 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.725502014 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.725509882 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.725573063 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.725580931 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.725644112 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.725646973 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.725708008 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.725713015 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.725773096 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.725779057 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.725837946 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.725843906 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.725903034 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.726021051 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.726069927 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.726119995 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.726128101 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.726178885 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.726188898 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.726239920 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.726250887 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.726298094 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.726346016 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.726407051 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.726424932 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.726469994 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.726496935 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.726561069 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.726564884 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.726623058 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.737906933 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.737951994 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.737994909 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.738008022 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.738043070 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.738054037 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.738058090 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.738111019 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.738111973 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.738176107 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.738182068 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.738234997 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.738236904 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.738291979 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.738291979 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.738348007 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.738348961 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.738403082 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.738404989 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.738459110 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.738461971 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.738512993 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.738516092 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.738563061 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.738581896 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.738619089 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.738657951 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.738703966 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.738725901 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.738764048 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.738766909 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.738818884 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.738852978 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.738876104 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.738923073 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.744347095 CEST	443	49742	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.832514048 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.832583904 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.908171892 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.947587013 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.951085091 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.952064037 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:49.970999002 CEST	49752	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:49.971111059 CEST	49751	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:49.989074945 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:49.989871025 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:50.024308920 CEST	443	49751	74.125.140.156	192.168.2.5
Jun 25, 2021 12:24:50.024410963 CEST	49751	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:50.025042057 CEST	443	49752	74.125.140.156	192.168.2.5
Jun 25, 2021 12:24:50.025202990 CEST	49752	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:50.039505005 CEST	49752	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:50.039546967 CEST	49751	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:50.052440882 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:50.052510977 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:50.056580067 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:50.056791067 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:50.057010889 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:50.092885017 CEST	443	49751	74.125.140.156	192.168.2.5
Jun 25, 2021 12:24:50.093202114 CEST	443	49751	74.125.140.156	192.168.2.5
Jun 25, 2021 12:24:50.093218088 CEST	443	49751	74.125.140.156	192.168.2.5
Jun 25, 2021 12:24:50.093235970 CEST	443	49751	74.125.140.156	192.168.2.5
Jun 25, 2021 12:24:50.093333960 CEST	49751	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:50.093379974 CEST	49751	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:50.093549013 CEST	443	49752	74.125.140.156	192.168.2.5
Jun 25, 2021 12:24:50.093995094 CEST	443	49752	74.125.140.156	192.168.2.5
Jun 25, 2021 12:24:50.094011068 CEST	443	49752	74.125.140.156	192.168.2.5
Jun 25, 2021 12:24:50.094033003 CEST	443	49752	74.125.140.156	192.168.2.5
Jun 25, 2021 12:24:50.094100952 CEST	49752	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:50.094126940 CEST	49752	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:50.094468117 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:50.094547033 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:50.094830036 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:50.105221033 CEST	49752	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:50.105396986 CEST	49751	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:50.105618954 CEST	49752	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:50.105797052 CEST	49752	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:50.105906963 CEST	49751	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:50.158854961 CEST	443	49751	74.125.140.156	192.168.2.5
Jun 25, 2021 12:24:50.158869028 CEST	443	49751	74.125.140.156	192.168.2.5
Jun 25, 2021 12:24:50.158945084 CEST	49751	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:50.159136057 CEST	443	49751	74.125.140.156	192.168.2.5
Jun 25, 2021 12:24:50.159233093 CEST	49751	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:50.159496069 CEST	443	49752	74.125.140.156	192.168.2.5
Jun 25, 2021 12:24:50.159571886 CEST	443	49752	74.125.140.156	192.168.2.5
Jun 25, 2021 12:24:50.159606934 CEST	49752	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:50.159640074 CEST	49752	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:50.159651041 CEST	443	49752	74.125.140.156	192.168.2.5
Jun 25, 2021 12:24:50.159706116 CEST	49752	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:50.159938097 CEST	49751	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:50.160284996 CEST	49752	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:50.160903931 CEST	443	49752	74.125.140.156	192.168.2.5
Jun 25, 2021 12:24:50.160988092 CEST	49752	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:50.161287069 CEST	49752	443	192.168.2.5	74.125.140.156
Jun 25, 2021 12:24:50.216655016 CEST	443	49752	74.125.140.156	192.168.2.5
Jun 25, 2021 12:24:50.219369888 CEST	443	49751	74.125.140.156	192.168.2.5
Jun 25, 2021 12:24:50.375675917 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:50.375690937 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:50.375770092 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:50.380654097 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:50.380667925 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:50.380760908 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:50.384386063 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:50.422244072 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:50.436217070 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:50.438905954 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:50.477374077 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:50.495085001 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:50.495096922 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:50.495266914 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:50.508800983 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:50.508811951 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:50.509594917 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:50.545687914 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:50.545816898 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:50.551040888 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:50.551063061 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:50.551573038 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:50.590462923 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:50.590537071 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:50.590955019 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:50.743968964 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:50.743997097 CEST	443	49743	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:50.747587919 CEST	49743	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:51.594259024 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:51.595762014 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:51.637583017 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.656296015 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.656363964 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.656388998 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.656435013 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.656472921 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:51.656490088 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.656511068 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:51.656528950 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:51.656541109 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.656585932 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:51.656590939 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.656605959 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:51.656642914 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.656687021 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:51.656693935 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.656743050 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.656780958 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:51.656791925 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.656841993 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.656878948 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:51.656883001 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.657215118 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.657260895 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:51.657273054 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.657335043 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.657370090 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:51.657383919 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.657793999 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:51.660770893 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.660829067 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.660888910 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.660948038 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.661007881 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.661016941 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:51.661052942 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:51.661067963 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.661113977 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:51.661118984 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.661166906 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:24:51.661209106 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:24:51.663217068 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:25:13.239343882 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:25:13.304923058 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:25:13.304971933 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:25:13.305001974 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:25:13.305028915 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:25:13.305258989 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:25:14.251494884 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:25:14.254040003 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:25:14.295011044 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:25:14.337610006 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:25:14.337749004 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:25:14.414933920 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:25:14.415036917 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:25:14.434411049 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:25:14.482161045 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:25:14.491580963 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:25:14.491611958 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:25:14.491647005 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:25:14.491667032 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:25:14.491704941 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:25:14.491712093 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:25:14.494510889 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:25:14.547193050 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:25:16.037938118 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:25:16.098325968 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:25:16.098368883 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:25:16.098413944 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:25:16.098443031 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:25:16.110416889 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:25:16.188602924 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:25:16.188652039 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:25:16.188693047 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:25:16.188731909 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:25:18.057014942 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:25:18.135950089 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:25:18.256957054 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:25:18.256985903 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:25:18.256994009 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:25:18.257236958 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:25:19.339770079 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:25:19.346820116 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:25:19.379244089 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:25:19.387253046 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:25:19.417792082 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:25:19.418059111 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:25:19.425745964 CEST	443	49735	104.18.229.238	192.168.2.5
Jun 25, 2021 12:25:19.425930023 CEST	49735	443	192.168.2.5	104.18.229.238
Jun 25, 2021 12:25:19.458633900 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:25:19.507240057 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:25:19.514822960 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:25:19.514842987 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:25:19.514930964 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:25:19.514940977 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:25:19.514987946 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:25:19.514995098 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:25:19.525371075 CEST	49740	443	192.168.2.5	142.250.186.78
Jun 25, 2021 12:25:19.578968048 CEST	443	49740	142.250.186.78	192.168.2.5
Jun 25, 2021 12:25:46.636843920 CEST	443	49730	52.52.240.3	192.168.2.5
Jun 25, 2021 12:25:46.636885881 CEST	443	49730	52.52.240.3	192.168.2.5
Jun 25, 2021 12:25:46.637177944 CEST	49730	443	192.168.2.5	52.52.240.3
Jun 25, 2021 12:25:46.904154062 CEST	443	49731	52.52.240.3	192.168.2.5
Jun 25, 2021 12:25:46.904625893 CEST	49731	443	192.168.2.5	52.52.240.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 25, 2021 12:23:15.236845016 CEST	62060	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:15.282900095 CEST	53	62060	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:15.473572016 CEST	61805	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:15.539997101 CEST	53	61805	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:15.582638979 CEST	54795	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:15.640264988 CEST	53	54795	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:16.121810913 CEST	49557	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:16.182364941 CEST	53	49557	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:17.495711088 CEST	61733	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:17.543318033 CEST	53	61733	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:17.765554905 CEST	65447	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:17.832762003 CEST	53	65447	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:18.657619953 CEST	52441	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:18.704708099 CEST	53	52441	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:19.845810890 CEST	62176	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:19.898140907 CEST	53	62176	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:20.755163908 CEST	59596	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:20.802839041 CEST	53	59596	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:21.565179110 CEST	65296	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:21.611535072 CEST	53	65296	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:23.525203943 CEST	63183	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:23.572168112 CEST	53	63183	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:25.303153992 CEST	60151	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:25.359549999 CEST	53	60151	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:26.694317102 CEST	56969	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:26.749146938 CEST	53	56969	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:27.897233009 CEST	55161	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:27.943413973 CEST	53	55161	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:39.153740883 CEST	54757	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:39.212517023 CEST	53	54757	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:39.480999947 CEST	49992	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:39.538491964 CEST	53	49992	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:40.159410000 CEST	54757	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:40.218810081 CEST	53	54757	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:40.505474091 CEST	49992	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:40.561903000 CEST	53	49992	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:41.206716061 CEST	54757	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:41.264061928 CEST	53	54757	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:41.552474976 CEST	49992	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:41.608685970 CEST	53	49992	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:43.252789021 CEST	54757	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:43.312572002 CEST	53	54757	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:43.553088903 CEST	49992	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:43.610418081 CEST	53	49992	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:43.956691980 CEST	60075	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:44.032250881 CEST	53	60075	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:47.309277058 CEST	54757	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:47.367137909 CEST	53	54757	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:47.559449911 CEST	49992	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:47.607394934 CEST	53	49992	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:49.503216028 CEST	55016	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:49.566721916 CEST	53	55016	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:50.905764103 CEST	64345	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:50.923089027 CEST	57128	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:50.932435036 CEST	54791	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:23:50.961189032 CEST	53	64345	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:50.971278906 CEST	53	57128	8.8.8.8	192.168.2.5
Jun 25, 2021 12:23:50.980483055 CEST	53	54791	8.8.8.8	192.168.2.5
Jun 25, 2021 12:24:29.802274942 CEST	50463	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:24:29.859285116 CEST	53	50463	8.8.8.8	192.168.2.5
Jun 25, 2021 12:24:31.862524033 CEST	50394	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:24:31.933682919 CEST	53	50394	8.8.8.8	192.168.2.5
Jun 25, 2021 12:24:33.487442970 CEST	58530	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:24:33.548141003 CEST	53	58530	8.8.8.8	192.168.2.5
Jun 25, 2021 12:24:43.407295942 CEST	53813	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:24:43.477513075 CEST	53	53813	8.8.8.8	192.168.2.5
Jun 25, 2021 12:24:44.486887932 CEST	63732	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:24:44.545034885 CEST	53	63732	8.8.8.8	192.168.2.5
Jun 25, 2021 12:24:44.562221050 CEST	57344	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:24:44.631257057 CEST	53	57344	8.8.8.8	192.168.2.5
Jun 25, 2021 12:24:46.141294956 CEST	54450	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:24:46.197415113 CEST	53	54450	8.8.8.8	192.168.2.5
Jun 25, 2021 12:24:47.029400110 CEST	59261	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:24:47.089592934 CEST	53	59261	8.8.8.8	192.168.2.5
Jun 25, 2021 12:24:47.438646078 CEST	57151	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:24:47.498528957 CEST	53	57151	8.8.8.8	192.168.2.5
Jun 25, 2021 12:24:48.075213909 CEST	59413	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:24:48.137389898 CEST	53	59413	8.8.8.8	192.168.2.5
Jun 25, 2021 12:24:48.728790045 CEST	51649	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:24:48.759852886 CEST	65086	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:24:48.779716969 CEST	53	51649	8.8.8.8	192.168.2.5
Jun 25, 2021 12:24:48.828950882 CEST	53	65086	8.8.8.8	192.168.2.5
Jun 25, 2021 12:24:49.413407087 CEST	56432	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:24:49.471930981 CEST	53	56432	8.8.8.8	192.168.2.5
Jun 25, 2021 12:24:49.868146896 CEST	52929	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:24:49.881951094 CEST	64317	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:24:49.891736031 CEST	61004	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:24:49.902790070 CEST	56895	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:24:49.937711000 CEST	53	61004	8.8.8.8	192.168.2.5
Jun 25, 2021 12:24:49.948983908 CEST	53	56895	8.8.8.8	192.168.2.5
Jun 25, 2021 12:24:49.951280117 CEST	53	52929	8.8.8.8	192.168.2.5
Jun 25, 2021 12:24:49.953562975 CEST	53	64317	8.8.8.8	192.168.2.5
Jun 25, 2021 12:24:56.481746912 CEST	62372	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:24:56.547337055 CEST	53	62372	8.8.8.8	192.168.2.5
Jun 25, 2021 12:25:08.523072958 CEST	61515	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:25:08.575681925 CEST	53	61515	8.8.8.8	192.168.2.5
Jun 25, 2021 12:25:10.318085909 CEST	56675	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:25:10.389561892 CEST	53	56675	8.8.8.8	192.168.2.5
Jun 25, 2021 12:25:11.079677105 CEST	57172	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:25:11.139950991 CEST	53	57172	8.8.8.8	192.168.2.5
Jun 25, 2021 12:25:14.474858046 CEST	55267	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:25:14.522842884 CEST	53	55267	8.8.8.8	192.168.2.5
Jun 25, 2021 12:25:15.515599966 CEST	55267	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:25:15.565083981 CEST	53	55267	8.8.8.8	192.168.2.5
Jun 25, 2021 12:25:15.626355886 CEST	50969	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:25:15.679223061 CEST	53	50969	8.8.8.8	192.168.2.5
Jun 25, 2021 12:25:16.660108089 CEST	50969	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:25:16.663921118 CEST	55267	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:25:16.713361025 CEST	53	50969	8.8.8.8	192.168.2.5
Jun 25, 2021 12:25:16.714566946 CEST	53	55267	8.8.8.8	192.168.2.5
Jun 25, 2021 12:25:17.693016052 CEST	50969	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:25:17.745682001 CEST	53	50969	8.8.8.8	192.168.2.5
Jun 25, 2021 12:25:18.724327087 CEST	55267	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:25:18.776251078 CEST	53	55267	8.8.8.8	192.168.2.5
Jun 25, 2021 12:25:19.737267971 CEST	50969	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:25:19.786808968 CEST	53	50969	8.8.8.8	192.168.2.5
Jun 25, 2021 12:25:22.766273022 CEST	55267	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:25:22.814393044 CEST	53	55267	8.8.8.8	192.168.2.5
Jun 25, 2021 12:25:23.822982073 CEST	50969	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:25:23.872798920 CEST	53	50969	8.8.8.8	192.168.2.5
Jun 25, 2021 12:25:58.393682003 CEST	64362	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:25:58.448566914 CEST	53	64362	8.8.8.8	192.168.2.5
Jun 25, 2021 12:25:59.051239967 CEST	54766	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:25:59.114873886 CEST	53	54766	8.8.8.8	192.168.2.5
Jun 25, 2021 12:25:59.602498055 CEST	61446	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:25:59.667850971 CEST	53	61446	8.8.8.8	192.168.2.5
Jun 25, 2021 12:26:00.057858944 CEST	57515	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:26:00.122692108 CEST	53	57515	8.8.8.8	192.168.2.5
Jun 25, 2021 12:26:00.594683886 CEST	58199	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:26:00.651381016 CEST	53	58199	8.8.8.8	192.168.2.5
Jun 25, 2021 12:26:01.107889891 CEST	65221	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:26:01.161040068 CEST	53	65221	8.8.8.8	192.168.2.5
Jun 25, 2021 12:26:01.568706036 CEST	61573	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:26:01.631242990 CEST	53	61573	8.8.8.8	192.168.2.5
Jun 25, 2021 12:26:02.204978943 CEST	56562	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:26:02.267065048 CEST	53	56562	8.8.8.8	192.168.2.5
Jun 25, 2021 12:26:02.915539026 CEST	53591	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:26:02.976146936 CEST	53	53591	8.8.8.8	192.168.2.5
Jun 25, 2021 12:26:03.401611090 CEST	59688	53	192.168.2.5	8.8.8.8
Jun 25, 2021 12:26:03.464684963 CEST	53	59688	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 25, 2021 12:24:33.487442970 CEST	192.168.2.5	8.8.8.8	0xcfc8	Standard query (0)	degoo.com	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:44.562221050 CEST	192.168.2.5	8.8.8.8	0xd1c9	Standard query (0)	cloud.degoo.com	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:46.141294956 CEST	192.168.2.5	8.8.8.8	0x1559	Standard query (0)	cloud.degoo.com	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:47.029400110 CEST	192.168.2.5	8.8.8.8	0x9129	Standard query (0)	s82i.app.link	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:47.438646078 CEST	192.168.2.5	8.8.8.8	0xc951	Standard query (0)	app.degoo.com	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:48.759852886 CEST	192.168.2.5	8.8.8.8	0xf98b	Standard query (0)	www.googleoptimize.com	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:49.413407087 CEST	192.168.2.5	8.8.8.8	0xdbe1	Standard query (0)	rest-api.degoo.com	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:49.881951094 CEST	192.168.2.5	8.8.8.8	0xc33e	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:49.891736031 CEST	192.168.2.5	8.8.8.8	0x5ff7	Standard query (0)	www.google.de	A (IP address)	IN (0x0001)
Jun 25, 2021 12:25:11.079677105 CEST	192.168.2.5	8.8.8.8	0x3d1a	Standard query (0)	app.degoo.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jun 25, 2021 12:24:29.859285116 CEST	8.8.8.8	192.168.2.5	0xf77c	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Jun 25, 2021 12:24:33.548141003 CEST	8.8.8.8	192.168.2.5	0xcfc8	No error (0)	degoo.com		104.18.228.238	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:33.548141003 CEST	8.8.8.8	192.168.2.5	0xcfc8	No error (0)	degoo.com		104.18.229.238	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:44.631257057 CEST	8.8.8.8	192.168.2.5	0xd1c9	No error (0)	cloud.degoo.com	custom.bnc.lt		CNAME (Canonical name)	IN (0x0001)
Jun 25, 2021 12:24:44.631257057 CEST	8.8.8.8	192.168.2.5	0xd1c9	No error (0)	custom.bnc.lt		52.52.240.3	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:44.631257057 CEST	8.8.8.8	192.168.2.5	0xd1c9	No error (0)	custom.bnc.lt		204.236.162.77	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:44.631257057 CEST	8.8.8.8	192.168.2.5	0xd1c9	No error (0)	custom.bnc.lt		13.57.121.49	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:44.631257057 CEST	8.8.8.8	192.168.2.5	0xd1c9	No error (0)	custom.bnc.lt		52.52.151.150	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:44.631257057 CEST	8.8.8.8	192.168.2.5	0xd1c9	No error (0)	custom.bnc.lt		52.8.226.158	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:44.631257057 CEST	8.8.8.8	192.168.2.5	0xd1c9	No error (0)	custom.bnc.lt		13.57.44.146	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:44.631257057 CEST	8.8.8.8	192.168.2.5	0xd1c9	No error (0)	custom.bnc.lt		13.56.57.255	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:44.631257057 CEST	8.8.8.8	192.168.2.5	0xd1c9	No error (0)	custom.bnc.lt		13.56.71.158	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:46.197415113 CEST	8.8.8.8	192.168.2.5	0x1559	No error (0)	cloud.degoo.com	custom.bnc.lt		CNAME (Canonical name)	IN (0x0001)
Jun 25, 2021 12:24:46.197415113 CEST	8.8.8.8	192.168.2.5	0x1559	No error (0)	custom.bnc.lt		52.52.240.3	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:46.197415113 CEST	8.8.8.8	192.168.2.5	0x1559	No error (0)	custom.bnc.lt		204.236.162.77	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:46.197415113 CEST	8.8.8.8	192.168.2.5	0x1559	No error (0)	custom.bnc.lt		13.57.121.49	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:46.197415113 CEST	8.8.8.8	192.168.2.5	0x1559	No error (0)	custom.bnc.lt		52.52.151.150	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:46.197415113 CEST	8.8.8.8	192.168.2.5	0x1559	No error (0)	custom.bnc.lt		52.8.226.158	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:46.197415113 CEST	8.8.8.8	192.168.2.5	0x1559	No error (0)	custom.bnc.lt		13.57.44.146	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:46.197415113 CEST	8.8.8.8	192.168.2.5	0x1559	No error (0)	custom.bnc.lt		13.56.57.255	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:46.197415113 CEST	8.8.8.8	192.168.2.5	0x1559	No error (0)	custom.bnc.lt		13.56.71.158	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:47.089592934 CEST	8.8.8.8	192.168.2.5	0x9129	No error (0)	s82i.app.link		13.224.193.100	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:47.089592934 CEST	8.8.8.8	192.168.2.5	0x9129	No error (0)	s82i.app.link		13.224.193.44	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:47.089592934 CEST	8.8.8.8	192.168.2.5	0x9129	No error (0)	s82i.app.link		13.224.193.104	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:47.089592934 CEST	8.8.8.8	192.168.2.5	0x9129	No error (0)	s82i.app.link		13.224.193.82	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:47.498528957 CEST	8.8.8.8	192.168.2.5	0xc951	No error (0)	app.degoo.com		104.18.229.238	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:47.498528957 CEST	8.8.8.8	192.168.2.5	0xc951	No error (0)	app.degoo.com		104.18.228.238	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:48.828950882 CEST	8.8.8.8	192.168.2.5	0xf98b	No error (0)	www.googleoptimize.com		142.250.186.78	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:49.471930981 CEST	8.8.8.8	192.168.2.5	0xdbe1	No error (0)	rest-api.degoo.com		104.18.229.238	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:49.471930981 CEST	8.8.8.8	192.168.2.5	0xdbe1	No error (0)	rest-api.degoo.com		104.18.228.238	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:49.937711000 CEST	8.8.8.8	192.168.2.5	0x5ff7	No error (0)	www.google.de		142.250.184.227	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:49.953562975 CEST	8.8.8.8	192.168.2.5	0xc33e	No error (0)	stats.g.doubleclick.net	stats.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)
Jun 25, 2021 12:24:49.953562975 CEST	8.8.8.8	192.168.2.5	0xc33e	No error (0)	stats.l.doubleclick.net		74.125.140.156	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:49.953562975 CEST	8.8.8.8	192.168.2.5	0xc33e	No error (0)	stats.l.doubleclick.net		74.125.140.154	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:49.953562975 CEST	8.8.8.8	192.168.2.5	0xc33e	No error (0)	stats.l.doubleclick.net		74.125.140.157	A (IP address)	IN (0x0001)
Jun 25, 2021 12:24:49.953562975 CEST	8.8.8.8	192.168.2.5	0xc33e	No error (0)	stats.l.doubleclick.net		74.125.140.155	A (IP address)	IN (0x0001)
Jun 25, 2021 12:25:11.139950991 CEST	8.8.8.8	192.168.2.5	0x3d1a	No error (0)	app.degoo.com		104.18.228.238	A (IP address)	IN (0x0001)
Jun 25, 2021 12:25:11.139950991 CEST	8.8.8.8	192.168.2.5	0x3d1a	No error (0)	app.degoo.com		104.18.229.238	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jun 25, 2021 12:24:46.656369925 CEST	52.52.240.3	443	192.168.2.5	49730	CN=cloud.degoo.com CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Mon Apr 26 18:33:47 CEST 2021 Wed Oct 07 21:21:40 CEST 2020	Sun Jul 25 18:33:47 CEST 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 25, 2021 12:24:46.656369925 CEST	52.52.240.3	443	192.168.2.5	49730	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		9e10692f1b7f78228b2d4e424db3a98c
Jun 25, 2021 12:24:46.658037901 CEST	52.52.240.3	443	192.168.2.5	49731	CN=cloud.degoo.com CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Mon Apr 26 18:33:47 CEST 2021 Wed Oct 07 21:21:40 CEST 2020	Sun Jul 25 18:33:47 CEST 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 25, 2021 12:24:46.658037901 CEST	52.52.240.3	443	192.168.2.5	49731	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		9e10692f1b7f78228b2d4e424db3a98c
Jun 25, 2021 12:24:47.175746918 CEST	13.224.193.100	443	192.168.2.5	49733	CN=appipv4.link CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Thu Jun 24 02:00:00 CEST 2021 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sun Jul 24 01:59:59 CEST 2022 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jun 25, 2021 12:24:47.186120987 CEST	13.224.193.100	443	192.168.2.5	49732	CN=appipv4.link CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Thu Jun 24 02:00:00 CEST 2021 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sun Jul 24 01:59:59 CEST 2022 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jun 25, 2021 12:24:47.585843086 CEST	104.18.229.238	443	192.168.2.5	49735	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Fri Aug 07 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Sat Aug 07 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 25, 2021 12:24:47.585843086 CEST	104.18.229.238	443	192.168.2.5	49735	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jun 25, 2021 12:24:47.591262102 CEST	104.18.229.238	443	192.168.2.5	49734	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Fri Aug 07 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Sat Aug 07 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 25, 2021 12:24:47.591262102 CEST	104.18.229.238	443	192.168.2.5	49734	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jun 25, 2021 12:24:49.035778046 CEST	142.250.186.78	443	192.168.2.5	49740	CN=*.google-analytics.com CN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Mon May 31 03:33:58 CEST 2021 Thu Aug 13 02:00:42 CEST 2020 Fri Jun 19 02:00:42 CEST 2020	Mon Aug 23 03:33:57 CEST 2021 Thu Sep 30 02:00:42 CEST 2027 Fri Jan 28 01:00:42 CET 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=GTS CA 1C3, O=Google Trust Services LLC, C=US	CN=GTS Root R1, O=Google Trust Services LLC, C=US	Thu Aug 13 02:00:42 CEST 2020	Thu Sep 30 02:00:42 CEST 2027
					CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Fri Jun 19 02:00:42 CEST 2020	Fri Jan 28 01:00:42 CET 2028
Jun 25, 2021 12:24:49.058737040 CEST	142.250.186.78	443	192.168.2.5	49741	CN=*.google-analytics.com CN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Mon May 31 03:33:58 CEST 2021 Thu Aug 13 02:00:42 CEST 2020 Fri Jun 19 02:00:42 CEST 2020	Mon Aug 23 03:33:57 CEST 2021 Thu Sep 30 02:00:42 CEST 2027 Fri Jan 28 01:00:42 CET 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=GTS CA 1C3, O=Google Trust Services LLC, C=US	CN=GTS Root R1, O=Google Trust Services LLC, C=US	Thu Aug 13 02:00:42 CEST 2020	Thu Sep 30 02:00:42 CEST 2027
					CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Fri Jun 19 02:00:42 CEST 2020	Fri Jan 28 01:00:42 CET 2028
Jun 25, 2021 12:24:49.616281986 CEST	104.18.229.238	443	192.168.2.5	49742	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Fri Aug 07 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Sat Aug 07 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 25, 2021 12:24:49.616281986 CEST	104.18.229.238	443	192.168.2.5	49742	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jun 25, 2021 12:24:49.616647005 CEST	104.18.229.238	443	192.168.2.5	49743	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Fri Aug 07 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Sat Aug 07 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 25, 2021 12:24:49.616647005 CEST	104.18.229.238	443	192.168.2.5	49743	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jun 25, 2021 12:24:50.093218088 CEST	74.125.140.156	443	192.168.2.5	49751	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Mon May 31 03:33:18 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Mon Aug 23 03:33:17 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 25, 2021 12:24:50.093218088 CEST	74.125.140.156	443	192.168.2.5	49751	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jun 25, 2021 12:24:50.094011068 CEST	74.125.140.156	443	192.168.2.5	49752	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Mon May 31 03:33:18 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Mon Aug 23 03:33:17 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 25, 2021 12:24:50.094011068 CEST	74.125.140.156	443	192.168.2.5	49752	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: AcroRd32.exe PID: 5452 Parent PID: 5884

General

Start time:	12:23:22
Start date:	25/06/2021
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' 'C:\Users\user\Desktop\Updated Invoices.pdf'
Imagebase:	0xab0000
File size:	2571312 bytes
MD5 hash:	B969CF0C7B2C443A99034881E8C8740A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: AcroRd32.exe PID: 6224 Parent PID: 5452

General

Start time:	12:23:23
Start date:	25/06/2021
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer /prefetch:1 'C:\Users\user\Desktop\Updated Invoices.pdf'
Imagebase:	0xab0000
File size:	2571312 bytes
MD5 hash:	B969CF0C7B2C443A99034881E8C8740A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: RdrCEF.exe PID: 6484 Parent PID: 5452

General

Start time:	12:23:29
Start date:	25/06/2021
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --backgroundcolor=16514043
Imagebase:	0xa0000
File size:	9475120 bytes
MD5 hash:	9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: RdrCEF.exe PID: 6668 Parent PID: 6484

General

Start time:	12:23:32
Start date:	25/06/2021
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1588,6436224196370243818,47289614401758773,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=8902479671005506358 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=8902479671005506358 --renderer-client-id=2 --mojo-platform-channel-handle=1716 --allow-no-sandbox-job /prefetch:1
Imagebase:	0xa0000
File size:	9475120 bytes
MD5 hash:	9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: RdrCEF.exe PID: 6688 Parent PID: 6484

General

Start time:	12:23:34
Start date:	25/06/2021
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=gpu-process --field-trial-handle=1588,6436224196370243818,47289614401758773,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --service-request-channel-token=6192589008187299491 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=' --type=renderer ' /prefetch:2
Imagebase:	0xa0000
File size:	9475120 bytes
MD5 hash:	9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: RdrCEF.exe PID: 6728 Parent PID: 6484

General

Start time:	12:23:36
Start date:	25/06/2021
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1588,6436224196370243818,47289614401758773,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=4651875932248415935 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4651875932248415935 --renderer-client-id=4 --mojo-platform-channel-handle=1836 --allow-no-sandbox-job /prefetch:1
Imagebase:	0x7ff797770000
File size:	9475120 bytes
MD5 hash:	9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: RdrCEF.exe PID: 6960 Parent PID: 6484

General

Start time:	12:23:41
Start date:	25/06/2021
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1588,6436224196370243818,47289614401758773,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=16296965572426256682 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=16296965572426256682 --renderer-client-id=5 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job /prefetch:1
Imagebase:	0xa0000
File size:	9475120 bytes
MD5 hash:	9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: iexplore.exe PID: 6368 Parent PID: 5452

General

Start time:	12:24:44
Start date:	25/06/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' https://cloud.degoo.com/share/yEamRoo0VDj2ZJXd1fAFww
Imagebase:	0x7ff6b1700000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 4696 Parent PID: 6368

General

Start time:	12:24:45
Start date:	25/06/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6368 CREDAT:17410 /prefetch:2
Imagebase:	0xa80000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' 'C:\Users\user\Desktop\Updated Invoices.pdf'
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer /prefetch:1 'C:\Users\user\Desktop\Updated Invoices.pdf'
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --backgroundcolor=16514043
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1588,6436224196370243818,47289614401758773,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=8902479671005506358 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=8902479671005506358 --renderer-client-id=2 --mojo-platform-channel-handle=1716 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=gpu-process --field-trial-handle=1588,6436224196370243818,47289614401758773,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --service-request-channel-token=6192589008187299491 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=' --type=renderer ' /prefetch:2
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1588,6436224196370243818,47289614401758773,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=4651875932248415935 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4651875932248415935 --renderer-client-id=4 --mojo-platform-channel-handle=1836 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1588,6436224196370243818,47289614401758773,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=16296965572426256682 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=16296965572426256682 --renderer-client-id=5 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' https://cloud.degoo.com/share/yEamRoo0VDj2ZJXd1fAFww
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6368 CREDAT:17410 /prefetch:2
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer /prefetch:1 'C:\Users\user\Desktop\Updated Invoices.pdf'	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' https://cloud.degoo.com/share/yEamRoo0VDj2ZJXd1fAFww	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1588,6436224196370243818,47289614401758773,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=8902479671005506358 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=8902479671005506358 --renderer-client-id=2 --mojo-platform-channel-handle=1716 --allow-no-sandbox-job /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=gpu-process --field-trial-handle=1588,6436224196370243818,47289614401758773,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --service-request-channel-token=6192589008187299491 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=' --type=renderer ' /prefetch:2	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1588,6436224196370243818,47289614401758773,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=4651875932248415935 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4651875932248415935 --renderer-client-id=4 --mojo-platform-channel-handle=1836 --allow-no-sandbox-job /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1588,6436224196370243818,47289614401758773,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=16296965572426256682 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=16296965572426256682 --renderer-client-id=5 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job /prefetch:1	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6368 CREDAT:17410 /prefetch:2	Jump to behavior

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to elicit sensitive information and/or gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.
Tactics:	Initial Access
Data Sources:	DNS records, Detonation chamber, Email gateway, Mail server, Packet capture, SSL/TLS inspection, Web proxy
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Updated Invoices.pdf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

Compliance:

Networking:

System Summary:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PDF Info

General

Keywords Statistics

Image Streams

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: AcroRd32.exe PID: 5452 Parent PID: 5884

General

Analysis Process: AcroRd32.exe PID: 6224 Parent PID: 5452

General

Analysis Process: RdrCEF.exe PID: 6484 Parent PID: 5452

General