Edit tour

Windows Analysis Report
Cancellation_418406_Dec23.pdf

Overview

General Information

Sample Name:	Cancellation_418406_Dec23.pdf
Analysis ID:	778232
MD5:	c085bbddc02251986f1fd8b84c5a404e
SHA1:	98d3377ff32441e24baa96f1d0fd83190e274c22
SHA256:	ca2d98108f12fb407cb0e1778febc9ff453ebbd8888e3b184cb8b9993775b5d8
Infos:

Detection

Qbot Downloader

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found potential malicious PDF (bad image similarity)

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Yara detected Qbot Downloader

Clickable URLs found in PDF pointing to potentially malicious files

Creates a DirectInput object (often for capturing keystrokes)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Internet Provider seen in connection with other malware

Sample execution stops while process was sleeping (likely an evasion)

Creates a process in suspended mode (likely to inject code)

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

AcroRd32.exe (PID: 2156 cmdline: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\Cancellation_418406_Dec23.pdf MD5: B969CF0C7B2C443A99034881E8C8740A)

RdrCEF.exe (PID: 5448 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043 MD5: 9AEBA3BACD721484391D15478A4080C7)

chrome.exe (PID: 7152 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 2364 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=1812,i,544507481073856773,15156316211615148029,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

unarchiver.exe (PID: 6076 cmdline: C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Cancellation_367461_Dec23.zip MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)

7za.exe (PID: 5296 cmdline: C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\fgt4alc0.uhe" "C:\Users\user\Downloads\Cancellation_367461_Dec23.zip MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 5312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: Qbot Downloader

{"Download Url": "http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Cancellation_418406_Dec23.pdf	JoeSecurity_QbotDownloader	Yara detected Qbot Downloader	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip

Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip

Virustotal: Detection: 15%

Perma Link

Source: Cancellation_418406_Dec23.pdf

Malware Configuration Extractor: Qbot Downloader {"Download Url": "http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip"}

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Spreading

Yara detected Qbot Downloader

Source: Yara match

File source: Cancellation_418406_Dec23.pdf, type: SAMPLE

Source: Joe Sandbox View

ASN Name: AS-26496-GO-DADDY-COM-LLCUS AS-26496-GO-DADDY-COM-LLCUS

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 05 Jan 2023 08:03:45 GMTServer: ApacheX-Powered-By: PHP/8.1.13Connection: keep-alive, Keep-AliveAccept-Ranges: bytesExpires: 0Cache-Control: no-cache, no-store, must-revalidateContent-Disposition: attachment; filename="Cancellation_367461_Dec23.zip"Upgrade: h2,h2cConnection: UpgradeContent-Length: 801520Vary: Accept-EncodingKeep-Alive: timeout=5Content-Type: application/zipData Raw: 50 4b 03 04 14 00 01 00 08 00 02 9c 97 55 e0 d4 f8 ae 42 3a 0c 00 00 d0 6a 06 14 00 00 00 43 61 6e 63 65 6c 6c 61 74 69 6f 6e 23 4a 35 38 2e 69 73 6f 79 61 b4 0c 99 42 96 64 6f 83 91 a6 87 9a e5 3b a7 9b fa 5c ce db 83 0b 04 d9 b6 6c 6b c0 29 f7 77 06 99 5d 89 d8 25 f7 83 d0 e7 99 b5 61 ec 80 11 0d 3f ab ff b3 1e 8a da 89 07 00 17 6a ec e6 29 66 86 ed bf 05 74 c7 c4 7c 06 90 e2 b0 2d 93 97 cf c9 70 ab d3 95 5b b2 ed 34 37 cb cb 9b c8 3a fb be 6c 97 18 a2 80 38 1b 2f 9a 5a 49 9d 4c 08 51 38 eb d6 d9 76 b8 dd 45 e0 a7 da c5 f3 68 1d 93 e1 36 73 17 47 c3 84 d1 50 b0 20 e0 0f 2f 1c ba ad 94 8c d5 01 a0 44 c8 57 38 0e b7 40 e6 67 9d e3 e4 b7 ef 2d a6 da d8 4d ff be 7d a9 a8 68 55 a3 aa 40 fb 32 c8 a1 2b 79 c1 e4 f5 44 28 a9 e8 6d 90 d7 2c f8 a6 a7 d3 f7 4d cd 5c 12 87 6b 1c a6 df da 6c f4 db 85 6c 02 12 db 8a f5 b8 f3 5a 1e 09 34 9b f1 09 d4 31 61 ec dd 98 ce d0 fe 90 73 1d 8f ff 0f 0a 49 41 25 be 0a 11 13 3c 09 76 9f c6 c9 0c b8 42 55 a2 ef 6e 61 a6 e8 c0 f4 02 5a 7e fd c2 2f 48 3e 80 50 95 ce 2e f5 5a 93 67 db cd b2 29 e5 bb 9d 0e 62 e2 2c 31 ec 3a 10 92 44 3f 90 c3 4d 8d 78 1d 46 c1 7e f6 97 5a 08 bd 77 25 72 27 e9 80 65 ae d6 7a 71 36 ea b4 32 04 2e c4 39 00 76 fb 72 d4 40 ac 61 a6 37 85 ca f3 1f 0b a9 1c 0b 68 b6 46 50 87 c1 02 a6 5b 2c 19 53 aa 37 4e c9 91 6a 4f fa 5a 49 aa 28 55 28 fd 13 fb 29 bf 51 74 1d 23 18 cd 17 74 20 81 cf a2 6e 45 2e e2 71 c9 01 18 59 6f e6 8c 3c 09 1d 71 f9 92 87 c1 71 d9 40 fd e3 16 28 8a 86 ff 37 d4 e6 37 21 18 c0 7a 7f 44 37 e6 8d 17 12 6b 93 fb a5 8d 64 de 6d a5 1b fd 57 d9 4e 7d e0 56 b6 c1 76 c0 30 44 73 e9 a2 7f 4c 05 21 0a 60 55 17 f4 b7 da 7d ef 80 22 eb f8 df f2 e7 c0 f3 e9 96 5c 9a 67 ea 0a 27 b1 9a 56 9e 23 db 96 6d 10 a6 9b 6b e5 a2 e2 59 36 2b 26 9e 1b 69 9c d3 38 14 c6 36 f0 da 48 f3 79 40 c9 e2 7f dd 9d bf 3a 3a 05 47 80 07 34 e3 74 1e e4 0f 97 7b ae 19 c5 d9 68 9b df 3b 64 53 bf 69 af 0c bf 9c 9c 6a 36 18 67 ab 81 08 7b 42 6c 0d cd e1 62 60 11 a4 a7 21 23 a0 4f 6c 40 f5 7b 11 1d f0 76 5f 7a 8a 5b 2e 65 7f 21 1e 86 b6 19 54 57 b5 41 94 5b 90 8f 16 50 60 ae 7f a4 92 dc 2b a4 67 ad 6b 9b f2 05 9a 3a 94 ae 2a 89 78 68 9f 8f 8b 31 27 07 e4 b4 13 7c 80 cb e7 c5 e5 bc 7e 3a d7 60 11 c2 bb 12 ee 5f ae 4e 7c c3 36 be 22 ef 58 5e 4e 59 bc 23 d8 61 55 c7 14 7b 70 a5 9a 09 2f 7a 5a 22 0a 39 e9 6f 02 5c 47 49 f9 11 04 ee 58 0a 0c 64 04 62 b0 2a 4b fe 40 3b e6 05 50 d4 d2 46 2f 6a 7b c3 7d 4e 3f c6 78 fd 9d e9 5c 21 0e bb 7c 04 d4 81 ae 3e 1b 54 21 f5 63 74 70 ea 32 40 2d cb f0 cc 61 55 09 d1 aa 35 53 1a a1 6e 94 69 e8 c9 0f e8 15 17 07 f8 16 aa 7d 01 ad bb 78 51 d2 f8 0d 0d 25 d2

Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: Cancellation_418406_Dec23.pdf

String found in binary or memory: http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip)

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+904; AEC=AakniGO7HqlHWlnoY-P22_SwwnNSfVGxlF1NgK5nuj5WLe313NyJi16g7z4; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg; NID=511=nUT82hOv6CVwMNqDg-sTtCMJJ6SQ1v_cCpfCpf5nt8EolEbal01GWFyjG01tqWQgh9ciRU880J6nLd2gdbhAJs44PsHAZaVQAFIbrqe2FmFgjrAAK7W9Z8u5LDvwsuZRng98jP6E23SJ4fsPIs326YmnuCwa92dRRCcB6MNeI_o

Source: unknown

DNS traffic detected: queries for: agapeministriesinternational.church

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.81Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /blog/Cancellation_367461_Dec23.zip HTTP/1.1Host: agapeministriesinternational.churchConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: unarchiver.exe, 0000000F.00000002.606287284.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Found potential malicious PDF (bad image similarity)

Source: Cancellation_418406_Dec23.pdf

Static PDF information: Image stream: 6

Clickable URLs found in PDF pointing to potentially malicious files

Source: Cancellation_418406_Dec23.pdf	Initial sample: http://agapeministriesinternational.church/blog/cancellation_367461_dec23.zip
Source: Cancellation_418406_Dec23.pdf	Initial sample: http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\Fonts\ariblk.ttf

Jump to behavior

Source: Cancellation_418406_Dec23.pdf	Initial sample: http://agapeministriesinternational.church/blog/cancellation_367461_dec23.zip
Source: Cancellation_418406_Dec23.pdf	Initial sample: http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\Cancellation_418406_Dec23.pdf
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=1812,i,544507481073856773,15156316211615148029,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Cancellation_367461_Dec23.zip
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\fgt4alc0.uhe" "C:\Users\user\Downloads\Cancellation_367461_Dec23.zip
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=1812,i,544507481073856773,15156316211615148029,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Cancellation_367461_Dec23.zip	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\fgt4alc0.uhe" "C:\Users\user\Downloads\Cancellation_367461_Dec23.zip	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5312:120:WilError_01

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\Local\Temp\acrord32_sbx

Jump to behavior

Source: classification engine

Classification label: mal76.spre.winPDF@38/57@5/7

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: Cancellation_418406_Dec23.pdf	Initial sample: PDF keyword /JS count = 0
Source: Cancellation_418406_Dec23.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Cancellation_418406_Dec23.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6500	Thread sleep count: 119 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6500	Thread sleep time: -59500s >= -30000s			Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\unarchiver.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 15_2_00F0B1D6 GetSystemInfo,

15_2_00F0B1D6

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\fgt4alc0.uhe" "C:\Users\user\Downloads\Cancellation_367461_Dec23.zip

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Spearphishing Link	Windows Management Instrumentation	Path Interception	11 Process Injection	3 Masquerading	1 Input Capture	1 Virtualization/Sandbox Evasion	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Virtualization/Sandbox Evasion	LSASS Memory	3 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
agapeministriesinternational.church	3%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip	100%	Avira URL Cloud	malware
http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip)	0%	Avira URL Cloud	safe
http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip	16%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
agapeministriesinternational.church	50.62.149.105	true	true	3%, Virustotal, Browse	unknown
accounts.google.com	142.251.209.13	true	false		high
www.google.com	142.250.184.36	true	false		high
clients.l.google.com	142.250.184.78	true	false		high
clients2.google.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip)	Cancellation_418406_Dec23.pdf	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
50.62.149.105	agapeministriesinternational.church	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true
142.250.184.78	clients.l.google.com	United States	15169	GOOGLEUS	false
142.251.209.13	accounts.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.184.36	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	778232
Start date and time:	2023-01-05 09:01:23 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Cancellation_418406_Dec23.pdf
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.spre.winPDF@38/57@5/7
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 47 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Find and activate links Security Warning found Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.21.22.155, 2.21.22.179, 23.211.4.250, 142.250.184.35, 34.104.35.123, 142.250.184.67
Excluded domains from analysis (whitelisted): ssl.adobe.com.edgekey.net, fs.microsoft.com, armmf.adobe.com, edgedl.me.gvt1.com, acroipm2.adobe.com.edgesuite.net, e4578.dscb.akamaiedge.net, a122.dscd.akamai.net, update.googleapis.com, clientservices.googleapis.com, acroipm2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:02:21	API Interceptor	1x Sleep call for process: RdrCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
50.62.149.105	swift copy$48,400.exe	Get hash	malicious	Browse	www.myeramd.com/hq0b/?FvW8X=PPbHunsP3xKlC8&A2=FEn4sz1CWpi2cWl1wcENQWyyn446hRlJFbqqf0jkHBurpevR/ONYOzyuSCpQG4EC96N+
239.255.255.250	http://sg.lightrdr.best/	Get hash	malicious	Browse
	http://au-redelivery-fees.com	Get hash	malicious	Browse
	https://taxes.rpacx.com	Get hash	malicious	Browse
	http://www.farmandcity.co.zw	Get hash	malicious	Browse
	https://app.uizard.io/p/78d796e3	Get hash	malicious	Browse
	https://taxes.rpacx.com/eutirtovoqnurkallc6gpwakepm88ohmjmo+ckkwgqbz5ooqf7zou0z7pjke7dw1	Get hash	malicious	Browse
	http://clickserve.dartsearch.net/link/click?&ds_a_cid=680760384&ds_a_caid=12694754542&ds_a_agid=123477218634&ds_a_fiid=&ds_a_lid=&&ds_e_adid=512650395034&ds_e_matchtype=&ds_e_device=c&ds_e_network=&&ds_url_v=2&ds_dest_url=https://mf606g.codesandbox.io/?dg=YWNjb3VudHNwYXlhYmxlQHBsYXRlYXV0ZWwuY29t	Get hash	malicious	Browse
	wescom Sharedscanned documents .HTMl.HTm	Get hash	malicious	Browse
	https://www.bing.com/ck/a?!&&p=c9c2566e4ab710b4JmltdHM9MTY3Mjc5MDQwMCZpZ3VpZD0xZGI0MmQwZi0yMjEwLTZhMjQtMzZhNC0zZjgwMjNlZDZiOGMmaW5zaWQ9NTE2NA&ptn=3&hsh=3&fclid=1db42d0f-2210-6a24-36a4-3f8023ed6b8c&u=a1aHR0cHM6Ly9jcmVhdGl2ZW1lZGlhc29sdXRpb25zLm9yZy8&ntb=1?qw=m.temnyk@gms-worldwide.com	Get hash	malicious	Browse
	http://object.fm	Get hash	malicious	Browse
	http://watch-online.49n7wqynho5u.top	Get hash	malicious	Browse
	malicious-attachement.html	Get hash	malicious	Browse
	Remittance01042023000128912838383.html	Get hash	malicious	Browse
	fsbwa Sharedscanned documents .HTMl.HTm.htm	Get hash	malicious	Browse
	http://r.kansasupdatesinc.com/tr/cl/-QiVUVSiXNevuU5j0YBr07D8r0GJPslw7tR4LhBAYAzhuo4GwluGG2j0Yr-xQaeuBF4g7wletcwoHb7PAt5U-4GfBeiNbMTHtyU7xesSaDGRU2-dvQszXGmuQT-cReuJp5mlkr9_yUyIcXqr2zS4UML88OY46likHFJs6b-CAlJztHWdfk6dXkhWyc7YA-3Jl8FIcS5MU6WD8zAtQc2rgdXtciRvXNpLlrWaaBrPiwfvk06RLfE	Get hash	malicious	Browse
	transmountain cyril_jenkins alex.correa.html	Get hash	malicious	Browse
	https://kampuskonnekt49.com/cdn/notify/regotransport	Get hash	malicious	Browse
	transmountain cyril_jenkins alex.correa.html	Get hash	malicious	Browse
	Scanned3345609.hTml	Get hash	malicious	Browse
	http://pogothere.xyz	Get hash	malicious	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AS-26496-GO-DADDY-COM-LLCUS	Copy_Company-profile.vbe	Get hash	malicious	Browse	173.201.193.229
	http://object.fm	Get hash	malicious	Browse	184.168.104.171
	university of kentucky indirect cost rate agreement 5564.js	Get hash	malicious	Browse	23.229.209.229
	payload.dll.exe	Get hash	malicious	Browse	166.62.88.163
	ANSFXTL55060.vbs	Get hash	malicious	Browse	72.167.39.20
	jAqT1F0Fpy.exe	Get hash	malicious	Browse	107.180.4.94
	sSB5yHCWJg.elf	Get hash	malicious	Browse	192.186.201.160
	40090300098393.exe	Get hash	malicious	Browse	184.168.101.66
	40090300098393.exe	Get hash	malicious	Browse	184.168.101.66
	MYorfmVq9Z.exe	Get hash	malicious	Browse	192.169.149.78
	qqt.exe	Get hash	malicious	Browse	184.168.111.40
	qqt.exe	Get hash	malicious	Browse	184.168.111.40
	SETjGyH4X8.elf	Get hash	malicious	Browse	97.74.248.66
	file.exe	Get hash	malicious	Browse	107.180.98.101
	file.exe	Get hash	malicious	Browse	107.180.98.101
	file.exe	Get hash	malicious	Browse	107.180.98.101
	lCVLEXbxih.exe	Get hash	malicious	Browse	107.180.98.101
	remotesecurity1.apk	Get hash	malicious	Browse	43.255.154.97
	tochi8890.exe	Get hash	malicious	Browse	68.178.145.252
	DHL Original BL, PL, CI Copies.htm.exe	Get hash	malicious	Browse	72.167.125.133

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.621995976318026
Encrypted:	false
SSDEEP:	3:m+lvns8RzYOCGLvHkWBGKuKjXKLNjKLuVlfl/1lQRktyrVNBiTFJrqzOJkvP5m1:men9YOFLvEWdM9QKftvPtYvi7Z+P41
MD5:	05A8ED13DB8ACF9593227A84C5C6FF47
SHA1:	6414B2E11A5C6EDA3AEDDF90585DC7AB6AA8817E
SHA-256:	6AD07D48B525B5EBE2DE9B7C4A074C01C366CCDD01080F8F65C378B8089C4227
SHA-512:	A392B1984BB041DB20B9AC85C423966E8D67F40D5774D82B9313626CB5F428454BD88C77D5CC82CC6DE18DC7EDB1BE95C6DAF387C92F19AB2AA799C613B4AEE4
Malicious:	false
Reputation:	low
Preview:	0\r..m......M..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/plugin.js ..mQ..P/....."#.D5.3....A.A..Eo......KX..............d.{v.^.G...d.W.:...P..k%..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.576331272896254
Encrypted:	false
SSDEEP:	3:m+lF9NX6v8RzYOCGLvHktWVeofl/Tk9kRktWfO98fZe/O+/rkwGhkg4m1:mi9NqEYOFLvEk5tT0jtV8Be7Ywcr1
MD5:	7F55774458FA8EA992A4750965A14D93
SHA1:	1B5B39ACACE70F1BC54D1746E2C8CC05D59E2028
SHA-256:	03A014EF976E41BDA70EBB3EE3775CDBF07AF033A808EE9DE7D3CDCEE58546B9
SHA-512:	5A413BEF7E1445D5C3A2E6D9026B07B7450BF322AC34B4E8C4CEF7EF39D02A177955B60F40C4A8DDDF72CA3A664C1EA59098D1110F79335805EC66A13DFA7475
Malicious:	false
Reputation:	low
Preview:	0\r..m............,....._keyhttps://rna-resource.acrobat.com/init.js ..N9..P/....."#.DS.....A.A..Eo...................1.x.'.vI..*\|Z..o...+.4....0..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	246
Entropy (8bit):	5.567684396308422
Encrypted:	false
SSDEEP:	6:mMyEYOFLvEWdVFLBKFjVFLBKFlQhuLm1u6OQt7XHmt/RlUoSjGY1:DyeRVFAFjVFAFXx9QFXGtZlUo6
MD5:	97CD0EFE5E2B8A3D74AEEE4842308710
SHA1:	8AA2676E49EE270AF8120524244A7BE5B58D3991
SHA-256:	3FDACB1B6DB3BC8535408C9A2598E2C9C9E6F84901CD5060A56CF2E9B9197ABC
SHA-512:	D40DC4F1773DDB3E1622493F6BBA336A01F0FE7C56A56659E9AF7AC55C99BC1314BA8EA9F92F70465F35E8EEE86277F64FCA7F02D87B2DA7743C88CAC757F551
Malicious:	false
Reputation:	low
Preview:	0\r..m......v...n......._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/selector.js ...O..P/....."#.D..-....A.A..Eo......Y..2..........hvDO.N.t@.....n.*...... ....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	5.64887853183383
Encrypted:	false
SSDEEP:	6:mNtVYOFLvEWdFCi5RsbH4A1Di9tGuiWulHyA1:IbRkiD6HH1+QjWus
MD5:	9EA125E9CF4BD143066AA72AB2D1D403
SHA1:	434C1A2C729CA4D40154E9F98FAE727767E4263D
SHA-256:	7A04211A73C7169FD4EB1FCC0D0B5B46198EAC7A4D233AC37E4F95394E1D3837
SHA-512:	7E4DEA9B51E264FE3D356B928F068C50C84D5BE07EFE1970830BC2E2D7AF1481B3C4AA6B75634A5AFAA637922BD6CF41E08C22221F60287E9CB22D010E2F1C0C
Malicious:	false
Preview:	0\r..m......h.....'....._keyhttps://rna-resource.acrobat.com/static/js/plugins/aicuc/js/plugins/rhp/exportpdf-rna-tool-view.js .>w...P/....."#.D.z:....A.A..Eo....................8 P..a...R..Y....7.@..2Dm{..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.512939302571262
Encrypted:	false
SSDEEP:	6:m+yiXYOFLvEWd7VIGXVuQtItiGVyh9PT41:pyixRu3EGV41T
MD5:	A17F44A872680C207579A1A086788A99
SHA1:	9119588BADE75F7BBB909798C3048D4C78C49DED
SHA-256:	1ADD7711FDD7361A04F6F0680525B5529853D3CA300BA69DF0555322800DC321
SHA-512:	37C865F8FE9EC955A5DD7E71A57D266389E0858444C294AC2005196977E79CBE631334E5D9526A61C789DC24851FB33A4ED7ACB2C5788F7945466DBA185F7C21
Malicious:	false
Preview:	0\r..m......R...kP]g...._keyhttps://rna-resource.acrobat.com/static/js/plugins/app-center/js/selector.js ..MP..P/....."#.Dk......A.A..Eo.......(G........k.Q.....-_..y.....O...>..1....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	modified
Size (bytes):	216
Entropy (8bit):	5.612388645423502
Encrypted:	false
SSDEEP:	6:mvYOFLvEWdhwjQo4e8Bl9t6P/73ZIl6P41:0RhkMl9aDZ
MD5:	FF6F0A6F4A92165C2750003E38D98901
SHA1:	C9C78B3F5200C167C28357E2BE0DDD05A4D080CB
SHA-256:	73708B5FC326A0EF2172354612B07BB86E42C2515AD5F624344CC7BB9ED294C8
SHA-512:	B836830D4B854BF2693E5BD6E6F24718E0432E5C6DF47AF363A6C03F4D93A6B2917EF62AD013C34F7D10702BD2F06CC26E942980F8CB7D1AE528CFA0E5295653
Malicious:	false
Preview:	0\r..m......X.....V....._keyhttps://rna-resource.acrobat.com/static/js/plugins/sign-services-auth/js/plugin.js ..EJ..P/....."#.D.......A.A..Eo........:.........].>....uUf..N...k......c..l.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	5.523770318520741
Encrypted:	false
SSDEEP:	3:m+lZd8RzYOCGLvHkWBGKuKjXKX7KoQRA/KVdKLuV2ll/X59lI9k6RktNcyxMtv9G:mJYOFLvEWdGQRQOdQ7tp9Ok9tND6g1
MD5:	C8E82FEB22D90B3991337437F2948FC4
SHA1:	8691CD0E6A3068871B3233EC70C7BA714160B08B
SHA-256:	7C752F349B50EBC49C0ABE460515311ADF5CA8291298F7EBFFB4BC8197A69910
SHA-512:	B2FDCBB762EC76A2D01B4CF75F798E5E37E7EBDEB2A791852AC9A4E68DB99E54EE84335086F621ECB6EEFA34A9B949B029820CA021101D51CC3958A79BBC0D2B
Malicious:	false
Preview:	0\r..m......Q..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-computer/js/plugin.js ..^P..P/....."#.D.......A.A..Eo........g...........c..y/L....\|y.n..C/I.....X7-ne.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.5990078596133435
Encrypted:	false
SSDEEP:	3:m+lLp08RzYOCGLvHkfaMMuVeoH/l/NKqkRktg/l/VQMWqg4nRb7om5m1:mOYOFLvECMLPt8qjtg2uR/41
MD5:	3825DDDE75117D171E71E5A458925227
SHA1:	888D0794E3A82F286534336C13E2C1BE72DAC204
SHA-256:	5A710A6D29EC4856CDBDECF5DD80C0B4E6C50D9648F8F83670AEC94661FEA8EF
SHA-512:	018C790C06BE9DA972F4AAC61CE76B1E0865C64F973A93858F7455656ECAD0AC99925A5870BC1B69F6682FD7936F088B030037495E908B6DEBC76690908AD088
Malicious:	false
Preview:	0\r..m......3....<lb...._keyhttps://rna-resource.acrobat.com/base_uris.js .N.9..P/....."#.D......A.A..Eo...................y...L<?W.Xi..A\Q3...J.}...d..~G.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\39c14c1f4b086971_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	212
Entropy (8bit):	5.645116909414164
Encrypted:	false
SSDEEP:	6:mGpYOFLvEWdzAAu9p9tXMGm0bbsIDMGH41:XfRM75MVKsIZ
MD5:	49C5D81D91FB71BC30A6194FF1EC9511
SHA1:	CD1CF4B7CAF5310114F568DCBEFAE30B5E6BEDB9
SHA-256:	013C484B65CF375E55A8D23396A38B83215541C89C688F95620783DFFC1A9824
SHA-512:	A2386258025F2A536DCE5A8D478B85F393683FF9CDEB65AADC05A35DD55CAD7EA00EB50B94C4C7B865AF0C2CB1E1893DB6B5CF063A62232FE7A6E32A27641337
Malicious:	false
Preview:	0\r..m......T....,.^...._keyhttps://rna-resource.acrobat.com/static/js/plugins/walk-through/js/selector.js .....P/....."#.D8Mh....A.A..Eo........Vw..........`.....^....L>..Xa./......C.y.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\3a4ae3940784292a_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	214
Entropy (8bit):	5.50823459567584
Encrypted:	false
SSDEEP:	6:m4fPYOFLvEWdtuio41atOqKjtEhby0zBUKSAA1:pRHlAQ5ahb
MD5:	95844A96114E25247A2FF70296381B8F
SHA1:	9B7C3175BEA13C18EEBF7773A2978D94304F467B
SHA-256:	6DC9AF2C8078322C1D3F029FB277C539B1EC9C81E9B14A7F9D5BAAAAA501395B
SHA-512:	BC6B9BC933D31484E0A1024A9062CA179A23158983B69EF7433A9557BAFEE6053F10C0C2925A2D7C5DBA089D5F834B2E1F546A586325C33149031865BAC742BD
Malicious:	false
Preview:	0\r..m......V..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/search-summary/js/selector.js ..Q..P/....."#.D../....A.A..Eo.......N .........Q..E.=....=h`t..t..3%A.F$..w..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	177
Entropy (8bit):	5.464478515173832
Encrypted:	false
SSDEEP:	3:m+l64HXlA8RzYOCGLvHkjXMLOWFvrZ4Al/cbekRkt/gulWd1dn76KohyP5m1:md4HXXYOFLvEjMSWFvV4Atcbejt/LlWs
MD5:	3B017F44D6937A232DAF337527007722
SHA1:	BF073D4A3478DEB49B19168951EB4AF5BAE00BCB
SHA-256:	846C8930FE818F33EE410564FFEE3DCF8373729EC527BACB7178BEDE5FB9988D
SHA-512:	04634D17981352204AD8D850BDF187F0447A9B3ED828B785D4EC6978C4308E2898F558111D3FB8664783569262E8FCB76D109F095A0589F3ADC5234DB4833798
Malicious:	false
Preview:	0\r..m......1......5...._keyhttps://rna-resource.acrobat.com/plugins.js ..9..P/....."#.D......A.A..Eo......oA...........PU ....t^.....a.k..u.7.M.BW6#}..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.537214904794677
Encrypted:	false
SSDEEP:	3:m+lpSUlIv8RzYOCGLvHkWBGKuK2fKVLaOjval/JAT9k6RktxfNFtRUPqf9tsDMam:mkl9YOFLvEWsfOLaOjatEStx4PqVyM+e
MD5:	8BE056AB92C0B0E86E8B813D483AEE4F
SHA1:	57DAB50CBD799FC1602E10CAF834A0E6B7B9DA81
SHA-256:	2117ABF959441BA292E84E00F16C4EB5238A05694E58675FF05014FB198A55E6
SHA-512:	01AC1479A0393075FC49F4C16753A4A10C37CBEA13DE3F40C7A6637F5A647F7556F603279191C1EF481F9D30B95278E99859666FF58D73A98AD74CAACF4BC7CF
Malicious:	false
Preview:	0\r..m......;...I......._keyhttps://rna-resource.acrobat.com/static/js/desktop.js ...F..P/....."#.D......A.A..Eo.......`z...........q.O...j....._y..L^z...?..@N..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	244
Entropy (8bit):	5.592823378418027
Encrypted:	false
SSDEEP:	6:mt9YOFLvEWdVFLBKFjVFLBKFlyDMtK5BtZtwSeKaT9pr1:URVFAFjVFAFq5BjtwSeKaTL
MD5:	F84876297A72BEB1651728C1BFBC1656
SHA1:	C3A6235941079B657A7FA71E9F18BD0D781F76D0
SHA-256:	0D817919DDD0781C329CA59BF7825F621614506EEF0BEA06D02A38809444055A
SHA-512:	979A592311103B859550302B63A4C504E702902B57D78B79C3ADBEA59159081EE0F754A1DCB1B004FB557A13EF420E28DD8261D040A1B4BDBFCE04C4CB074DD7
Malicious:	false
Preview:	0\r..m......t...R.1<...._keyhttps://rna-resource.acrobat.com/static/js/plugins/tracked-send/js/plugins/tracked-send/js/home-view/plugin.js .Y\P..P/....."#.D..9....A.A..Eo......8{T...............H...{...2../.k`..r4.C. .A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6267ed4d4a13f54b_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.542565577661833
Encrypted:	false
SSDEEP:	6:mq9YOFLvEWdzAHdQWZ1iltM0t5GFCaa+41:NRMHdjZUlS0t5Gda+
MD5:	2B30A71A95636FB7EB31ABBCD30914B1
SHA1:	EBCEB28F0DABD913F71C8E970B226DB750CE72A3
SHA-256:	3ACA663CF9476B74AA3AB2974971668E9CD3D7C33D66D1D107FD167C0E3FE949
SHA-512:	05753E498D442AC0C5CE4CA1074DDA1343D0BE042426C835378B74E3016015EE6DE30C2731B1F2D7DF938E72D92683703F706613049DF436D0383091E0891A9E
Malicious:	false
Preview:	0\r..m......R....L......_keyhttps://rna-resource.acrobat.com/static/js/plugins/walk-through/js/plugin.js .....P/....."#.D..i....A.A..Eo.......#.g...........G.3D.....Q.g0...._.Q.........A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.503044010207524
Encrypted:	false
SSDEEP:	3:m+lx4F08RzYOCGLvHkWBGKuKjXKGBIEGdevA/KPWFvq5Ll///RktWfJyrpYFm1:ms2VYOFLvEWdvBIEGdeXucRXKtWA11
MD5:	EAC791EA906DFF9FFFE142A9C3128082
SHA1:	1E64D921644E4255D83F8628BCF5B854D92E1CDF
SHA-256:	86A99F42FCA4331C519705EB534CDA3D56D404D6725BCD7425DB4AFB964E002B
SHA-512:	4BC2B0C9F5EB356D3BE2FE90EE03B51313034B26598DAF27FBA4D0A4A4DA47121AAD3D01C369C7F4A39AED209DC8A6235C0F3A9DB7A83DD241AEE2A110DDBED5
Malicious:	false
Preview:	0\r..m......S...]......._keyhttps://rna-resource.acrobat.com/static/js/plugins/add-account/js/selector.js ...O..P/....."#.D.......A.A..Eo......'............A.o]@r..Q.....<w.....].n\....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	202
Entropy (8bit):	5.607762882702344
Encrypted:	false
SSDEEP:	6:maVYOFLvEWdwAPCQvkWtj7xm7OhKlvA1:RbR16Q9xmJ
MD5:	557A0AA61BDFB25AD34327FE8435751A
SHA1:	85094D987F3F984A4EC70BCC250B0DCA39A0F2C8
SHA-256:	37C4521EDF38CAF2848CEB5771D7601D8CAF1A2B6BC32B5095E17219D016439B
SHA-512:	7E4C3CF8F9A57110DDBAAD102C7EF2C807D937D2CF5D31122BF3976141BCDB44C8B10D866172EACEA0F6F6D66B4512DE946FA9681BF566FA1B069B69AC087493
Malicious:	false
Preview:	0\r..m......J......{...._keyhttps://rna-resource.acrobat.com/static/js/plugins/home/js/plugin.js ..(J..P/....."#.D.c.....A.A..Eo......D.............4T].....Tw.....(..b...EO....9.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.551307296605831
Encrypted:	false
SSDEEP:	6:ms2gEYOFLvEWdGQRQVuSMeQa0BtzdFt1:B2geRHRQHU
MD5:	B4A4AAF19733C12B4B33E2D15D0FCE58
SHA1:	8B163C6853DE9E60B357821A6FCFDB39D61544B6
SHA-256:	F0836551209222B402AF4FD01C08656F2E804400C03804F28148EF3C7614F234
SHA-512:	EAA75427B31C3B82E7D8E7E8C0AE2906482186D044077F650B4000DA87BA35BDDD97C06ED340942EC7BFD1FE81D4984653F9D1134AF17FDC17FB7E9A3E64F10C
Malicious:	false
Preview:	0\r..m......S...W.%z...._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-computer/js/selector.js .orO..P/....."#.D..-....A.A..Eo.......$8.........@..{o]...9o\|..qY....T....{..u.b..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	206
Entropy (8bit):	5.627841101631036
Encrypted:	false
SSDEEP:	3:m+lerlyv8RzYOCGLvHkWBGKuKjXKX+IAHKLuVn/rmJO0kRktWtgEnNWQ1SUm1:mzyEYOFLvEWdrIOQESBtZEt1S/1
MD5:	64E8C64C6A112DC79EA38A6DA4FD9576
SHA1:	391CDCF1689D666F2CEFEC41B9CF7548C8A41B22
SHA-256:	9BDF5299BF039AEC674577CBDCC0CF2507FB7FAD9816BA7BBB943A4574CA6E7E
SHA-512:	ACCA0514DD114F827D7F875B6F9C16498FBB0D0978BA9F0B149FF03A9D4CBEDFD410124E7234E2E457E0B78D937E2A8E96FD481E975982EB50007FBE34A521C6
Malicious:	false
Preview:	0\r..m......N..../......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/plugin.js ..)H..P/....."#.D.i.....A.A..Eo......M............t\a......x5.'OuE.C..@......x..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.550674839202454
Encrypted:	false
SSDEEP:	3:m+lKcv8RzYOCGLvHkWBGKuKjXKoyNH/KPWFvJ5t/t9kRktYEt/glwJNqww6U+5m1:mnYOFLvEWdhwyuj51t9tDClwrqwK+41
MD5:	A86CDE160790DFE274404BFE174A765A
SHA1:	18E017F5E931422390B642FE1DC41DBCDD242959
SHA-256:	9D58599A524D65AD58B5ECA39F5E95C1A0C2AC19BFBE48BD9BE04C78506F3768
SHA-512:	10BD32F3764A343D3CFF0132BCB58CE7F73B8F2618BEE067AD41C44B8B305417464976218FB8C0798867EDD5BB5A7C1FEBF8D16B5315CD4C98105F4EB0EDB984
Malicious:	false
Preview:	0\r..m......Z.........._keyhttps://rna-resource.acrobat.com/static/js/plugins/sign-services-auth/js/selector.js .,'J..P/....."#.D36.....A.A..Eo.......hD................7...o..a=.98I......(3.$G.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	230
Entropy (8bit):	5.600848952677848
Encrypted:	false
SSDEEP:	6:mYXYOFLvEWdrROk/RJbuOWltntM0fO441:/RrROk/UpC0fL
MD5:	93B8F67BA6059DA3748FD998C5DBC788
SHA1:	3E623AD93172A25C525E4A78F0EEEC53813B6F83
SHA-256:	D383312016DB941640B947688007DD211A9EF754C5BC51BD0E6F0A0B42FCB0CF
SHA-512:	72287A5E1692BA88599436FD3C8E61539054EC43D12401EFDE982F9A6FE1EDC8FB28EADA7C03A664C88A2556A44D3D3C0C80AA500B10625F3B777B8D0EB19A26
Malicious:	false
Preview:	0\r..m......f...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/selector.js ...G..P/....."#.DPQ.....A.A..Eo.........^..........~..rw.+[....!.)?..f.U..(=.=.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	186
Entropy (8bit):	5.588810987211443
Encrypted:	false
SSDEEP:	3:m+lhD4ll08RzYOCGLvHkWBGKuKdTSVs+ll/oOJRktYT3zoIN1OFPL4m1:mmDEYOFLvEWXIjtoOQtYLzV1QPLr1
MD5:	CA823AA1C7CB0DFCEA3FE712B63A557D
SHA1:	12383F1280288995D7221C890ED488C9BAA1C861
SHA-256:	9C9604A8846253EF0A3790580196374917E239BC17E42DECFC1A3A9356AEED43
SHA-512:	1384029E9CE5160BBA3103D23F9AFFB54768AF2B81EA57935C84B4056D780D2FA7C3148DF4F50446A199C22DC75B74C38065FB042F7F2C86B9C38420E2C83287
Malicious:	false
Preview:	0\r..m......:....f......_keyhttps://rna-resource.acrobat.com/static/js/config.js ..F..P/....."#.D.k.....A.A..Eo........&...........~]...%s..<...n.f..<.....1#..U..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.610626350115273
Encrypted:	false
SSDEEP:	3:m+l+nq1A8RzYOCGLvHkWBGKuKjXKLNfKPWFvkFTHt/PLc9k6RktE0//m8D6EsEJo:m52YOFLvEWdMAuqTVPoG9tl2EvsEJ41
MD5:	0926F994DE13EDA59A7E2CFC10281BE5
SHA1:	935830D69C61C55EDA95BF974779BCBADF853CED
SHA-256:	DF223F196F3927202A76E14C1A1D8C1CFE13138118102E542A4313D748211DE0
SHA-512:	4E8D2E51BA77EFA84583E313E3D8F5D59A1F80EAD845803A8859AA8C0E7220961A7E8ED49724C0AEEFE78F1EA1847BE3D18FB8EFCC28169E07142ED01CF5B185
Malicious:	false
Preview:	0\r..m......O...a.Y....._keyhttps://rna-resource.acrobat.com/static/js/plugins/reviews/js/selector.js ...O..P/....."#.DJC.....A.A..Eo......C(.)..........z._a...'.v.......4p3..1.']...A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.583998485910321
Encrypted:	false
SSDEEP:	3:m+lf1UldA8RzYOCGLvHkWBGKuKjXK9QXAdWKfKPWFveCu/jQRkt3A/OFoDb7T2/1:mYilPYOFLvEWd8CAdAuPebt3long1
MD5:	3D95B90EB0979E07AEE7E94065292E5B
SHA1:	39683F5FD739A548B0A08DD9754FD8610F730908
SHA-256:	74724B37664F439C379CEF31A267E8146BE66C16892C8E2DD3BECF8297EC106B
SHA-512:	32ECD6CED29ADBD1F4A1E323CCFF61B5750702A8AD53C8C01CFEA1BEEAB636456CDA8CF3C29105A47E6253830A5478638897FBC1857F9B5D7406619E7F171A03
Malicious:	false
Preview:	0\r..m......R....\|....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/selector.js .;.O..P/....."#.D)^.....A.A..Eo.......B..........c}.H7M=M..-.....Ix..R.l...}Rl.$q.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.575019062802048
Encrypted:	false
SSDEEP:	3:m+l18t08RzYOCGLvHkWBGKuKjXKeRKVIJ/2oKPWFv6ll/fgnnkRktnEOe28WIJLA:mY8nYOFLvEWdrROk/IuwltqtEN16wG1
MD5:	1C1C09775D89160E3A7B6F61C8E20FF9
SHA1:	8019387BCB63D8091D68D2456C94281132FE4679
SHA-256:	1524F3BE3F93029528B9C62B04F50D4B8FC1445D6F41916343CFEC6865021BE2
SHA-512:	0E7F507F4CE4ED44FF1EB0F722B5B46F9D64515194655C4DA4195B97CD53ED83AF3DAA60CF54EC3264152A0423C90733955CF197642740187637800DA1B67635
Malicious:	false
Preview:	0\r..m......_...h......_keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/selector.js .K.G..P/....."#.D.E.....A.A..Eo........}S..........%.k.SZ..~W.....:)'B..ad......A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	213
Entropy (8bit):	5.668873581676798
Encrypted:	false
SSDEEP:	3:m+lstxt08RzYOCGLvHkWBGKuKjXKX+IAuAJVKjXKLuVytoF//pzcqkRktrlePmJt:mLrnYOFLvEWdrIoJUQFaVdjtxeeJIi1
MD5:	D5EAB93751AC1B7A61F8E96AC211EF3F
SHA1:	FB8C7EA8C0F710DB3676D39A69E9F31A99BB2E76
SHA-256:	F6E3414FB2014966D04477625B51E19DEF36D3DA5A0B3DD8B49C85B1800325C8
SHA-512:	D1AB12BD803A180ADA820E3B2047A2953280633350C4C468C396807B04EFBF4FCB900D225D0FA71C50747B13F5FDBEBC2B442F07DD368E5111CB07181C04DA86
Malicious:	false
Preview:	0\r..m......U..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files-select/js/plugin.js ..+H..P/....."#.D......A.A..Eo.......Z...........;"./N_.,.:C..2....9L.H...3:...A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.5612368136651344
Encrypted:	false
SSDEEP:	6:mOEYOFLvEWdrIhuDVta2rIStD/xzgm2d/1:0R5VEEISV/xR
MD5:	7A6974EF458ABA31509126F8638D6F99
SHA1:	4B009AE03A7892EDBEEE77710D429C6BD3B63154
SHA-256:	BDD7527EDB021F834BFC94CA96B150B49D17B5B19B5C7C8B5CE1FFB95E4AA70B
SHA-512:	299EABF847D9BB30B390AF6688C5DB965AA889412EBA34320D1BA1040082288D8FC6E7EEB6B28F2B875929BB580A2F23E15952796B32B0C878CF7D3CF5D3A68D
Malicious:	false
Preview:	0\r..m......P....r......_keyhttps://rna-resource.acrobat.com/static/js/plugins/my-files/js/selector.js ...G..P/....."#.D.......A.A..Eo..................Z.Z}Q..4.o....0+..[\|..n:*..U.W.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.606320392905866
Encrypted:	false
SSDEEP:	3:m+l8UElLA8RzYOCGLvHkWBGKuKPK7CvJ1+//YjI9JRktO1GBiaQ562HvpMm1:mAElVYOFLvEW1K4e/9Qtix56uvp1
MD5:	11399BA6433E5D2C6EAF25C0B93DB932
SHA1:	E081C102177D38FA90F9B475AC0EBCF0B66C7AC2
SHA-256:	537B0A06834A3FA7E046914387CC53C3AE93EBB3B3D1BD2393D72ACF63CC82E5
SHA-512:	8870BA6EDCF9560D6CBA7F4ED13F523FD32305F65A5ADBD7BD59736BFA907DC20917409441B70BF492999839BE3343EF851EC3ABF838C8A53EC327332D546A57
Malicious:	false
Preview:	0\r..m......<...)6......_keyhttps://rna-resource.acrobat.com/static/js/rna-main.js .*.<..P/....."#.D......A.A..Eo......+.2.........z?...SwC...^..y.....V..7R-O.....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	214
Entropy (8bit):	5.651471255775399
Encrypted:	false
SSDEEP:	6:mWYOFLvEWdBJvvusvesAHISt8UDLYtmOZn1:xRBJDeTDcFZ
MD5:	18D937FA69EE6EE16DE14487BE3D0F24
SHA1:	407556B89EFFBE80AB5D16BB78A31FFB2CBAC769
SHA-256:	2A58B426FC93AFD55F466FC88043755A89597C11A04A8BCC6DC7D60DB81A963C
SHA-512:	EA1873AE9199D6F8A51BFD6CFDAC39270D03AF9A304DA801EA24E7D8770F4C21AD603D55FC5CEAB2DDA1F37A312EE4E5330AB9772E5B5A65B504716A10D92EEA
Malicious:	false
Preview:	0\r..m......V.....h....._keyhttps://rna-resource.acrobat.com/static/js/plugins/activity-badge/js/selector.js ...O..P/....."#.D.%.....A.A..Eo.......*..............t.q..W.EZ....1...[.zC.7mD..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.598506873098588
Encrypted:	false
SSDEEP:	3:m+lxCq//6v8RzYOCGLvHkWBGKuKCH6U4LJzWHK7WFvxZfl/2hylQRkt3llFpSKGi:msRPYOFLvEWIa7zp7Kt2ElPtt8VPu1
MD5:	B36CE60DABAE5C2C68ABCDF537B399A7
SHA1:	42511E2604CBA44236ADDDEA87BC8BE6A6FABA3F
SHA-256:	2761E6588D371710329B839163392855342C66187D477C9DF92FA1E768EB60FB
SHA-512:	5669770560C2AA4D98EF50C45881DEE87BBA91F9FE50BBEFB0C4F6B940CB4B836D3D1DE64F0B576B14D62DC0C481797C5AEA08E0FEDBBC2B9574ED89B638CE87
Malicious:	false
Preview:	0\r..m......S...{.j....._keyhttps://rna-resource.acrobat.com/static/js/libs/require/2.1.15/require.min.js .`.9..P/....."#.D......A.A..Eo......g1m=...........L...Im.@.........E.nW...IP..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf0ac66ae1eb4a7f_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.572894941037124
Encrypted:	false
SSDEEP:	3:m+lQi9lC8RzYOCGLvHkWBGKuKjXKVRNUpXKLuVa//k9kRktJXl96F4XVAZ+8cV3I:mKPYOFLvEWdENU9QFItgwiM3Y1
MD5:	6C25D187D5522309902319CB0F2E04D1
SHA1:	D9B972270373BA977C08081B584FE4C196A91246
SHA-256:	1DF97D65306F71A7EA7C4668387B6C2DCEE3E26A39D2CAD26E399BEB72AF6686
SHA-512:	18B8DBD480501564B45FF1908935E3B506ED8F0CE71666EA3526966314EDE66A9C312D98C58B67EDE51F68FE4BE857A7B689CA3E6790294FB737CDE46430D6DC
Malicious:	false
Preview:	0\r..m......P...Yft....._keyhttps://rna-resource.acrobat.com/static/js/plugins/uss-search/js/plugin.js ..J..P/....."#.Dh......A.A..Eo......Qr.f...........M....m+lS..e.....<7.U.P8.0K.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.600545661828051
Encrypted:	false
SSDEEP:	6:mQt6EYOFLvEWdccAHQzAtRtCijBRCh/41:XRc9CcQiDi/
MD5:	42EA06B4F1B3D20D423F50E4781590C8
SHA1:	13D2FBF2085C500E4DB01F1D42FFA12569556A59
SHA-256:	25A3ED04D8F2358B9398C02966857B2CAECC4F9FAC7C48C3C7E6373304CE59E9
SHA-512:	0BBF27F3903CFE74D5C38BB9DB49215D1735A93D747C16A1122254578194BF9BA1799C3BF90E9415D16A3B22E72593C25EB8DBC9BC243B4AB347FAA94EF88272
Malicious:	false
Preview:	0\r..m......P...W3......_keyhttps://rna-resource.acrobat.com/static/js/plugins/scan-files/js/plugin.js .Z]P..P/....."#.D..>....A.A..Eo.......(].........PJm...0x.x..RD...BB!@5..<..]....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d449e58cb15daaf1_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	231
Entropy (8bit):	5.559487569468151
Encrypted:	false
SSDEEP:	6:mqs6XYOFLvEWdFCi5mhuqYVvttXl/l/kULlF4r1:bs6xRkirx3lt/7LlF4
MD5:	8C236DEE20477DDEAAB43674564AB50C
SHA1:	D225A033A89420C2E72776A2FA62AB55BF2CF840
SHA-256:	EFB50A6265C9B2646BF5CB846B5BE985770D9D80AC5191764B0041EDF8432271
SHA-512:	C4F46CF317C1D891F13612D01CB0D3A2A4C121ED6A084A28715D26BCD2BF724664C282B48782C56A2A879D8F773B680ED82ACDA136205A337F5B101B621A4C66
Malicious:	false
Preview:	0\r..m......g...~.I?...._keyhttps://rna-resource.acrobat.com/static/js/plugins/aicuc/js/plugins/rhp/exportpdf-rna-selector.js .x....P/....."#.D[.'....A.A..Eo......".K..........P...#4..l....5...5..).w.. .h.~..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d88192ac53852604_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.485797221682207
Encrypted:	false
SSDEEP:	3:m+lPHYs8RzYOCGLvHkWBGKuKjXKXqjuSKPWFvwal/dIXRktx91ECcu1isLK5m1:mhYOFLvEWd/aFuBtdIStJEN941
MD5:	2F6BB997FD2E326A5BBA37709986B17F
SHA1:	F0F1C8B3B50B1B0B74B9C137C3761BF23763870C
SHA-256:	01F38D7684A5BE497D1AB19C954BBC641B4D0BB18F59A07EE14FE2F89C2E4EB1
SHA-512:	0F6477D5D962E0B0A5A8EB7E1D763C04A18D8EEE83794A610E2FC49527AC24DD3F8474053A2C84DF9D13EE66970BB4966F95969B55739DC8CAA76DD9B1E41C1B
Malicious:	false
Preview:	0\r..m......W....w.m...._keyhttps://rna-resource.acrobat.com/static/js/plugins/my-recent-files/js/selector.js ...Q..P/....."#.De./....A.A..Eo.......l%............a.f.m.i.o.p..3U5.....^...I.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\de789e80edd740d6_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.51662120596477
Encrypted:	false
SSDEEP:	6:mR9YOFLvEWd7VIGXOdQF0lAt2StQBMqVd3G4K41:2DRuR20isSKB9Vd2
MD5:	8F8E284399A3C4CAEB29BF6033B0E4CA
SHA1:	BF5C22998C8B0346DEC0F95CFB57861EC31D12E9
SHA-256:	EE20292A9285CFA7B3DE1B28B303C798EC73E415C1925B02E6A029C3FA3F9C42
SHA-512:	704C8D0583137B2FBCB1798D881EBE77A96115536D350DCC0B4EDCDA315EEA9E7FE9BB153211B855C1B4E09DE45D4B7EA3D3A0C8CF44D71B6DAEA3BBEE10C812
Malicious:	false
Preview:	0\r..m......P...y.p....._keyhttps://rna-resource.acrobat.com/static/js/plugins/app-center/js/plugin.js ...Q..P/....."#.DP......A.A..Eo.......!.r..........y.$..$.v5j...T...z.]..._S....A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.557649370956887
Encrypted:	false
SSDEEP:	6:mkqYOFLvEWd8CAd9QGltcotFllDuA424r1:+RQXpxsr
MD5:	BA906F3502DB77FDB33FFDF846683B72
SHA1:	C6512A55A493082989422EF9B86F8375ECB53472
SHA-256:	DC1965981BAC7469337DD483732E9F782BFF3CC490A6151AA8EFB0ECD1C6A013
SHA-512:	00B130E788E8547B13475664683B4E6181EA18C949AC8280EA180AA0EBD9B0B789EBFB1C0D5542563660402EA871948512AEC55E199E287BA6E942625E82E59A
Malicious:	false
Preview:	0\r..m......P...gT....._keyhttps://rna-resource.acrobat.com/static/js/plugins/signatures/js/plugin.js ..tQ..P/....."#.D..?....A.A..Eo..................#..@..k(v.8g..5.~_....]Pj.*..6.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f4a0d4ca2f3b95da_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.58392873454031
Encrypted:	false
SSDEEP:	3:m+lS5Etla8RzYOCGLvHkWBGKuKjXKVRNUp/KPWFv//1L9kRktgl7Ag2iHio/Mm1:moXXYOFLvEWdENUAul1L9tbyC8n1
MD5:	8D55D63C5CCBDF76D54A3A7B6D0B2DD4
SHA1:	957F82EE76A16B889A5E24EEBAB3828324946918
SHA-256:	EF5290A9633E5934007A8E556FB7A22465938D5C0BA493D70EC4A9638957F1AC
SHA-512:	BA80E4AC60F54D990BE4A2991447AAF3529E543375F1C5837D81CF1A0ACDC2878C1ADA41919679290DF9B9AF960262C77A90A86C2247E92003D1CB1DC13FCAD0
Malicious:	false
Preview:	0\r..m......R..........._keyhttps://rna-resource.acrobat.com/static/js/plugins/uss-search/js/selector.js .C.I..P/....."#.DB......A.A..Eo..................8.../...;.\\o....1..........+..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	221
Entropy (8bit):	5.596994789210489
Encrypted:	false
SSDEEP:	3:m+lFNrs8RzYOCGLvHkWBGKuKjXKeRKVIJ/2kKLuVc//kcG9kRktvE/sYWmYk5m1:mQZYOFLvEWdrROk/VQPa9tvE/sLmB41
MD5:	88AD3D637A4C91DFA2C03F846E38F919
SHA1:	9068B8C973A9202209D90DCA60ACBC79B7943F3D
SHA-256:	F20574E1CAD077A8DE728FEB5431A67D635A10BD1ADCA09EE2F7CC73AF5B6493
SHA-512:	6A69C903812702DDDFC6AE0AC2082EE4F0C7D6CA439EED3D7CF4BBE06F620B17CEB8B0889F788260BF97EBEF549D28F5AC0D429ED0C7799C138DB42EA7242CC6
Malicious:	false
Preview:	0\r..m......]......,...._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files/js/plugin.js .k-H..P/....."#.D.......A.A..Eo......e.......... ./.ev......N~..6.b.....$.j;:C...A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.565040183022998
Encrypted:	false
SSDEEP:	6:mZ/lXYOFLvEWdccAWuyT4eSEtJ5dm9741:qxRcEEEf5du7
MD5:	BFB1E0BFD547650E0D8D2C598E14AAB1
SHA1:	11356D8D7377419AD0FC11A0B6E546037B9CA638
SHA-256:	AC020FB74E120DCE276617FE93E184DF0170BB2F5CDCBCEFC4516B841C7BE548
SHA-512:	DC12A24801E1A11900C078021D81C3ECD6A2C381824FF08F6C852544D99CDEF19908A54ECDA8256A4FF054492C629393202A58DCF1A9F2766042DC09AFBA7B17
Malicious:	false
Preview:	0\r..m......R...F......._keyhttps://rna-resource.acrobat.com/static/js/plugins/scan-files/js/selector.js ...O..P/....."#.D..-....A.A..Eo.......\............U...I.>P...X...x..0U.~;m.x.k.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.601439502435024
Encrypted:	false
SSDEEP:	3:m+lUg18RzYOCGLvHkWBGKuKjXKrAUWiKPWFvwHt/+LkRktD//2B6shoq+Nem1:mMOYOFLvEWdwAPVuI1+PtD/OB6Jn1
MD5:	62FF3FEE75D6A47F2029EBD8410C365F
SHA1:	23CCB236A8B6C6D7F5B76D21C739D2F6E0DFA0A1
SHA-256:	BA1DA14D79DD90839078685DB5061B5CA3D85740AC10E57611D8B7704B3680E4
SHA-512:	954A0940F1AC6B7DDA4432715265F7642A69956EAB979229093387E105A7F001E75C8DE86D4110E51C0EBE5AFB9ED4C3001ED70CE4689FB483B5DAD9FB5649B5
Malicious:	false
Preview:	0\r..m......L....Ey....._keyhttps://rna-resource.acrobat.com/static/js/plugins/home/js/selector.js .b.I..P/....."#.D.......A.A..Eo.......................k....F..D..O.n;[.1m.....=..A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fdd733564de6fbcb_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	212
Entropy (8bit):	5.63835904638504
Encrypted:	false
SSDEEP:	6:m3PXYOFLvEWdBJvYQXq+ltKISBtTl/AhcsBXIh1:mxRBJQEUI63/4B
MD5:	ACDAA9AB84DF748F3E332D8EB23FA2FD
SHA1:	078D843B39A851E5E3FE399E017BCC634AD26705
SHA-256:	5C877B08292E9E402A0E64EA2E85AC5D82BF9A6BBB96DD0EAA0254A56B778267
SHA-512:	18FAD91D215A2EB31E6683206B69F1302B6F9DE5701696FE1A027E76EBC7FD84BB6627E4C2A09277C7843D82EEBBDC99EB1C1318DACBBDAAA05839E96D334604
Malicious:	false
Preview:	0\r..m......T......z...._keyhttps://rna-resource.acrobat.com/static/js/plugins/activity-badge/js/plugin.js .Y.Q..P/....."#.D.-/....A.A..Eo.....................k..`..N3.... ..d..$[.....{.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.5998858495321455
Encrypted:	false
SSDEEP:	3:m+l4kC8RzYOCGLvHkWBGKuKjXKeRKVIJ/2NAJVKjXKLuVFAt/lAk6Rktn3Rlc3OK:msPYOFLvEWdrROk/RJUQZlPtrc3Me/1
MD5:	D0420A713C4C78DE127E5B6DF1F9A6DC
SHA1:	294EA17FD838BE667076B5A0933373A4B8ACC41E
SHA-256:	DA54A544204AA54FC9C73FEC67C42518EB3E6E4764A1F211EF64BCA5F93F4632
SHA-512:	DE0D42EDD2AEE317BB7A313A79858A43261D4AD948E68609A27A684F0DD04C7B7EA6F50738B1A4EC92AA325DEDD42FF7FCC3C72232F32055EB26E2581617B4C5
Malicious:	false
Preview:	0\r..m......d...<.s....._keyhttps://rna-resource.acrobat.com/static/js/plugins/desktop-connector-files-select/js/plugin.js ...H..P/....."#.D%......A.A..Eo........}..............9Q].8O.z....=..:.N.{....N{.A..Eo..................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	1080
Entropy (8bit):	5.029059890152802
Encrypted:	false
SSDEEP:	24:X4vPA5OnT9AMqOua0R5im8ZD/EX8hKx/61BW:CPpnTWgY8REXlZ8A
MD5:	B891934DBE6EB934EB98792AE7607A9D
SHA1:	F779156AEC614CC860306DEA05F7EDF2CF149B86
SHA-256:	7E74212BE3DEEC52C4BBF57A6883EC1FE28C22DFA0BF20A59829249EBE1B5913
SHA-512:	0AC0E0855746236159D84079AC959B1923A2584CE6C271DDC4DB77D2F36E198341AEC64CE8D73DD867A759FEA1AA4BFD87E10D810DD0C08CA06264C0C3325F13
Malicious:	false
Preview:	0...6...oy retne....+........V...............LH..P/...........;.y~A...9..P/..............oB..9..P/............#...(...A_./.............D.4..LH..P/..........[.i..%..LH..P/.............k7A..LH..P/..........]...I..C...P/...........2q.....LH..P/...........P....V..9..P/.........!...0.o.LH..P/............P[. q.LH..P/...........3....LH..P/..........v...q....9..P/...........a......9..P/..........C..M.....A_./.........,+..._.#.LH..P/.........<...W..J..9..P/..........J..j....LH..P/...........6<\|.....9..P/.........qi.K.L.9@\|..P/.........K..JM.gb@\|..P/.................C...P/.........F..=z;..LH..P/.............o..LH..P/.........Gy.'.h..LH..P/.........:..N.A...LH..P/.................LH..P/..........;/....LH..P/.........A?.2:...LH..P/..............q..LH..P/..........u\]..q.LH..P/..........o..k...LH..P/................LH..P/.........^.~..z..LH..P/..........+.{..'.LH..P/..........@..x..LH..P/.........)....J:.LH..P/..........&.S.....LH..P/............MV3...LH..P/.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	1080
Entropy (8bit):	5.029059890152802
Encrypted:	false
SSDEEP:	24:X4vPA5OnT9AMqOua0R5im8ZD/EX8hKx/61BW:CPpnTWgY8REXlZ8A
MD5:	B891934DBE6EB934EB98792AE7607A9D
SHA1:	F779156AEC614CC860306DEA05F7EDF2CF149B86
SHA-256:	7E74212BE3DEEC52C4BBF57A6883EC1FE28C22DFA0BF20A59829249EBE1B5913
SHA-512:	0AC0E0855746236159D84079AC959B1923A2584CE6C271DDC4DB77D2F36E198341AEC64CE8D73DD867A759FEA1AA4BFD87E10D810DD0C08CA06264C0C3325F13
Malicious:	false
Preview:	0...6...oy retne....+........V...............LH..P/...........;.y~A...9..P/..............oB..9..P/............#...(...A_./.............D.4..LH..P/..........[.i..%..LH..P/.............k7A..LH..P/..........]...I..C...P/...........2q.....LH..P/...........P....V..9..P/.........!...0.o.LH..P/............P[. q.LH..P/...........3....LH..P/..........v...q....9..P/...........a......9..P/..........C..M.....A_./.........,+..._.#.LH..P/.........<...W..J..9..P/..........J..j....LH..P/...........6<\|.....9..P/.........qi.K.L.9@\|..P/.........K..JM.gb@\|..P/.................C...P/.........F..=z;..LH..P/.............o..LH..P/.........Gy.'.h..LH..P/.........:..N.A...LH..P/.................LH..P/..........;/....LH..P/.........A?.2:...LH..P/..............q..LH..P/..........u\]..q.LH..P/..........o..k...LH..P/................LH..P/.........^.~..z..LH..P/..........+.{..'.LH..P/..........@..x..LH..P/.........)....J:.LH..P/..........&.S.....LH..P/............MV3...LH..P/.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index~RF4cd3b9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	1080
Entropy (8bit):	5.029059890152802
Encrypted:	false
SSDEEP:	24:X4vPA5OnT9AMqOua0R5im8ZD/EX8hKx/61BW:CPpnTWgY8REXlZ8A
MD5:	B891934DBE6EB934EB98792AE7607A9D
SHA1:	F779156AEC614CC860306DEA05F7EDF2CF149B86
SHA-256:	7E74212BE3DEEC52C4BBF57A6883EC1FE28C22DFA0BF20A59829249EBE1B5913
SHA-512:	0AC0E0855746236159D84079AC959B1923A2584CE6C271DDC4DB77D2F36E198341AEC64CE8D73DD867A759FEA1AA4BFD87E10D810DD0C08CA06264C0C3325F13
Malicious:	false
Preview:	0...6...oy retne....+........V...............LH..P/...........;.y~A...9..P/..............oB..9..P/............#...(...A_./.............D.4..LH..P/..........[.i..%..LH..P/.............k7A..LH..P/..........]...I..C...P/...........2q.....LH..P/...........P....V..9..P/.........!...0.o.LH..P/............P[. q.LH..P/...........3....LH..P/..........v...q....9..P/...........a......9..P/..........C..M.....A_./.........,+..._.#.LH..P/.........<...W..J..9..P/..........J..j....LH..P/...........6<\|.....9..P/.........qi.K.L.9@\|..P/.........K..JM.gb@\|..P/.................C...P/.........F..=z;..LH..P/.............o..LH..P/.........Gy.'.h..LH..P/.........:..N.A...LH..P/.................LH..P/..........;/....LH..P/.........A?.2:...LH..P/..............q..LH..P/..........u\]..q.LH..P/..........o..k...LH..P/................LH..P/.........^.~..z..LH..P/..........+.{..'.LH..P/..........@..x..LH..P/.........)....J:.LH..P/..........&.S.....LH..P/............MV3...LH..P/.........

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.22106866932705
Encrypted:	false
SSDEEP:	6:kOjYepcN+q2PWXp+N2nKuAl9OmbnIFUtjjYe9XZmwJjYeA3VkwOWXp+N2nKuAl91:kOU1IvaHAahFUtjUg/JUv5fHAaSJ
MD5:	2E7001C32D3007C69E1C881132991D74
SHA1:	338148D453B6A9D517C67D0050824085F35DE07C
SHA-256:	8A4B5C463EB52B3DA59E4E0110015640EF7B72BBB79BC35C7408F0451BF951F3
SHA-512:	84120307564F598C410000072EC2A4DDE7BF2F9695F064531A9325FEC0FBD66EF48896B17CD4A5B6DB04F768FCBF50D6B39F44484DB4E46516606ED5D3184A5D
Malicious:	false
Preview:	2023/01/05-09:02:26.340 728 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/01/05-09:02:26.350 728 Recovering log #3.2023/01/05-09:02:26.351 728 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.22106866932705
Encrypted:	false
SSDEEP:	6:kOjYepcN+q2PWXp+N2nKuAl9OmbnIFUtjjYe9XZmwJjYeA3VkwOWXp+N2nKuAl91:kOU1IvaHAahFUtjUg/JUv5fHAaSJ
MD5:	2E7001C32D3007C69E1C881132991D74
SHA1:	338148D453B6A9D517C67D0050824085F35DE07C
SHA-256:	8A4B5C463EB52B3DA59E4E0110015640EF7B72BBB79BC35C7408F0451BF951F3
SHA-512:	84120307564F598C410000072EC2A4DDE7BF2F9695F064531A9325FEC0FBD66EF48896B17CD4A5B6DB04F768FCBF50D6B39F44484DB4E46516606ED5D3184A5D
Malicious:	false
Preview:	2023/01/05-09:02:26.340 728 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/01/05-09:02:26.350 728 Recovering log #3.2023/01/05-09:02:26.351 728 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF4c4c2a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.22106866932705
Encrypted:	false
SSDEEP:	6:kOjYepcN+q2PWXp+N2nKuAl9OmbnIFUtjjYe9XZmwJjYeA3VkwOWXp+N2nKuAl91:kOU1IvaHAahFUtjUg/JUv5fHAaSJ
MD5:	2E7001C32D3007C69E1C881132991D74
SHA1:	338148D453B6A9D517C67D0050824085F35DE07C
SHA-256:	8A4B5C463EB52B3DA59E4E0110015640EF7B72BBB79BC35C7408F0451BF951F3
SHA-512:	84120307564F598C410000072EC2A4DDE7BF2F9695F064531A9325FEC0FBD66EF48896B17CD4A5B6DB04F768FCBF50D6B39F44484DB4E46516606ED5D3184A5D
Malicious:	false
Preview:	2023/01/05-09:02:26.340 728 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2023/01/05-09:02:26.350 728 Recovering log #3.2023/01/05-09:02:26.351 728 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.010978819626460943
Encrypted:	false
SSDEEP:	3:ImtVdXb+j4x9pPlXlpyPll//zVrzlltD0lGQZ7XEZhGIelHdP4/X:IiVtg4x9pdM//hFwl570ZhdelG/
MD5:	E36F8F81D3C03F6AAF7D768706B7673F
SHA1:	EECE93F9E417717892E50F6A159516DD76C255B0
SHA-256:	C6E687FF9677244574F37AD2877726DF64E5BAADDA2ABE8C4759BDE8344E44F2
SHA-512:	0582ADCFA1A09095D4482C9A61475C8B77FF444BF2655DE4F6583BBB2699A054BBB2292DE2741FEEB27AFE0835B0B48F476418EE1A666DE20CA146D1EB4390A4
Malicious:	false
Preview:	VLnk.....?.......Tq.>..j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-230105170223Z-212.bmp

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PC bitmap, Windows 3.x format, 164 x -115 x 32, cbSize 75494, bits offset 54
Category:	dropped
Size (bytes):	75494
Entropy (8bit):	2.4020228028982116
Encrypted:	false
SSDEEP:	192:zyAByfgu8b4OcFX3EhrFgACR3PUNesB3CRcj0M9VGCf9iuseJDhQBehvv3rvvPJr:zyAByY6rfAYfUNBxRpJFc6V4/I8aHr
MD5:	D67CF064FC7C7ABA560E46285869AEEE
SHA1:	6D641177A756D9794095224A6B5B30FCE45BEEC8
SHA-256:	924E28444D2BB3939F59D6C770E979CAA612C14F33097B31FBA6C513DF3494AE
SHA-512:	235AFDCA6196A55217D9FE0FCDBCFFD31A7D6AA3EAAF169DBF79AB475FE9197B5C0124D104F3F83E7438C3EF64E930578B20727C6E801D120ABFE335F5AA1D63
Malicious:	false
Preview:	BM.&......6...(............. ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3024000, file counter 12, database pages 15, cookie 0x5, schema 4, UTF-8, version-valid-for 12
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	3.564715552600696
Encrypted:	false
SSDEEP:	384:3eI9dThatELJ8fwRRwZsLRGlKhsvXh+vSc:ykYZsLQhUSc
MD5:	B15E8A8F33A5601830E856D5573DF225
SHA1:	A120DEB8D7DE2770921B5B26B9479D7BB124DBBE
SHA-256:	F52C1FC60D6D4C9123ED057BBFC32FA46A56B5595E1C2241388913C7E01CCD21
SHA-512:	9A55432D8AD36DEEF09BB4C5AF61DE9C26A2936A55F921463940F8E910AB100B5B531F03BE53B89C367884C0064176469C565984AD795AAEEB2CA136AD675349
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................$.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.284607295536086
Encrypted:	false
SSDEEP:	48:7M/om1CSiomeiom2om1Nom1Aiom1RROiom1oom1pom1jZiomVsiomgLqQlmFTIFv:7RSVOhnCsLN49IVXEBodRBk8
MD5:	A520C13D5593D1E7086D723EAB60B232
SHA1:	097223BD3549317F09FA926183CAC9960A2F8FF2
SHA-256:	78F75B8E967FD72B85D045446DC89259E2EF6950156A6399FD044E7AB3230A97
SHA-512:	8116921775C1B018AE5BA04A3E10BDDA9DE6B20A9CD27FB1B4E433DF1BFCC746AF2D7DD313BAD3286B6560B98139588308F8BB4F2F80A91B32DE662DFBCCFA50
Malicious:	false
Preview:	.... .c.....Z.>...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s........L.s.y................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.2008

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	157443
Entropy (8bit):	5.172039478677
Encrypted:	false
SSDEEP:	1536:amNTjRlaRlQShhp2VpMKRhWa11quVJzlzofqG9Z0ADWp1ttawvayKLWbVG3+2:RNj3aRlQShhp2VpMKRhWa11quVJX2
MD5:	A2C6972A1A9506ACE991068D7AD37098
SHA1:	BF4D2684587CF034BCFC6F74CED551F9E5316440
SHA-256:	0FB687D20C49DDBADD42ABB489C3B492B5A1893352E2F4B6AA1247EFE7363F65
SHA-512:	4D03884CA5D1652A79E6D55D8F92F4D138C47D462E05C3E6A685DA6742E98841D9C63720727203B913A179892C413BFB33C05416E1675E0CF80DA98BE90BA5E4
Malicious:	false
Preview:	%!Adobe-FontList 1.16.%Locale:0x409..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Marlett.FamilyName:Marlett.StyleName:Regular.MenuName:Marlett.StyleBits:0.WeightClass:500.WidthClass:5.AngleClass:0.FullName:Marlett.WritingScript:Roman.WinName:Marlett.FileLength:27724.NameArray:0,Win,1,Marlett.NameArray:0,Mac,4,Marlett.NameArray:0,Win,1,Marlett.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:ArialMT.FamilyName:Arial.StyleName:Regular.MenuName:Arial.StyleBits:0.WeightClass:400.WidthClass:5.AngleClass:0.FullName:Arial.WritingScript:Roman.WinName:Arial.FileLength:1036584.NameArray:0,Win,1,Arial.NameArray:0,Mac,4,Arial.NameArray:0,Win,1,Arial.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Arial-BoldMT.FamilyName:Arial.StyleName:Bold.MenuName:Arial.StyleBits:2.WeightClass:700.WidthClass:5.AngleClass:0.FullName:Arial Bold.WritingScript:Roman.WinName:Arial Bold.FileLength:980756.NameArray:0,Win,1,Arial.NameArray:0,Mac,4,Arial Bold.NameAr

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	157443
Entropy (8bit):	5.172039478677
Encrypted:	false
SSDEEP:	1536:amNTjRlaRlQShhp2VpMKRhWa11quVJzlzofqG9Z0ADWp1ttawvayKLWbVG3+2:RNj3aRlQShhp2VpMKRhWa11quVJX2
MD5:	A2C6972A1A9506ACE991068D7AD37098
SHA1:	BF4D2684587CF034BCFC6F74CED551F9E5316440
SHA-256:	0FB687D20C49DDBADD42ABB489C3B492B5A1893352E2F4B6AA1247EFE7363F65
SHA-512:	4D03884CA5D1652A79E6D55D8F92F4D138C47D462E05C3E6A685DA6742E98841D9C63720727203B913A179892C413BFB33C05416E1675E0CF80DA98BE90BA5E4
Malicious:	false
Preview:	%!Adobe-FontList 1.16.%Locale:0x409..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Marlett.FamilyName:Marlett.StyleName:Regular.MenuName:Marlett.StyleBits:0.WeightClass:500.WidthClass:5.AngleClass:0.FullName:Marlett.WritingScript:Roman.WinName:Marlett.FileLength:27724.NameArray:0,Win,1,Marlett.NameArray:0,Mac,4,Marlett.NameArray:0,Win,1,Marlett.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:ArialMT.FamilyName:Arial.StyleName:Regular.MenuName:Arial.StyleBits:0.WeightClass:400.WidthClass:5.AngleClass:0.FullName:Arial.WritingScript:Roman.WinName:Arial.FileLength:1036584.NameArray:0,Win,1,Arial.NameArray:0,Mac,4,Arial.NameArray:0,Win,1,Arial.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Arial-BoldMT.FamilyName:Arial.StyleName:Bold.MenuName:Arial.StyleBits:2.WeightClass:700.WidthClass:5.AngleClass:0.FullName:Arial Bold.WritingScript:Roman.WinName:Arial Bold.FileLength:980756.NameArray:0,Win,1,Arial.NameArray:0,Mac,4,Arial Bold.NameAr

C:\Users\user\AppData\Local\Temp\unarchiver.log

Download File

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2068
Entropy (8bit):	5.0863149791147855
Encrypted:	false
SSDEEP:	48:zFJbGYGbYGYGpiGbfGYGp3FkGbeG0FkGQGNGYGYGmHGYGNGYGmbP1+EEEEEEEEEY:x8MjKU9Q
MD5:	8A8E8565CCAA246BA9B71598B7038E38
SHA1:	27578ACD6D50E313A3BA1F5DB05EF479F0F9CF8B
SHA-256:	C783A44B81D1DEE63B86D0B1C036889E1DF5686A911785BBB9AC5F35AA32AFEC
SHA-512:	E7DBC97A56628ED6CA7F5B456AC31C1BC6C79DBF8ECF1B1D3E375F3C197FE2B4F8CC6476B2453A4D9551186EAAF83395A4E628FFA171130E724A0E4A79AF20CC
Malicious:	false
Preview:	01/05/2023 9:03 AM: Unpack: C:\Users\user\Downloads\Cancellation_367461_Dec23.zip..01/05/2023 9:03 AM: Tmp dir: C:\Users\user\AppData\Local\Temp\fgt4alc0.uhe..01/05/2023 9:03 AM: Received from standard out: ..01/05/2023 9:03 AM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..01/05/2023 9:03 AM: Received from standard out: ..01/05/2023 9:03 AM: Received from standard out: Scanning the drive for archives:..01/05/2023 9:03 AM: Received from standard out: 1 file, 801520 bytes (783 KiB)..01/05/2023 9:03 AM: Received from standard out: ..01/05/2023 9:03 AM: Received from standard out: Extracting archive: C:\Users\user\Downloads\Cancellation_367461_Dec23.zip..01/05/2023 9:03 AM: Received from standard out: --..01/05/2023 9:03 AM: Received from standard out: Path = C:\Users\user\Downloads\Cancellation_367461_Dec23.zip..01/05/2023 9:03 AM: Received from standard out: Type = zip..01/05/2023 9:03 AM: Received from standard out: Physical Size

C:\Users\user\Downloads\Cancellation_367461_Dec23.zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	801520
Entropy (8bit):	7.999770193882168
Encrypted:	true
SSDEEP:	24576:wlDW7aQ9CEKLN0rvLPFMDcebEvbm37vcYep11QJ/6dP/z:MDWtKZ0+DczS3TcYefQJ/uP/z
MD5:	26097A602D65D1CC7E47D2A5E5D32895
SHA1:	78868EA9BD5CA1E5B591303C964C74CAC18F76EC
SHA-256:	9D4DD3EFB6149DA52E080EC9E91F1E64C5D0656F488FA78DCD6CE638EE75BA0B
SHA-512:	6BFD8ECCB1C7CE62B06F54728781ECC100389E129A98D831F3FE20DD79BD65CDDE2D91764993624161F906936672A0839790FEBAF86019B8A10BDC26D83D2DF1
Malicious:	false
Preview:	PK...........U....B:....j.....Cancellation#J58.isoya...B.do......;...\.....lk.).w..]..%....a...?.........j..)f...t..\|...-....p..[..47...:..l....8./.ZI.L.Q8...v..E....h...6s.G..P. ../........D.W8..@.g....-...M..}..hU..@.2.+y...D(..m..,.....M.\..k....l..l......Z..4....1a......s.....IA%....<.v.....BU..na.....Z~../H>.P....Z.g..)..b.,1.:..D?..M.x.F.~..Z..w%r'.e..zq6.2...9.v.r.@.a.7........h.FP....[,.S.7N.jO.ZI.(U(...).Qt.#...t ..nE..q...Yo.<..q....q.@...(...7..7!..z.D7...k....d.m...W.N}.V..v.0Ds..L.!.`U....}."........\.g..'..V.#.m...k..Y6+&..i..8..6..H.y@.....::.G..4.t....{....h..;dS.i.....j6.g...{Bl...b`...!#.Ol@.{...v_z.[.e.!....TW.A.[...P`.....+.g.k....:...xh...1'...\|.....~:.`...._.N\|.6.".X^NY.#.aU..{p.../zZ".9.o.\GI....X..d.b.K.@;..P..F/j{.}N?.x...\!..\|...>.T!.ctp.2@-...aU..5S..n.i..........}...xQ....%.x....i...1...~...!....>.GU.p....X.....w..%..../*......Z.;.wI...Ii.3...?Tddl'.D..uf.Io..@....7x...R.....).....U!...n..1.x#I7.M....]......N.&..

C:\Users\user\Downloads\Cancellation_367461_Dec23.zip.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	801520
Entropy (8bit):	7.999770193882168
Encrypted:	true
SSDEEP:	24576:wlDW7aQ9CEKLN0rvLPFMDcebEvbm37vcYep11QJ/6dP/z:MDWtKZ0+DczS3TcYefQJ/uP/z
MD5:	26097A602D65D1CC7E47D2A5E5D32895
SHA1:	78868EA9BD5CA1E5B591303C964C74CAC18F76EC
SHA-256:	9D4DD3EFB6149DA52E080EC9E91F1E64C5D0656F488FA78DCD6CE638EE75BA0B
SHA-512:	6BFD8ECCB1C7CE62B06F54728781ECC100389E129A98D831F3FE20DD79BD65CDDE2D91764993624161F906936672A0839790FEBAF86019B8A10BDC26D83D2DF1
Malicious:	false
Preview:	PK...........U....B:....j.....Cancellation#J58.isoya...B.do......;...\.....lk.).w..]..%....a...?.........j..)f...t..\|...-....p..[..47...:..l....8./.ZI.L.Q8...v..E....h...6s.G..P. ../........D.W8..@.g....-...M..}..hU..@.2.+y...D(..m..,.....M.\..k....l..l......Z..4....1a......s.....IA%....<.v.....BU..na.....Z~../H>.P....Z.g..)..b.,1.:..D?..M.x.F.~..Z..w%r'.e..zq6.2...9.v.r.@.a.7........h.FP....[,.S.7N.jO.ZI.(U(...).Qt.#...t ..nE..q...Yo.<..q....q.@...(...7..7!..z.D7...k....d.m...W.N}.V..v.0Ds..L.!.`U....}."........\.g..'..V.#.m...k..Y6+&..i..8..6..H.y@.....::.G..4.t....{....h..;dS.i.....j6.g...{Bl...b`...!#.Ol@.{...v_z.[.e.!....TW.A.[...P`.....+.g.k....:...xh...1'...\|.....~:.`...._.N\|.6.".X^NY.#.aU..{p.../zZ".9.o.\GI....X..d.b.K.@;..P..F/j{.}N?.x...\!..\|...>.T!.ctp.2@-...aU..5S..n.i..........}...xQ....%.x....i...1...~...!....>.GU.p....X.....w..%..../*......Z.;.wI...Ii.3...?Tddl'.D..uf.Io..@....7x...R.....).....U!...n..1.x#I7.M....]......N.&..

C:\Users\user\Downloads\f1db83af-6dc2-44be-ad08-ad1b8f6a393d.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	12426
Entropy (8bit):	7.986045610697938
Encrypted:	false
SSDEEP:	192:wQq1Fv+lodYd9vhN+W7rHGeZfn2BR/zPAfo028LiuOUlOiCo6r+XR7raexT4qR6E:/q1uFJE0tB4ZzMX95OUU9sdeOT7tjJn
MD5:	D09E144A7ED978AF106E813070C6DC12
SHA1:	DD127F78FB8FE3C55876927E6BDA8A3D9FA64CD3
SHA-256:	DFBDA2E1C8DFD9AB61E6E0522699E498499FBD6CAD02ABE3D90E51CACB2D2AC5
SHA-512:	1C15B50BB02885F72D99E997A2F86DDF83CAF12F2AE9E56704188DB302DB696A127D28EF5242B24D0AD9CB18B6F595707189C3A23D3335E0BD2CD544E84BD51B
Malicious:	false
Preview:	PK...........U....B:....j.....Cancellation#J58.isoya...B.do......;...\.....lk.).w..]..%....a...?.........j..)f...t..\|...-....p..[..47...:..l....8./.ZI.L.Q8...v..E....h...6s.G..P. ../........D.W8..@.g....-...M..}..hU..@.2.+y...D(..m..,.....M.\..k....l..l......Z..4....1a......s.....IA%....<.v.....BU..na.....Z~../H>.P....Z.g..)..b.,1.:..D?..M.x.F.~..Z..w%r'.e..zq6.2...9.v.r.@.a.7........h.FP....[,.S.7N.jO.ZI.(U(...).Qt.#...t ..nE..q...Yo.<..q....q.@...(...7..7!..z.D7...k....d.m...W.N}.V..v.0Ds..L.!.`U....}."........\.g..'..V.#.m...k..Y6+&..i..8..6..H.y@.....::.G..4.t....{....h..;dS.i.....j6.g...{Bl...b`...!#.Ol@.{...v_z.[.e.!....TW.A.[...P`.....+.g.k....:...xh...1'...\|.....~:.`...._.N\|.6.".X^NY.#.aU..{p.../zZ".9.o.\GI....X..d.b.K.@;..P..F/j{.}N?.x...\!..\|...>.T!.ctp.2@-...aU..5S..n.i..........}...xQ....%.x....i...1...~...!....>.GU.p....X.....w..%..../*......Z.;.wI...Ii.3...?Tddl'.D..uf.Io..@....7x...R.....).....U!...n..1.x#I7.M....]......N.&..

Static File Info

General

File type:	PDF document, version 1.3, 1 pages
Entropy (8bit):	7.795798037764297
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Cancellation_418406_Dec23.pdf
File size:	186639
MD5:	c085bbddc02251986f1fd8b84c5a404e
SHA1:	98d3377ff32441e24baa96f1d0fd83190e274c22
SHA256:	ca2d98108f12fb407cb0e1778febc9ff453ebbd8888e3b184cb8b9993775b5d8
SHA512:	02fef8a38f843cec18a6ca0e80cbb1ee23659534bab963d7ef0e8b522c2de1787666bfa4970c4d34d701ec4f652ba8bc583adca517fe5679e9d985bd2a3da59c
SSDEEP:	3072:fQcfk8aPgtSyiVLFkckuQMPhB20K8HR9hYDdfddlRCFwfkFPWN50kNSFHFUmV8N1:W8nwhFkZuvPDiYqdfddlVjbr03UmVruv
TLSH:	3504E0CCB13B76BFE8B77BB3A562835D374F6525732E6687088992A4C301F42D4510AE
File Content Preview:	%PDF-1.3.3 0 obj.<</Type /Page./Parent 1 0 R./Resources 2 0 R./Annots [5 0 R ]./Contents 4 0 R>>.endobj.4 0 obj.<</Filter /FlateDecode /Length 59>>.stream.x.3R..2.35W(.*T.01.32U0.BSKS=S C..@A.@..H!9WA..P.%_!... 4...endstream.endobj.5 0 obj.<</Type /Annot

File Icon


Icon Hash:	74ecccdcd4ccccf0

Static PDF Info

General
Header:	%PDF-1.3
Total Entropy:	7.795798
Total Bytes:	186639
Stream Entropy:	7.794817
Stream Bytes:	185459
Entropy outside Streams:	5.173523
Bytes outside Streams:	1180
Number of EOF found:	1
Bytes after EOF:

Keywords Statistics

Name	Count
obj	8
endobj	8
stream	2
endstream	2
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5	Preview
6	66f76b6664006000	fde72814e2e16d5b1a82d3b7cf0921d8

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2023 09:03:45.665621042 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:45.666202068 CET	49699	443	192.168.2.3	142.250.184.78
Jan 5, 2023 09:03:45.666264057 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:45.666347027 CET	49699	443	192.168.2.3	142.250.184.78
Jan 5, 2023 09:03:45.667125940 CET	49701	443	192.168.2.3	142.251.209.13
Jan 5, 2023 09:03:45.667155981 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:45.667221069 CET	49701	443	192.168.2.3	142.251.209.13
Jan 5, 2023 09:03:45.681859016 CET	49702	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:45.682480097 CET	49699	443	192.168.2.3	142.250.184.78
Jan 5, 2023 09:03:45.682548046 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:45.683199883 CET	49701	443	192.168.2.3	142.251.209.13
Jan 5, 2023 09:03:45.683228016 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:45.806641102 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:45.813993931 CET	49701	443	192.168.2.3	142.251.209.13
Jan 5, 2023 09:03:45.814045906 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:45.815979004 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:45.816091061 CET	49701	443	192.168.2.3	142.251.209.13
Jan 5, 2023 09:03:45.823188066 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:45.823334932 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:45.823719978 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:45.839335918 CET	80	49702	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:45.839426994 CET	49702	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:45.854161978 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:45.854439020 CET	49699	443	192.168.2.3	142.250.184.78
Jan 5, 2023 09:03:45.854484081 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:45.855062008 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:45.855139017 CET	49699	443	192.168.2.3	142.250.184.78
Jan 5, 2023 09:03:45.855910063 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:45.855979919 CET	49699	443	192.168.2.3	142.250.184.78
Jan 5, 2023 09:03:45.980948925 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:46.144690037 CET	49701	443	192.168.2.3	142.251.209.13
Jan 5, 2023 09:03:46.144759893 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:46.144988060 CET	49701	443	192.168.2.3	142.251.209.13
Jan 5, 2023 09:03:46.145015955 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:46.145217896 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:46.145606995 CET	49699	443	192.168.2.3	142.250.184.78
Jan 5, 2023 09:03:46.145653963 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:46.145747900 CET	49699	443	192.168.2.3	142.250.184.78
Jan 5, 2023 09:03:46.145764112 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:46.146033049 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:46.192888975 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:46.193018913 CET	49699	443	192.168.2.3	142.250.184.78
Jan 5, 2023 09:03:46.193053007 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:46.193342924 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:46.193413019 CET	49699	443	192.168.2.3	142.250.184.78
Jan 5, 2023 09:03:46.195028067 CET	49699	443	192.168.2.3	142.250.184.78
Jan 5, 2023 09:03:46.195064068 CET	443	49699	142.250.184.78	192.168.2.3
Jan 5, 2023 09:03:46.214713097 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:46.214826107 CET	49701	443	192.168.2.3	142.251.209.13
Jan 5, 2023 09:03:46.214858055 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:46.215186119 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:46.215260029 CET	49701	443	192.168.2.3	142.251.209.13
Jan 5, 2023 09:03:46.216869116 CET	49701	443	192.168.2.3	142.251.209.13
Jan 5, 2023 09:03:46.216905117 CET	443	49701	142.251.209.13	192.168.2.3
Jan 5, 2023 09:03:48.063569069 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.063642025 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.063687086 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.063714027 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.063734055 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.063755989 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.063781023 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.063797951 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.063807964 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.063849926 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.063875914 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.063901901 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.063932896 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.063934088 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.063934088 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.221364021 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221400023 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221451044 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221481085 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221508026 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221533060 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221560955 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221589088 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221616983 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221647024 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221652985 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.221652985 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.221652985 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.221652985 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.221652985 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.221673965 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221702099 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221729994 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221733093 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.221759081 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.221882105 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.221882105 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.379358053 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.379399061 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.379429102 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.379458904 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.379489899 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.379523039 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.379523039 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.379549980 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.379580975 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.379581928 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.379580975 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.379627943 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.437524080 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.536957979 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.537009954 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.537039042 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.537066936 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.537092924 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.537120104 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.537146091 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.537173986 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.537177086 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.537177086 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.537177086 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.537201881 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.537229061 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.537256002 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.537282944 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.537311077 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.537319899 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.537319899 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.537319899 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.596995115 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.597079992 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.597786903 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.694981098 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.695040941 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.695086956 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.695130110 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.695189953 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.695238113 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.695239067 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.695239067 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.695249081 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.695302963 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.695347071 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.695389986 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.695434093 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.695480108 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.695528984 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.695528984 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.695528984 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.695532084 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.695578098 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.695622921 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.695664883 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.695708990 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.695751905 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.695790052 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.695790052 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.695790052 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.695796013 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.735821009 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.755366087 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.755428076 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.755477905 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.755527973 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.755579948 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.755579948 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.853070021 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.853157997 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.853212118 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.853295088 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.853579998 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.853651047 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.853835106 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.853871107 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.853899956 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.853914022 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.853929043 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.853955984 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.853962898 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.853984118 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.854011059 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.854033947 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.854068041 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.854095936 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.854104042 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.854124069 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.854151964 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.854159117 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.854180098 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.854207039 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.854213953 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.854235888 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.854264021 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.854274988 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.854291916 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.854321003 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.854347944 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.854367971 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.854391098 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.854394913 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.854423046 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.854450941 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.854459047 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.854479074 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.854515076 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.872659922 CET	49705	443	192.168.2.3	142.250.184.36
Jan 5, 2023 09:03:48.872708082 CET	443	49705	142.250.184.36	192.168.2.3
Jan 5, 2023 09:03:48.872790098 CET	49705	443	192.168.2.3	142.250.184.36
Jan 5, 2023 09:03:48.873281956 CET	49705	443	192.168.2.3	142.250.184.36
Jan 5, 2023 09:03:48.873301983 CET	443	49705	142.250.184.36	192.168.2.3
Jan 5, 2023 09:03:48.893250942 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.893285036 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.893352985 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.912873983 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.912906885 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.912949085 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.912951946 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.912976027 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.913000107 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.913012981 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.913027048 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:48.913064003 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:48.952358961 CET	443	49705	142.250.184.36	192.168.2.3
Jan 5, 2023 09:03:48.952975988 CET	49705	443	192.168.2.3	142.250.184.36
Jan 5, 2023 09:03:48.953010082 CET	443	49705	142.250.184.36	192.168.2.3
Jan 5, 2023 09:03:48.954538107 CET	443	49705	142.250.184.36	192.168.2.3
Jan 5, 2023 09:03:48.954668045 CET	49705	443	192.168.2.3	142.250.184.36
Jan 5, 2023 09:03:48.957395077 CET	49705	443	192.168.2.3	142.250.184.36
Jan 5, 2023 09:03:48.957412958 CET	443	49705	142.250.184.36	192.168.2.3
Jan 5, 2023 09:03:48.957525969 CET	443	49705	142.250.184.36	192.168.2.3
Jan 5, 2023 09:03:49.011776924 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.011826038 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.011846066 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.011876106 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.011892080 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.011919022 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.011929989 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.011946917 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.011966944 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.011982918 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.012001991 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012037039 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012037992 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.012063980 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012090921 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012099028 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.012125969 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012155056 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012159109 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.012187004 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012219906 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.012228966 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012273073 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012306929 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.012309074 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012341976 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012370110 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012376070 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.012397051 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012432098 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.012432098 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012486935 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012506008 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012526035 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012531996 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.012546062 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012562037 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.012564898 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012584925 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012598038 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.012604952 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012624025 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012638092 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.012644053 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012664080 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012679100 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.012684107 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012702942 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012717962 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.012722969 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012742043 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.012742996 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012759924 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.012762070 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012777090 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.012784004 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012800932 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.012803078 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012818098 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.012823105 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012842894 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.012842894 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.012856007 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.012878895 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.035839081 CET	49705	443	192.168.2.3	142.250.184.36
Jan 5, 2023 09:03:49.035873890 CET	443	49705	142.250.184.36	192.168.2.3
Jan 5, 2023 09:03:49.050890923 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.050945997 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.051011086 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.070400953 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.070475101 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.070512056 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.070548058 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.070588112 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.070599079 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.070622921 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.070637941 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.070658922 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.070660114 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.070709944 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.070749998 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.135833979 CET	49705	443	192.168.2.3	142.250.184.36
Jan 5, 2023 09:03:49.170106888 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.170160055 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.170217037 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.170238972 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.170284986 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.170309067 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.170331001 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.170332909 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.170358896 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.170377970 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.170404911 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.170428991 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.170434952 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.170483112 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.170525074 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.170532942 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.170583963 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.170620918 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.170634031 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.170667887 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.170706987 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.170713902 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.170747995 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.170789957 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.170794964 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.170818090 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.170841932 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.170866013 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.170892954 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.170896053 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.170922995 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.170928001 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.170953035 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.170963049 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.170978069 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.171001911 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.171016932 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.171025038 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.171050072 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.171056032 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.171073914 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.171097994 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.171123028 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.171123981 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.171147108 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.171159983 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.171170950 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.171194077 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.171224117 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.171240091 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.171262026 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.171278954 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.171286106 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.171294928 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.171327114 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.208471060 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.228164911 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.228208065 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.228255033 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.228255033 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.228297949 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.228364944 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.328591108 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.328646898 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.328663111 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.328691959 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.328731060 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.328742027 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.328814983 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.328850985 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.328859091 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.328898907 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.328933001 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.328954935 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.329000950 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.329035997 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.329041958 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.329082966 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.329121113 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.329301119 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.329372883 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.329417944 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.329418898 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.329466105 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.329504967 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.329514027 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.329560995 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.329602003 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.329611063 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.329658031 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.329698086 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.329704046 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.329751968 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.329790115 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.329797983 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.329845905 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.329884052 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.329919100 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.329965115 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.330003977 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.330010891 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.330056906 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.330096006 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.330102921 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.330149889 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.330194950 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.330208063 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.330240965 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.330264091 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.330276012 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.330286980 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.330327988 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.330332041 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.330372095 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.330379963 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.330424070 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.330430031 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.330467939 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.330476999 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.330523968 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.330524921 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.330569983 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.330609083 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.330617905 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.330663919 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.330705881 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.330733061 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.330780029 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.330825090 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.330826044 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.330872059 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.330909967 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.330919981 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.385796070 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.385863066 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.385869980 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.385911942 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.385920048 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.385955095 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.385971069 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.386014938 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.488435030 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.488512039 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.488558054 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.488559961 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.488615990 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.488655090 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.488665104 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.488713026 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.488753080 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.488761902 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.488811016 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.488853931 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.488857985 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.488904953 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.488943100 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.488955021 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.489006042 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.489042997 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.489053011 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.489099979 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.489136934 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.489146948 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.489195108 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.489229918 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.489240885 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.489286900 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.489324093 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.489334106 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.489382982 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.489414930 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.489428043 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.489475012 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.489512920 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.489520073 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.489566088 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.489602089 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.489614010 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.489660978 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.489696026 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.489708900 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.489756107 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.489792109 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.489801884 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.489847898 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.489886045 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.489895105 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.489943027 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.489989996 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.489990950 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.490027905 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.490039110 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.490086079 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.490101099 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.490118980 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.490134001 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.490179062 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.490186930 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.490216970 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.490226030 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.490272999 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.490304947 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.490319014 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.490319967 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.490358114 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.490365982 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.490406990 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.490412951 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.490459919 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.490495920 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.490506887 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.490552902 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.490588903 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.490600109 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.490650892 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.490686893 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.490725040 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.490772009 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.490812063 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.490817070 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.490856886 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.490863085 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.490900040 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.490910053 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.490948915 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.490957975 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.490993023 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.491003036 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.491049051 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.491050005 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.491094112 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.491095066 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.491139889 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.491187096 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.491189957 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.491235018 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.491276026 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.491281986 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.491331100 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.491369963 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.491375923 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.491425037 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.491460085 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.491470098 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.491516113 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.491561890 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.491583109 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.491609097 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.491648912 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.491653919 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.491703033 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.491739035 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.491748095 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.491795063 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.491836071 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.491839886 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.508028984 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.543433905 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.543510914 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.543585062 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.543617964 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.543669939 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.543711901 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.543715954 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.543764114 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.543802977 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.649301052 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.649370909 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.649421930 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.649437904 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.649470091 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.649512053 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.649521112 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.649570942 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.649612904 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.649621964 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.649671078 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.649709940 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.649719954 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.649768114 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.649812937 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.649815083 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.649863958 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.649908066 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.649910927 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.649960995 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.650005102 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.650007010 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.650054932 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.650094032 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.650104046 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.650145054 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.650152922 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.650190115 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.650198936 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.650235891 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.650248051 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.650285006 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.650295973 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.650336981 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.650341988 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.650391102 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.650430918 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.650439024 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.650490046 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.650542021 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.650588036 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.650590897 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.650641918 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.650643110 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.650717020 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.650760889 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.650765896 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.650813103 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.650856972 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.650857925 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.650902033 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.650938988 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.650945902 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.650989056 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.651026011 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.651032925 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.651077986 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.651120901 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.651123047 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.651170015 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.651211023 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.651215076 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.651258945 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.651299000 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.651305914 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.651350975 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.651391029 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.651393890 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.651437998 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.651475906 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.651480913 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.651525974 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.651570082 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.651588917 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.651614904 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.651665926 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.651665926 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.651714087 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.651758909 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.651809931 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.651839018 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.651901007 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.651901960 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.653283119 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.665685892 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.665743113 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.665760040 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.665788889 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.665832996 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.665837049 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.665885925 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.665925026 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.665931940 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.665980101 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.666016102 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.666026115 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.666073084 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.666107893 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.666117907 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.666165113 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.666203022 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.666212082 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.666256905 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.666290998 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.666304111 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.666349888 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.666383982 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.666393995 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.666440964 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.666476011 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.666486979 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.701330900 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.701411963 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.701462984 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.701479912 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.701508999 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.701518059 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.701555967 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.701595068 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.701603889 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.701653957 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.701690912 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.701699972 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.701745987 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.701781988 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.701792002 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.701838970 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.701874018 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.701884031 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.701932907 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.701970100 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.701981068 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.702028990 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.702064991 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.702075958 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.702122927 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.702161074 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.702168941 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.702217102 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.702256918 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.702263117 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.702311993 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.702351093 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.702359915 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.809315920 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.809392929 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.809425116 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.809439898 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.809482098 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.809488058 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.809534073 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.809571028 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.809586048 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.809638023 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.809678078 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.809685946 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.809731960 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.809771061 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.809779882 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.809827089 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.809865952 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.809875011 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.809922934 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.809961081 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.809969902 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.810019016 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.810058117 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.810067892 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.810117960 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.810156107 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.810165882 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.810214043 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.810251951 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.810261011 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.810309887 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.810348988 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.810357094 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.810405970 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.810444117 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.810451984 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.810502052 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.810539961 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.810549974 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.810599089 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.810636997 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.810647964 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.810729027 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.810780048 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.810781956 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.810830116 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.810868979 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.810877085 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.810925961 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.810965061 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.810971022 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.811017036 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.811054945 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.811062098 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.811108112 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.811146021 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.811152935 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.811196089 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.811233997 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.811242104 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.811285973 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.811322927 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.811330080 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.811377048 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.811414957 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.811419964 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.811465025 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.811501980 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.811511040 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.811554909 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.811592102 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.811598063 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.811649084 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.811686039 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.811693907 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.811742067 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.811780930 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.811788082 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.811836958 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.811875105 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.811883926 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.811929941 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.811969042 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.811975002 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.812022924 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.812066078 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.812067032 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.812107086 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.812115908 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.812154055 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.812164068 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.812202930 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.812211037 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.812254906 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.812258005 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.812304974 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.812309980 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.812351942 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.812391996 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.812398911 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.812444925 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.812483072 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.812491894 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.812539101 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.812582016 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.812587976 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.812637091 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.812676907 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.812685013 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.812731981 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.812772036 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.812779903 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.812827110 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.812872887 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.812874079 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.812920094 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.812966108 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.812971115 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.813014030 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.813055992 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.813060999 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.813114882 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.813159943 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.815376043 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.823852062 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.823920012 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.823961973 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.823971987 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.824002028 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.824043036 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.824044943 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.824084997 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.824124098 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.824124098 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.824170113 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.824208021 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.824210882 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.824248075 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.824285984 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.824286938 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.824327946 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.824366093 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.824366093 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.824407101 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.824445963 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.824446917 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.824487925 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.824527979 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.824528933 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.824568033 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.824605942 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.824606895 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.824650049 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.824688911 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.824690104 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.824731112 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.824769020 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.824770927 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.824811935 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.824851990 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.824857950 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.824892044 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.824932098 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.859888077 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.859971046 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.860022068 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.860081911 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.860093117 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.860140085 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.860146046 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.860193014 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.860229969 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.860239029 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.860285044 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.860321045 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.860331059 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.860380888 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.860414982 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.860426903 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.860474110 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.860510111 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.860522032 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.860569000 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.860605955 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.860614061 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.860665083 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.860702991 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.860711098 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.860759020 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.860797882 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.860805988 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.860853910 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.860889912 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.860899925 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.860948086 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.860986948 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.860994101 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.861042023 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.861077070 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.861088037 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.861135960 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.861171007 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.861185074 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.861232996 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.861267090 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.861278057 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.861325979 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.861367941 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.861370087 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.861421108 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.861455917 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.970561028 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.970632076 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.970685005 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.970689058 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.970760107 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.970803022 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.970804930 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.970853090 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.970897913 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.970900059 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.970952988 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.970994949 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.970997095 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.971045971 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.971087933 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.971090078 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.971138954 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.971179008 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.971182108 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.971229076 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.971268892 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.971275091 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.971321106 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.971359968 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.971364021 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.971410990 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.971451044 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.971453905 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.971502066 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.971541882 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.971548080 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.971594095 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.971637011 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.971638918 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.971689939 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.971729040 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.971736908 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.971786976 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.971827030 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.971832991 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.971880913 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.971920013 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.971927881 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.971976995 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.972023964 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.972024918 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.972071886 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.972111940 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.972117901 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.972166061 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.972204924 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.972212076 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.972256899 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.972296953 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.972302914 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.972349882 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.972388983 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.972394943 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.972441912 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.972481966 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.972489119 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.972536087 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.972574949 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.972582102 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.972629070 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.972676039 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.972677946 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.972726107 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.972764969 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.972773075 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.972820044 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.972865105 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.972866058 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.972913980 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.972953081 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.972960949 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.973010063 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.973050117 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.973057032 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.973104954 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.973145008 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.973153114 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.973200083 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.973242044 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.973247051 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.973294973 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.973337889 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.973340988 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.973387957 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.973433971 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.973433018 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.973481894 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.973521948 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.973529100 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.973576069 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.973614931 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.973622084 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.973673105 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.973711967 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.973720074 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.973767996 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.973805904 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.973814964 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.973862886 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.973905087 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.973910093 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.973956108 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.973994017 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.974001884 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.974047899 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:49.974085093 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:49.980815887 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:54.861654997 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:54.861841917 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:55.164216995 CET	49698	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:03:55.321816921 CET	80	49698	50.62.149.105	192.168.2.3
Jan 5, 2023 09:03:58.919450998 CET	443	49705	142.250.184.36	192.168.2.3
Jan 5, 2023 09:03:58.919549942 CET	443	49705	142.250.184.36	192.168.2.3
Jan 5, 2023 09:03:58.919650078 CET	49705	443	192.168.2.3	142.250.184.36
Jan 5, 2023 09:04:00.808644056 CET	49705	443	192.168.2.3	142.250.184.36
Jan 5, 2023 09:04:00.808687925 CET	443	49705	142.250.184.36	192.168.2.3
Jan 5, 2023 09:04:17.333237886 CET	80	49702	50.62.149.105	192.168.2.3
Jan 5, 2023 09:04:17.333431005 CET	49702	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:04:30.852730036 CET	49702	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:04:31.010540962 CET	80	49702	50.62.149.105	192.168.2.3
Jan 5, 2023 09:04:48.869604111 CET	49702	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:04:48.870382071 CET	49724	443	192.168.2.3	142.250.184.36
Jan 5, 2023 09:04:48.870445013 CET	443	49724	142.250.184.36	192.168.2.3
Jan 5, 2023 09:04:48.881270885 CET	49724	443	192.168.2.3	142.250.184.36
Jan 5, 2023 09:04:48.881555080 CET	49724	443	192.168.2.3	142.250.184.36
Jan 5, 2023 09:04:48.881592989 CET	443	49724	142.250.184.36	192.168.2.3
Jan 5, 2023 09:04:48.955430031 CET	443	49724	142.250.184.36	192.168.2.3
Jan 5, 2023 09:04:48.956141949 CET	49724	443	192.168.2.3	142.250.184.36
Jan 5, 2023 09:04:48.956195116 CET	443	49724	142.250.184.36	192.168.2.3
Jan 5, 2023 09:04:48.957493067 CET	443	49724	142.250.184.36	192.168.2.3
Jan 5, 2023 09:04:48.958540916 CET	49724	443	192.168.2.3	142.250.184.36
Jan 5, 2023 09:04:48.958570004 CET	443	49724	142.250.184.36	192.168.2.3
Jan 5, 2023 09:04:48.958700895 CET	443	49724	142.250.184.36	192.168.2.3
Jan 5, 2023 09:04:49.001255989 CET	49724	443	192.168.2.3	142.250.184.36
Jan 5, 2023 09:04:49.027427912 CET	80	49702	50.62.149.105	192.168.2.3
Jan 5, 2023 09:04:49.027667999 CET	49702	80	192.168.2.3	50.62.149.105
Jan 5, 2023 09:04:58.966501951 CET	443	49724	142.250.184.36	192.168.2.3
Jan 5, 2023 09:04:58.966588974 CET	443	49724	142.250.184.36	192.168.2.3
Jan 5, 2023 09:04:58.966730118 CET	49724	443	192.168.2.3	142.250.184.36

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2023 09:03:31.990242004 CET	57840	53	192.168.2.3	8.8.8.8
Jan 5, 2023 09:03:32.011425972 CET	53	57840	8.8.8.8	192.168.2.3
Jan 5, 2023 09:03:45.622262001 CET	60625	53	192.168.2.3	8.8.8.8
Jan 5, 2023 09:03:45.626640081 CET	49302	53	192.168.2.3	8.8.8.8
Jan 5, 2023 09:03:45.626899958 CET	53975	53	192.168.2.3	8.8.8.8
Jan 5, 2023 09:03:45.643832922 CET	53	60625	8.8.8.8	192.168.2.3
Jan 5, 2023 09:03:45.645402908 CET	53	53975	8.8.8.8	192.168.2.3
Jan 5, 2023 09:03:45.652929068 CET	53	49302	8.8.8.8	192.168.2.3
Jan 5, 2023 09:03:48.831399918 CET	60582	53	192.168.2.3	8.8.8.8
Jan 5, 2023 09:03:48.851125956 CET	53	60582	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 5, 2023 09:03:31.990242004 CET	192.168.2.3	8.8.8.8	0x58c	Standard query (0)	agapeministriesinternational.church	A (IP address)	IN (0x0001)	false
Jan 5, 2023 09:03:45.622262001 CET	192.168.2.3	8.8.8.8	0xf0a5	Standard query (0)	agapeministriesinternational.church	A (IP address)	IN (0x0001)	false
Jan 5, 2023 09:03:45.626640081 CET	192.168.2.3	8.8.8.8	0x7cc1	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Jan 5, 2023 09:03:45.626899958 CET	192.168.2.3	8.8.8.8	0x9e81	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Jan 5, 2023 09:03:48.831399918 CET	192.168.2.3	8.8.8.8	0xd046	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 5, 2023 09:03:32.011425972 CET	8.8.8.8	192.168.2.3	0x58c	No error (0)	agapeministriesinternational.church		50.62.149.105	A (IP address)	IN (0x0001)	false
Jan 5, 2023 09:03:45.643832922 CET	8.8.8.8	192.168.2.3	0xf0a5	No error (0)	agapeministriesinternational.church		50.62.149.105	A (IP address)	IN (0x0001)	false
Jan 5, 2023 09:03:45.645402908 CET	8.8.8.8	192.168.2.3	0x9e81	No error (0)	accounts.google.com		142.251.209.13	A (IP address)	IN (0x0001)	false
Jan 5, 2023 09:03:45.652929068 CET	8.8.8.8	192.168.2.3	0x7cc1	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 5, 2023 09:03:45.652929068 CET	8.8.8.8	192.168.2.3	0x7cc1	No error (0)	clients.l.google.com		142.250.184.78	A (IP address)	IN (0x0001)	false
Jan 5, 2023 09:03:48.851125956 CET	8.8.8.8	192.168.2.3	0xd046	No error (0)	www.google.com		142.250.184.36	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

accounts.google.com

clients2.google.com

agapeministriesinternational.church

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49701	142.251.209.13	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49699	142.250.184.78	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49698	50.62.149.105	80	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2023 09:03:45.823719978 CET	114	OUT	GET /blog/Cancellation_367461_Dec23.zip HTTP/1.1 Host: agapeministriesinternational.church Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 5, 2023 09:03:48.063569069 CET	453	IN	HTTP/1.1 200 OK Date: Thu, 05 Jan 2023 08:03:45 GMT Server: Apache X-Powered-By: PHP/8.1.13 Connection: keep-alive, Keep-Alive Accept-Ranges: bytes Expires: 0 Cache-Control: no-cache, no-store, must-revalidate Content-Disposition: attachment; filename="Cancellation_367461_Dec23.zip" Upgrade: h2,h2c Connection: Upgrade Content-Length: 801520 Vary: Accept-Encoding Keep-Alive: timeout=5 Content-Type: application/zip Data Raw: 50 4b 03 04 14 00 01 00 08 00 02 9c 97 55 e0 d4 f8 ae 42 3a 0c 00 00 d0 6a 06 14 00 00 00 43 61 6e 63 65 6c 6c 61 74 69 6f 6e 23 4a 35 38 2e 69 73 6f 79 61 b4 0c 99 42 96 64 6f 83 91 a6 87 9a e5 3b a7 9b fa 5c ce db 83 0b 04 d9 b6 6c 6b c0 29 f7 77 06 99 5d 89 d8 25 f7 83 d0 e7 99 b5 61 ec 80 11 0d 3f ab ff b3 1e 8a da 89 07 00 17 6a ec e6 29 66 86 ed bf 05 74 c7 c4 7c 06 90 e2 b0 2d 93 97 cf c9 70 ab d3 95 5b b2 ed 34 37 cb cb 9b c8 3a fb be 6c 97 18 a2 80 38 1b 2f 9a 5a 49 9d 4c 08 51 38 eb d6 d9 76 b8 dd 45 e0 a7 da c5 f3 68 1d 93 e1 36 73 17 47 c3 84 d1 50 b0 20 e0 0f 2f 1c ba ad 94 8c d5 01 a0 44 c8 57 38 0e b7 40 e6 67 9d e3 e4 b7 ef 2d a6 da d8 4d ff be 7d a9 a8 68 55 a3 aa 40 fb 32 c8 a1 2b 79 c1 e4 f5 44 28 a9 e8 6d 90 d7 2c f8 a6 a7 d3 f7 4d cd 5c 12 87 6b 1c a6 df da 6c f4 db 85 6c 02 12 db 8a f5 b8 f3 5a 1e 09 34 9b f1 09 d4 31 61 ec dd 98 ce d0 fe 90 73 1d 8f ff 0f 0a 49 41 25 be 0a 11 13 3c 09 76 9f c6 c9 0c b8 42 55 a2 ef 6e 61 a6 e8 c0 f4 02 5a 7e fd c2 2f 48 3e 80 50 95 ce 2e f5 5a 93 67 db cd b2 29 e5 bb 9d 0e 62 e2 2c 31 ec 3a 10 92 44 3f 90 c3 4d 8d 78 1d 46 c1 7e f6 97 5a 08 bd 77 25 72 27 e9 80 65 ae d6 7a 71 36 ea b4 32 04 2e c4 39 00 76 fb 72 d4 40 ac 61 a6 37 85 ca f3 1f 0b a9 1c 0b 68 b6 46 50 87 c1 02 a6 5b 2c 19 53 aa 37 4e c9 91 6a 4f fa 5a 49 aa 28 55 28 fd 13 fb 29 bf 51 74 1d 23 18 cd 17 74 20 81 cf a2 6e 45 2e e2 71 c9 01 18 59 6f e6 8c 3c 09 1d 71 f9 92 87 c1 71 d9 40 fd e3 16 28 8a 86 ff 37 d4 e6 37 21 18 c0 7a 7f 44 37 e6 8d 17 12 6b 93 fb a5 8d 64 de 6d a5 1b fd 57 d9 4e 7d e0 56 b6 c1 76 c0 30 44 73 e9 a2 7f 4c 05 21 0a 60 55 17 f4 b7 da 7d ef 80 22 eb f8 df f2 e7 c0 f3 e9 96 5c 9a 67 ea 0a 27 b1 9a 56 9e 23 db 96 6d 10 a6 9b 6b e5 a2 e2 59 36 2b 26 9e 1b 69 9c d3 38 14 c6 36 f0 da 48 f3 79 40 c9 e2 7f dd 9d bf 3a 3a 05 47 80 07 34 e3 74 1e e4 0f 97 7b ae 19 c5 d9 68 9b df 3b 64 53 bf 69 af 0c bf 9c 9c 6a 36 18 67 ab 81 08 7b 42 6c 0d cd e1 62 60 11 a4 a7 21 23 a0 4f 6c 40 f5 7b 11 1d f0 76 5f 7a 8a 5b 2e 65 7f 21 1e 86 b6 19 54 57 b5 41 94 5b 90 8f 16 50 60 ae 7f a4 92 dc 2b a4 67 ad 6b 9b f2 05 9a 3a 94 ae 2a 89 78 68 9f 8f 8b 31 27 07 e4 b4 13 7c 80 cb e7 c5 e5 bc 7e 3a d7 60 11 c2 bb 12 ee 5f ae 4e 7c c3 36 be 22 ef 58 5e 4e 59 bc 23 d8 61 55 c7 14 7b 70 a5 9a 09 2f 7a 5a 22 0a 39 e9 6f 02 5c 47 49 f9 11 04 ee 58 0a 0c 64 04 62 b0 2a 4b fe 40 3b e6 05 50 d4 d2 46 2f 6a 7b c3 7d 4e 3f c6 78 fd 9d e9 5c 21 0e bb 7c 04 d4 81 ae 3e 1b 54 21 f5 63 74 70 ea 32 40 2d cb f0 cc 61 55 09 d1 aa 35 53 1a a1 6e 94 69 e8 c9 0f e8 15 17 07 f8 16 aa 7d 01 ad bb 78 51 d2 f8 0d 0d 25 d2 Data Ascii: PKUB:jCancellation#J58.isoyaBdo;\lk)w]%a?j)ft\|-p[47:l8/ZILQ8vEh6sGP /DW8@g-M}hU@2+yD(m,M\kllZ41asIA%<vBUnaZ~/H>P.Zg)b,1:D?MxF~Zw%r'ezq62.9vr@a7hFP[,S7NjOZI(U()Qt#t nE.qYo<qq@(77!zD7kdmWN}Vv0DsL!`U}"\g'V#mkY6+&i86Hy@::G4t{h;dSij6g{Blb`!#Ol@{v_z[.e!TWA[P`+gk:xh1'\|~:`_N\|6"X^NY#aU{p/zZ"9o\GIXdbK@;PF/j{}N?x\!\|>T!ctp2@-aU5Sni}xQ%
Jan 5, 2023 09:03:48.063642025 CET	454	IN	Data Raw: 81 78 f7 ff 0b 0e 69 e2 8e f0 2e 31 09 15 eb 7e b9 86 d4 21 e2 18 b1 95 3e cd 47 55 90 70 c3 fb d4 03 58 bd ae 0f b9 0d 77 00 88 25 da 03 9c e2 2f 2a 94 f5 17 84 b0 e4 5a 80 3b d1 77 49 f7 8e 99 49 69 ac 33 c5 e5 c0 3f 54 64 64 6c 27 e8 44 e3 98 Data Ascii: xi.1~!>GUpXw%/*Z;wIIi3?Tddl'DufIo@7xR.)U!n1x#I7M]N&e}cu2f^)@60\!&Rw~U\D@<rN`9uR}lPy
Jan 5, 2023 09:03:48.063687086 CET	456	IN	Data Raw: 78 63 5d 55 e4 ed e8 ea 7d e4 d1 2b 1a 95 52 2d 15 fd 62 0b 4a 5b be 3b 85 94 a6 e9 76 16 58 da ed 23 f1 70 dc 96 5a fc f2 01 7f 86 26 ae 18 41 cb 6f 61 1e 8b b8 22 d3 f0 ef 5c 89 05 79 c5 e9 20 d9 ad 17 17 8c 72 e8 92 c4 b9 f9 c1 c2 c3 21 1a 4a Data Ascii: xc]U}+R-bJ[;vX#pZ&Aoa"\y r!J.W\|'RXR9\U6;Bh\(k!,VP_54;q"]d+nJ""Ou>\|U/~k47^#Vn?,TeWb>54> lu*;^.n(U
Jan 5, 2023 09:03:48.063714027 CET	457	IN	Data Raw: 2c 85 c7 67 55 89 71 d7 11 f6 c4 d7 04 ea 28 d6 1f d0 1c 1d 47 26 2c 9c 44 b3 b9 16 af be e5 8a da 17 1a 89 cc 18 e4 e4 76 e4 39 e7 7d 86 b0 89 dc e6 15 e1 a6 ab 0e 32 96 37 50 b1 29 6e ed 74 c6 49 8a 73 7e 56 67 98 2d 42 4f a4 b0 1d e9 78 80 16 Data Ascii: ,gUq(G&,Dv9}27P)ntIs~Vg-BOxk6s!)=\|jhMsFs\O[;_C%!\c\A\|oKJ{q?haLEm@#UX&~{aXYzPyK2Xm:\|
Jan 5, 2023 09:03:48.063755989 CET	458	IN	Data Raw: a8 3a 85 fd 50 e7 80 dc 2c 40 83 3f c8 0d 76 b5 68 90 4b e4 53 13 83 9d 7a 28 03 ad 11 de c8 53 6d e0 11 46 52 df a6 4d 87 ee d7 12 3e ee 0b 9f f9 44 c9 a7 5b 77 7d 5a f9 1e 87 c5 f7 2d b2 3a f2 f3 cb b2 a6 76 a3 15 24 cb 9f 3a 6b 98 76 e1 a8 d8 Data Ascii: :P,@?vhKSz(SmFRM>D[w}Z-:v$:kvv%0xc$+T8J!v#Fa>V(;Gi/jZ91IX73zAk\;BJS>DQn Va\huPi@ -?_0)ns/kcZu
Jan 5, 2023 09:03:48.063781023 CET	460	IN	Data Raw: 0d c1 68 79 20 ca 55 af 7e e6 84 9f 93 e3 cd e7 ef 3b dc 37 5e fb 3f f8 b8 5b b8 e9 2f 85 29 88 ae 99 21 3b 5d 6f a9 9a 2a bc e2 60 f9 45 5b 39 ce 06 86 b2 52 aa 52 d5 b5 26 c5 02 3b 28 aa e4 36 ca 0b 01 8b 85 eb 45 4e 33 c1 d7 1e 0a 51 25 6c c3 Data Ascii: hy U~;7^?[/)!;]o`E[9RR&;(6EN3Q%lV?y.'AX6Y#kbErE[+NcL}~OTZ#3Ms6vD%/C6@+bco8!3 < iZV1!G: \|j',5l0WDZ
Jan 5, 2023 09:03:48.063807964 CET	461	IN	Data Raw: c2 10 0d 01 c6 d8 b7 f6 f8 50 67 a0 5f 11 0f ce 02 34 24 72 b7 45 28 cf 78 60 12 9b 10 10 2f 1e ac fc e5 ab cd c0 aa 46 d0 e3 8b ee 64 86 ff 6e c7 41 11 53 f5 56 54 4e 0d 33 69 26 97 c3 5e 07 2b b3 cb bd bf a7 80 43 15 a6 63 79 95 ac dc 94 d7 9e Data Ascii: Pg_4$rE(x`/FdnASVTN3i&^+Ccy:tJ'gu6O56VpZz@mITuNZ<\|pX@MeGyA]Tj^,W\|my-b[$d0%Sl);VIC:g
Jan 5, 2023 09:03:48.063849926 CET	462	IN	Data Raw: b8 1e 30 da 3b 68 ee 22 70 cb e4 67 2d f7 1a ba d3 f4 a5 ce 16 24 69 53 7f 1a a5 24 9d d4 0e d9 26 4d c3 e9 64 d1 c4 ba b2 ff 3d 77 50 be 08 47 82 39 7d 31 41 23 17 92 ae 61 ac 8d 87 dd a1 5b 04 52 b0 da 34 0a f9 67 a6 59 e8 11 55 cd 0c 4d f0 41 Data Ascii: 0;h"pg-$iS$&Md=wPG9}1A#a[R4gYUMA}pWRNCAS`e8C\|q:p>bc'p!LhM~WF>fKl'Nu E\| v\|G!Am./-x4*2R%=\|EGhf^m
Jan 5, 2023 09:03:48.063875914 CET	464	IN	Data Raw: db 28 89 b2 e8 a8 ed b2 ce 36 ba 62 b4 ba ba d4 0f a6 fb 7a b1 51 01 b6 da 10 25 52 65 63 7d 95 10 5c 5c a9 d1 9f 84 03 09 a6 b1 37 0f be c9 9e 2a 74 76 ea 4a 21 b9 9d d9 1e ba 01 fd 34 e5 4c 61 d5 73 40 9a 18 16 2e 53 53 23 4b e4 f4 cc b3 f2 5a Data Ascii: (6bzQ%Rec}\\7*tvJ!4Las@.SS#KZ]H=P!)#APd,N:S"f?d-N4UKYqKW}@iXpufd?aoPpV6l{Zq'SR.[y"F{N4,DJjxz
Jan 5, 2023 09:03:48.063901901 CET	465	IN	Data Raw: 0f ac 9d 71 ff 80 ab ee 1d 40 4b 56 f2 33 ab 0e 35 2c d8 7e 3f 7f f4 e4 0c 23 4f b7 82 7b 94 fe 77 88 1f af d7 3b 6d 84 16 56 5a 1c 94 2c 00 d9 be 1d c5 04 91 5a e6 db ad 16 7c b5 61 84 17 4f a1 7b dc c4 65 92 d1 f0 f0 3b b7 5a 22 09 2a b3 1e 4e Data Ascii: q@KV35,~?#O{w;mVZ,Z\|aO{e;Z"*N}/;-y/1\|z4/8!xN>]Sj9e%5{Shl!iyGsJqA>UprZ1Ur>9COU-&2dkX`,e9sD@
Jan 5, 2023 09:03:48.221364021 CET	466	IN	Data Raw: 4f 5f 02 1d b7 e5 f9 6a be ab c5 4a 36 c7 c0 e8 36 96 37 b1 07 9c c1 3f 9b 2f 63 eb 46 f6 85 58 f9 f1 ae bc ca c3 3e e6 e3 46 05 72 e4 09 37 54 8a 60 42 dc 69 c0 94 c5 aa 6c 38 8f a4 eb cc d1 44 5b 9a 9f c5 94 9f 09 1e dc 69 d7 96 ba 20 8c ff 61 Data Ascii: O_jJ667?/cFX>Fr7T`Bil8D[i a}zUuVVM5l.i1QZpd+4?ouk9<E g^Ht1-?m#O]Yvs;<N+".KB'6^7w!XH2N d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49702	50.62.149.105	80	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
Jan 5, 2023 09:04:30.852730036 CET	1299	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49701	142.251.209.13	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-05 08:03:46 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+904; AEC=AakniGO7HqlHWlnoY-P22_SwwnNSfVGxlF1NgK5nuj5WLe313NyJi16g7z4; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg; NID=511=nUT82hOv6CVwMNqDg-sTtCMJJ6SQ1v_cCpfCpf5nt8EolEbal01GWFyjG01tqWQgh9ciRU880J6nLd2gdbhAJs44PsHAZaVQAFIbrqe2FmFgjrAAK7W9Z8u5LDvwsuZRng98jP6E23SJ4fsPIs326YmnuCwa92dRRCcB6MNeI_o
2023-01-05 08:03:46 UTC	0	OUT	Data Raw: 20 Data Ascii:
2023-01-05 08:03:46 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Jan 2023 08:03:46 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'report-sample' 'nonce-mU63rdbSr_6YpDL-1XBu0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Report-To: {"group":"IdentityListAccountsHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external"}]} Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-platform=, ch-ua-platform-version= Cross-Origin-Opener-Policy: same-origin; report-to="IdentityListAccountsHttp" Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-01-05 08:03:46 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-01-05 08:03:46 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49699	142.250.184.78	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-05 08:03:46 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-104.0.5112.81 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-01-05 08:03:46 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-Ne3Asu8cBNMm0vyF5cWgzA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 05 Jan 2023 08:03:46 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5848 X-Daystart: 226 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-01-05 08:03:46 UTC	2	IN	Data Raw: 32 63 37 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 38 34 38 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 32 36 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 20 73 Data Ascii: 2c7<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5848" elapsed_seconds="226"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname="" s
2023-01-05 08:03:46 UTC	2	IN	Data Raw: 6e 4d 76 4e 7a 49 30 51 55 46 58 4e 56 39 7a 54 32 52 76 64 55 77 79 4d 45 52 45 53 45 5a 47 56 6d 4a 6e 51 51 2f 31 2e 30 2e 30 2e 36 5f 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 Data Ascii: nMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="
2023-01-05 08:03:46 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:02:15
Start date:	05/01/2023
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\user\Desktop\Cancellation_418406_Dec23.pdf
Imagebase:	0xc40000
File size:	2571312 bytes
MD5 hash:	B969CF0C7B2C443A99034881E8C8740A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	1
Start time:	09:02:21
Start date:	05/01/2023
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Imagebase:	0x13c0000
File size:	9475120 bytes
MD5 hash:	9AEBA3BACD721484391D15478A4080C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	11
Start time:	09:03:42
Start date:	05/01/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://agapeministriesinternational.church/blog/Cancellation_367461_Dec23.zip
Imagebase:	0x7ff614650000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	14
Start time:	09:03:43
Start date:	05/01/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=1812,i,544507481073856773,15156316211615148029,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff614650000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	15
Start time:	09:03:50
Start date:	05/01/2023
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Cancellation_367461_Dec23.zip
Imagebase:	0x640000
File size:	12800 bytes
MD5 hash:	16FF3CC6CC330A08EED70CBC1D35F5D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Show Windows behavior

Target ID:	16
Start time:	09:03:51
Start date:	05/01/2023
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\fgt4alc0.uhe" "C:\Users\user\Downloads\Cancellation_367461_Dec23.zip
Imagebase:	0x1220000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	17
Start time:	09:03:51
Start date:	05/01/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Execution Graph

Execution Coverage:	22.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.5%
Total number of Nodes:	73
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00F0B1D6 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 00F0B208

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: fb505fe71f09dff230257622933b3c5ad907f55af681ca57d3fcbc0003c467ea
Instruction ID: 0d4f961339306a33eb945fbeb2ae0b9fe2a056f30def50171db6a433a3b3fc38
Opcode Fuzzy Hash: fb505fe71f09dff230257622933b3c5ad907f55af681ca57d3fcbc0003c467ea
Instruction Fuzzy Hash: 7F01D131804240DFDB11CF15E98876AFBA4EF44720F58C4ABDD488F256D379A408EB62

Uniqueness

Uniqueness Score: -1.00%

Function 00F0B246 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 00F0B2F3

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1c820179ec4997bcb8ab05028b6eda5554318315e820a40582e0568c235e0cd3
Instruction ID: c99b5c8136fb3d4817e1e9f7ef69cb4b483f648167f2f053a28320199c0a1056
Opcode Fuzzy Hash: 1c820179ec4997bcb8ab05028b6eda5554318315e820a40582e0568c235e0cd3
Instruction Fuzzy Hash: 0F31B4724043446FE7128B65DC44FA7BFACEF45320F0884AAE985CB162D324A919DB71

Uniqueness

Uniqueness Score: -1.00%

Function 00F0AD04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 00F0ADA7

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d6fbd4859a9ccf556e4f45c36b928a5c7dce5cca27747a77cac349cc14d4e202
Instruction ID: 4779d4796fd9d8e1ecd6b4a3b365854af632fa70adba4415538bccc1e4069983
Opcode Fuzzy Hash: d6fbd4859a9ccf556e4f45c36b928a5c7dce5cca27747a77cac349cc14d4e202
Instruction Fuzzy Hash: A331B5725043846FEB228B65DC44FA7BFACEF45320F0888AAE985DB152D224A519DB71

Uniqueness

Uniqueness Score: -1.00%

Function 00F0AB76 Relevance: 1.6, APIs: 1, Instructions: 93
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 00F0AC36

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: 0eb641a4ef91df51b3ca8fd63d718d3013eccaf4ffa792f2a2f92df92800405b
Instruction ID: d8f4c8c3a3f46902eea09748c1c67b2f6f9af056a3d0e2725b82d48b4b7fa9ca
Opcode Fuzzy Hash: 0eb641a4ef91df51b3ca8fd63d718d3013eccaf4ffa792f2a2f92df92800405b
Instruction Fuzzy Hash: 26318C6250E7C06FD3138B718C65A92BFB4AF47610F1E84DBD8C48F1A3D2686919C776

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A5DC Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00F0A67D

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: dfc797fe729a17430a331d630eb59031c4861f5f1a5ea750101939642a5f1f24
Instruction ID: 527921230904f7f49ab97b56665da2c9a7fd418d9c81ed8cad6312eeb409b00f
Opcode Fuzzy Hash: dfc797fe729a17430a331d630eb59031c4861f5f1a5ea750101939642a5f1f24
Instruction Fuzzy Hash: 30316D71504380AFE722CF65CD44F66BFE8EF45620F0884AEE9858B292D375E809DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A120 Relevance: 1.6, APIs: 1, Instructions: 85
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E2C,?,?), ref: 00F0A1C2

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 68e5d887cd680c1109ebce17548ae50b82f93c49bce36738d87f1798c51d4cc5
Instruction ID: 5a08a0981437d138c70060335694f8ab163f217f3d768a5501c8d1762a8c8e82
Opcode Fuzzy Hash: 68e5d887cd680c1109ebce17548ae50b82f93c49bce36738d87f1798c51d4cc5
Instruction Fuzzy Hash: 3531917140D7C06FD7138B368C51BA2BFB4EF47610F1981DBD8848F693D225A919C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A370 Relevance: 1.6, APIs: 1, Instructions: 80
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,D9A4BB1B,00000000,00000000,00000000,00000000), ref: 00F0A40C

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: c2192707e29fa42478abdb331e22dd5a3bc20104926bbdad6b9477fdacb9e462
Instruction ID: 6c25c27d625fc19e726eed2c6818f21494983446efafe6e4a1e8ae4b91ab3132
Opcode Fuzzy Hash: c2192707e29fa42478abdb331e22dd5a3bc20104926bbdad6b9477fdacb9e462
Instruction Fuzzy Hash: C0217C76504740AFD721CF15CC84FA7BBACEF45720F08849AE9859B292D264E848DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00F0B276 Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 00F0B2F3

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 931ed3ca6177a7a7afd721340ac818ffb0f38061e9ceb25febd58472b388b3a8
Instruction ID: 7257eb192c4c61f33d81b3b4648a123a2b7e5b5cbd22dfce14df3e4fc9d5185d
Opcode Fuzzy Hash: 931ed3ca6177a7a7afd721340ac818ffb0f38061e9ceb25febd58472b388b3a8
Instruction Fuzzy Hash: D521B372500204AFEB218F65DC84FABFBACEF04324F18896AED45DB251D774A5189BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00F0AD2A Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 00F0ADA7

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 17f716cd41df3135001abfb0c9767339aa3e32f272134cf070c6582f8113d87e
Instruction ID: 3fee93a0bb0cb592ec309dcfd9aad9ee708a0656963df68a4d1a5b673b33ac88
Opcode Fuzzy Hash: 17f716cd41df3135001abfb0c9767339aa3e32f272134cf070c6582f8113d87e
Instruction Fuzzy Hash: 5821D372500304AFEB218F65DC44FABFBACEF04324F18886AED45DB651D630A548DBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A850 Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E2C,D9A4BB1B,00000000,00000000,00000000,00000000), ref: 00F0A8DE

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 5ff33b95fd52a7acdb5fa8dbe2401e544de19405926910d87fdb61588ec13425
Instruction ID: 90212935ba56687432b00139453110ef004047ff98c743fb46ff8ac55193133d
Opcode Fuzzy Hash: 5ff33b95fd52a7acdb5fa8dbe2401e544de19405926910d87fdb61588ec13425
Instruction Fuzzy Hash: E021C4715083806FE7128F24DC40F66BFB8EF46724F0884EBED849F152C224A809C772

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A933 Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E2C,D9A4BB1B,00000000,00000000,00000000,00000000), ref: 00F0A9C1

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4df77d61728b40961ce6af5a249cee4c657d21ad8cea8ecc64a1a797b5df0e81
Instruction ID: d83bcf44c54e0d53adc6651839ff55c87e3d1b56612fbd35c2dc2f1142a73c4d
Opcode Fuzzy Hash: 4df77d61728b40961ce6af5a249cee4c657d21ad8cea8ecc64a1a797b5df0e81
Instruction Fuzzy Hash: 19218171509380AFDB228F65DC54F96BFB8EF46314F08849AE9849F152C265A449CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A5FE Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00F0A67D

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ff23e8b3857f97ec40c9ff7dbd47ee59d369789ddffe03e1a350f4eba7160a14
Instruction ID: 31aabeddec9fe76d47df288084962da33c144ca8025011ab2bf47d38b5a53cc5
Opcode Fuzzy Hash: ff23e8b3857f97ec40c9ff7dbd47ee59d369789ddffe03e1a350f4eba7160a14
Instruction Fuzzy Hash: F8218E72500340AFE721CF65CD44B66FBE8EF08720F18846AED858B291D372E408DB76

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A78F Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E2C,D9A4BB1B,00000000,00000000,00000000,00000000), ref: 00F0A815

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 693ec5a3110922878e59e65b3670607527371694c51209394fbf2b22448f3fb2
Instruction ID: 909b4f512221b23f88fd3456aca5dbabb2382a4364abc09af23d24ddcf6086e0
Opcode Fuzzy Hash: 693ec5a3110922878e59e65b3670607527371694c51209394fbf2b22448f3fb2
Instruction Fuzzy Hash: E021D8754083806FE7128B25DC50BA6BFACEF47724F1880DBED849B293D264A909D772

Uniqueness

Uniqueness Score: -1.00%

Function 00F0AA0B Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 00F0AA8B

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 1fcab20503aeba002c4bbade5517741fd1686c1e0c2355220dbf1e1cead53c87
Instruction ID: a15bb5bb8b74f5712b73f2d4bb9b74bf5d7826e81f4810211f116240017eade9
Opcode Fuzzy Hash: 1fcab20503aeba002c4bbade5517741fd1686c1e0c2355220dbf1e1cead53c87
Instruction Fuzzy Hash: 7E21C5715083C09FD712CB29DC55B96BFE8AF06324F0D84EAE884CF193D224D949CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,D9A4BB1B,00000000,00000000,00000000,00000000), ref: 00F0A40C

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1499e62ba2af99afabb1aa69ff854a205a864aa917ef7cc5ba8e503da75dcd18
Instruction ID: 329a6036074b71c1cce6f69905b6984d2529fe71be612472da7a6730928ab105
Opcode Fuzzy Hash: 1499e62ba2af99afabb1aa69ff854a205a864aa917ef7cc5ba8e503da75dcd18
Instruction Fuzzy Hash: A1219376500704AFE720CF15CC84FA7FBECEF04720F18846AED459B291D660E809EA72

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A6D4 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00F0A748

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 77e1fbd90de5c1c785f91751ad48b2ac63eb5dfe9139ec17d549317f5e1a01ab
Instruction ID: d6d87891c4d18353a8c68b304fdc0d7bfe716e83827c31f1b94e0c456d08c652
Opcode Fuzzy Hash: 77e1fbd90de5c1c785f91751ad48b2ac63eb5dfe9139ec17d549317f5e1a01ab
Instruction Fuzzy Hash: 1121CFB68093C05FD7138B25DC94792BFB8AF53220F1884DBDC858F1A3D2249908C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A962 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E2C,D9A4BB1B,00000000,00000000,00000000,00000000), ref: 00F0A9C1

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: f472f92d5c639bd6efe8ce3aababd2207ed3bf844288adab280a4abec5247ff5
Instruction ID: 1407501e57ff1e4585c72a8abdb232d961c8838e0f6d82048bccb697927da52e
Opcode Fuzzy Hash: f472f92d5c639bd6efe8ce3aababd2207ed3bf844288adab280a4abec5247ff5
Instruction Fuzzy Hash: CC11C472500300EFEB21CF55DC84FAAFBA8EF44724F18846BED459B251C274A448DB72

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A882 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000E2C,D9A4BB1B,00000000,00000000,00000000,00000000), ref: 00F0A8DE

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3166de3d38276d520e990b8a16e896784b381df7366e80438fbc3a7eb9bd0903
Instruction ID: 9942307be182e8132c086a468d7449a83c942a79007218260d701f13d105f1a0
Opcode Fuzzy Hash: 3166de3d38276d520e990b8a16e896784b381df7366e80438fbc3a7eb9bd0903
Instruction Fuzzy Hash: 3E11A372504300AFEB21CF55DC84FA6FBA8EF44724F18C86BED499B241D674A509DB72

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A2AE Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00F0A30C

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 94b918d9ab626310a84c3579a39f7407e99b0162e61ddf571e38166b8c9ed9cc
Instruction ID: 47ba796943012500c39f877985ba033793d7494de6e6e70c6f1f4a5980377fa8
Opcode Fuzzy Hash: 94b918d9ab626310a84c3579a39f7407e99b0162e61ddf571e38166b8c9ed9cc
Instruction Fuzzy Hash: E311A3758093C09FD7228B25DC55A52BFB4EF57320F0D80DBDD848F1A3D265A849DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A7C2 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,D9A4BB1B,00000000,00000000,00000000,00000000), ref: 00F0A815

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 54ad694c34ce1c3d3f158d2a024ed7520fe70b41402e0e294726dfcef523a9b7
Instruction ID: 52e5521c689359ebb7dc5a0353691d2cc32c18c37e4449178007df0bee29d83f
Opcode Fuzzy Hash: 54ad694c34ce1c3d3f158d2a024ed7520fe70b41402e0e294726dfcef523a9b7
Instruction Fuzzy Hash: F101D272500300AEE720CB15DC85FA7FBDCEF44724F18C4ABEE459B281D674A8099AB3

Uniqueness

Uniqueness Score: -1.00%

Function 00F0AA46 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 00F0AA8B

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: c8d7bb742deb1006860cf69e59f8c5039504e4cb7a922962c70b93d5193a880a
Instruction ID: 184e113f1f172418471cea62e0f887903df1ecb5a07e97a19cd1a7f4a2464ab0
Opcode Fuzzy Hash: c8d7bb742deb1006860cf69e59f8c5039504e4cb7a922962c70b93d5193a880a
Instruction Fuzzy Hash: 0B116571A04340DFDB10CF29D985756FBD8EF04720F18C4AADD49CB281E678D944DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00F0B1B4 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 00F0B208

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 9d647f18d5a0d65c1112e1ef99ae6354f7c5784f4c03033a341a447453b26b67
Instruction ID: 934b60d71ec4381725eee50f4e1305ab07bb5a3a07c5a92eb7dc75139df0ca7f
Opcode Fuzzy Hash: 9d647f18d5a0d65c1112e1ef99ae6354f7c5784f4c03033a341a447453b26b67
Instruction Fuzzy Hash: CE11A071809380AFD7128F25DC84B56FFB4EF46220F0884EBED848F252D275A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00F0AF8B Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 00F0AFE4

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: b59e5c3f29694229d6b4b94af0a00b1d0ce82886d7e97fc3853d616c99708f4b
Instruction ID: 61945f17f374dce93e23d3c2f1331c1cb5d4c2e687f90a727597178f1b363c1d
Opcode Fuzzy Hash: b59e5c3f29694229d6b4b94af0a00b1d0ce82886d7e97fc3853d616c99708f4b
Instruction Fuzzy Hash: D71191755093809FD7128B25DC45B52BFB4EF46220F0984DBDD858B262D265A848DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A172 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E2C,?,?), ref: 00F0A1C2

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 41ea45e3721a6b4deefec2f09609696ed320703f9b840f3e2120469786fda179
Instruction ID: e834ff567a377a6149daa7a5c51eb48331e1b21346cd5b98f912107bb40848e3
Opcode Fuzzy Hash: 41ea45e3721a6b4deefec2f09609696ed320703f9b840f3e2120469786fda179
Instruction Fuzzy Hash: 7401D471540600AFD710DF16DC85B26FBA8FB88B20F14816AED088B745D235F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00F0ABE6 Relevance: 1.5, APIs: 1, Instructions: 47pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 00F0AC36

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: a23d300d2c721f2315c42b9f4b8a9370d2fc77c37562c36333a78a15bb371170
Instruction ID: 029eb7320d5b4852315a558f3df98592144ad00d61a2b97dabdb1836c202198c
Opcode Fuzzy Hash: a23d300d2c721f2315c42b9f4b8a9370d2fc77c37562c36333a78a15bb371170
Instruction Fuzzy Hash: 5801D472540600AFD310DF16DC85B26FBA8FB88B20F14812AED088B745D235F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A716 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00F0A748

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: a721a4bd7d26ca85608cace6d1b3e7f7b1bdc52d7ce0deb088a9b57c627ab1fd
Instruction ID: fc305422508f577266ce2adeca6fcee0fecb74cbad900d97442af7e534c60a3d
Opcode Fuzzy Hash: a721a4bd7d26ca85608cace6d1b3e7f7b1bdc52d7ce0deb088a9b57c627ab1fd
Instruction Fuzzy Hash: D001F7759003409FDB10CF15D884766FFA4EF00320F18C4ABDC098F242D274A448DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00F0AFB2 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 00F0AFE4

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 2fce9222783ef17072f54b6a69b978913190b54c76a79be0d102063d1ab7b312
Instruction ID: e001dd5efd8977f04da8f354855d178991328ea23871842ff590cf22f4575d78
Opcode Fuzzy Hash: 2fce9222783ef17072f54b6a69b978913190b54c76a79be0d102063d1ab7b312
Instruction Fuzzy Hash: 5E01F476A00340DFDB108F19D884766FBA4EF04320F18C4ABDD598F392D675E848EEA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A2DA Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00F0A30C

Memory Dump Source

Source File: 0000000F.00000002.606676320.0000000000F0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f0a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: f1bab9a4c08970e5ecbaf26a3f4d44dd85b4c947931399155069514c41e533d6
Instruction ID: fd540e385a1adcef9afc19028a2659812babae28936b455773ac94fdca0ae917
Opcode Fuzzy Hash: f1bab9a4c08970e5ecbaf26a3f4d44dd85b4c947931399155069514c41e533d6
Instruction Fuzzy Hash: 8CF0AF36904340DFDB208F05D885766FBA4EF04720F58C0ABDD494B256D3B6A458EA63

Uniqueness

Uniqueness Score: -1.00%

Function 0294087E Relevance: 1.0, Instructions: 989COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.607114363.0000000002940000.00000040.00000020.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2940000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d047fce48bb2a7ecefa48268f7db398a8a75de911074f5ca4579dbac27fe193
Instruction ID: 777ed7bf1dd96164c74afbf1ba5e55633d68ef0abf0063c1c420943c214a81fd
Opcode Fuzzy Hash: 5d047fce48bb2a7ecefa48268f7db398a8a75de911074f5ca4579dbac27fe193
Instruction Fuzzy Hash: 0A21F66254E3C00FE71787242C668A97FE4DD43130B1D86EBD884CF5A3E615591AC7E7

Uniqueness

Uniqueness Score: -1.00%

Function 0294025D Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.607114363.0000000002940000.00000040.00000020.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2940000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd7bbe9bea6fb065914a256a4d768e79563d19bdd1398054aaa2e617be73c1da
Instruction ID: b930e105d81d986f084a932dd79a91262bf08a65d173cd57c733ec5c569eaa12
Opcode Fuzzy Hash: bd7bbe9bea6fb065914a256a4d768e79563d19bdd1398054aaa2e617be73c1da
Instruction Fuzzy Hash: 434100A664E7C04FC3134B358C65AA1BFB4AF43214B5E85EBD4C5CF5A3E129580ACB63

Uniqueness

Uniqueness Score: -1.00%

Function 028E02C0 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.607098718.00000000028E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62348131efeeaa0587ca4d06bc88d9b734e1f03027e41f8cae55952987fc0c32
Instruction ID: 8b936bfca19ab482d896a1f2d40ca14fc0cc45a81c1af980f41130fd753223ad
Opcode Fuzzy Hash: 62348131efeeaa0587ca4d06bc88d9b734e1f03027e41f8cae55952987fc0c32
Instruction Fuzzy Hash: D6B17078600219EFCB24EF24E94CB5E77B2FF89704B12982AD546E7364DB359D01DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 028E0799 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.607098718.00000000028E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da1e881febdcbc94ea0c526aa869fa1284efaa6fd32080fa5a9329dc8743e0c8
Instruction ID: f0f0bc16100c9ee932f13fc94f88fd001a0fa5c7b80d3ec79004c67d9cd8b5fa
Opcode Fuzzy Hash: da1e881febdcbc94ea0c526aa869fa1284efaa6fd32080fa5a9329dc8743e0c8
Instruction Fuzzy Hash: 4AA18F34B00209CFDB14EB78D858B6E76A3AFC4308F158829D946E7395EF7A8D42DB51

Uniqueness

Uniqueness Score: -1.00%

Function 028E0C99 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.607098718.00000000028E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6f952dad630eae8de98838bf2b55e48527305227ff7bd2340733d042c8107d6
Instruction ID: e179d78bd13e92b53782e5ab109d1397a4967a071abe6c51a7e5d23b04b3ceb2
Opcode Fuzzy Hash: b6f952dad630eae8de98838bf2b55e48527305227ff7bd2340733d042c8107d6
Instruction Fuzzy Hash: E0214730B012458FCB45DB398844AAE7BD77FC5200B48496DD446D7381DE3AAE0AC7A6

Uniqueness

Uniqueness Score: -1.00%

Function 028E0CA8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.607098718.00000000028E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ea96aa6bd45e0b3b255b922e70c7990218b8a28a7740b9cc525a6de319b6f2b
Instruction ID: 20ec721d19f18ac68617c2ff94abb9002573561c4b6515a46858f17cf5fa7134
Opcode Fuzzy Hash: 1ea96aa6bd45e0b3b255b922e70c7990218b8a28a7740b9cc525a6de319b6f2b
Instruction Fuzzy Hash: 0021F334B002058BCB54EB39C8446AFBBE7BFC5604B54892DC546DB384DF76AD0687E6

Uniqueness

Uniqueness Score: -1.00%

Function 028E0B8F Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.607098718.00000000028E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fe61f1b5b2d2411d69fae4214f3c83ede6eff6c5aaf1c194a8775e74e2ec61d
Instruction ID: 937f4ebbb2d4126886b2500196dfdf52a69c2dd6b6beacaa1c6e2023d966a2d9
Opcode Fuzzy Hash: 5fe61f1b5b2d2411d69fae4214f3c83ede6eff6c5aaf1c194a8775e74e2ec61d
Instruction Fuzzy Hash: 6E119035A00119AFCB14DFB4D844EDE7BF6BF88210B11497AE206E7265EA369C19CB80

Uniqueness

Uniqueness Score: -1.00%

Function 028E0BA0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.607098718.00000000028E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bf7db740f1031630dcb63d7e96cef328831b7ec1ffe3e427d16d4b7c466f623
Instruction ID: 0f9786c8cdc41357a25fc591693a50198da982ef6904907858116c5989d7ef96
Opcode Fuzzy Hash: 8bf7db740f1031630dcb63d7e96cef328831b7ec1ffe3e427d16d4b7c466f623
Instruction Fuzzy Hash: C1115135A10119AFCB14AFB4D844E9E7BE6FB88210B114876E206E7325DE32EC15CB80

Uniqueness

Uniqueness Score: -1.00%

Function 029407F8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.607114363.0000000002940000.00000040.00000020.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2940000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acc576ff3df803a6cd55c36f41b16438b9798225b59f41a38716f9dc7e020c6e
Instruction ID: 98fc8b2f5e25162991916f90d1470821d680cc0ae686e589dca14020f67cbe01
Opcode Fuzzy Hash: acc576ff3df803a6cd55c36f41b16438b9798225b59f41a38716f9dc7e020c6e
Instruction Fuzzy Hash: 1601D4B64092406FD301CF05EC41D57BBECEF85624F08C46BFC488B212E231A9148BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0294081E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.607114363.0000000002940000.00000040.00000020.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2940000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdca220b89bfa9c971e77873a8495bfc1b4ccc622dfa08cc4031047ca9658d9b
Instruction ID: 0aa68702b5073436addf1541810761160ddf15a00bc11491a4770614f8f07724
Opcode Fuzzy Hash: cdca220b89bfa9c971e77873a8495bfc1b4ccc622dfa08cc4031047ca9658d9b
Instruction Fuzzy Hash: 25F082B29452046FD240DF09ED45856F7ECEF84621F18C52FEC088B305E276A9154AE2

Uniqueness

Uniqueness Score: -1.00%

Function 029405F6 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.607114363.0000000002940000.00000040.00000020.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2940000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4042bdffc0e0165c8ecb6dc70a32dbac40771db2b308e89eb4f7f616b9739c3
Instruction ID: 12ece6dadc4a998ae84fde0a6c7f735b9a619facde71cad45f5ae7a0e541000f
Opcode Fuzzy Hash: b4042bdffc0e0165c8ecb6dc70a32dbac40771db2b308e89eb4f7f616b9739c3
Instruction Fuzzy Hash: B0E092766046004FD650CF0BEC81456F7D8EB88630B18C47FDC0D8B711E135B505CEA6

Uniqueness

Uniqueness Score: -1.00%

Function 028E0C50 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.607098718.00000000028E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c89c63b0147ad34aaf9e33f0ff0ebaa7fa7a7f82a4dd82c19bb57002b5a496e
Instruction ID: 8c9be6e9881d00ba968fc5fa39ba7857cc806dbf05d80f7c2a440ee09ada64c8
Opcode Fuzzy Hash: 6c89c63b0147ad34aaf9e33f0ff0ebaa7fa7a7f82a4dd82c19bb57002b5a496e
Instruction Fuzzy Hash: CAE026B2F083189FCB48DBBC48505AE3FE1DB55550F0048BEC008D7291ED368901C380

Uniqueness

Uniqueness Score: -1.00%

Function 028E0C60 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.607098718.00000000028E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00d8dd26483400618ac95dda71a2a81fa2e5434a100efd80120c17382c7413d9
Instruction ID: 4f736f94db71200a0598c2e2a5bd40dc11115ea2cdabc4c0f3a70ec62b9df401
Opcode Fuzzy Hash: 00d8dd26483400618ac95dda71a2a81fa2e5434a100efd80120c17382c7413d9
Instruction Fuzzy Hash: 76D01772F04318ABDB58EAB998409AEBFEAAB84561B10887DD008E7340ED32994083C4

Uniqueness

Uniqueness Score: -1.00%

Function 028E0E08 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.607098718.00000000028E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f8f687f4b09d70941e9f83b5bdc0dba8dd5d2d038923c4287459b889eac3ad4
Instruction ID: 0a267276db40444111d5193e0ae3a737de0a17f7fd6dd86e482c2f23e6f6368f
Opcode Fuzzy Hash: 5f8f687f4b09d70941e9f83b5bdc0dba8dd5d2d038923c4287459b889eac3ad4
Instruction Fuzzy Hash: D3D05B251593404FCB06977498596D47F755B83214F8A85E78049DB2B3C769CE45C741

Uniqueness

Uniqueness Score: -1.00%

Function 028E0DD1 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.607098718.00000000028E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f00c1fa751fbabae3e8e7c07089f0f45ae851cb64e35b66114f18273acbd98
Instruction ID: ff4a9043a6abf51f1a6c4c741e26aebd7067ff9138f0cdaa7f7cad9089f6de05
Opcode Fuzzy Hash: b7f00c1fa751fbabae3e8e7c07089f0f45ae851cb64e35b66114f18273acbd98
Instruction Fuzzy Hash: 8AD05B3414D2814FCB0797748869E657F725F83204F4986DAC489DB2A7D665DC48CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00F023F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.606662035.0000000000F02000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F02000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f02000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05415383a7e4cb1d06bb147b85ec48297a0eb5266e024ac6c8f85ecf55697bcf
Instruction ID: 8f7ce2bf3951efdaad33ee9c39b91cbd8241db2bb69e16a0a291f12fb3519a7d
Opcode Fuzzy Hash: 05415383a7e4cb1d06bb147b85ec48297a0eb5266e024ac6c8f85ecf55697bcf
Instruction Fuzzy Hash: 6CD05E79615A814FD326CA1CC1A8B953BD4AB51B14F4A44F9E8408B6A3C368D981E210

Uniqueness

Uniqueness Score: -1.00%

Function 00F023BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.606662035.0000000000F02000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F02000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_f02000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c3fe39dd591fd29a210754b74b845e8d58d5a071a9f992a76e46701bac51e60
Instruction ID: c4894f8dec71efe460206b51936e82e3f7827aeeff9e143410c35568bed0c3d7
Opcode Fuzzy Hash: 1c3fe39dd591fd29a210754b74b845e8d58d5a071a9f992a76e46701bac51e60
Instruction Fuzzy Hash: B7D05E347002814BCB15DB0CD598F5937D4AB41B14F0644E8AC008B6A2C7B8DC81E610

Uniqueness

Uniqueness Score: -1.00%

Function 028E0DE0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.607098718.00000000028E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5df54bf1d9da4b6ea628ecdf833fd1c07e10572892900f5e37cbf3a7791838c
Instruction ID: 62f441a572d18d6e8420a9881eb51d22093c954db672b1c4bb325fca5227eccd
Opcode Fuzzy Hash: c5df54bf1d9da4b6ea628ecdf833fd1c07e10572892900f5e37cbf3a7791838c
Instruction Fuzzy Hash: 83C012382102048BCB08A7A8D51DB2573EB67C1704F45C964804D9B351DA71EC40CA84

Uniqueness

Uniqueness Score: -1.00%

Function 028E0E18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.607098718.00000000028E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_28e0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9b7423518da54449bc4f1e1462d538a9a11a5a5380053049cd784f51db04791
Instruction ID: bb5efd839ceb8933086539d83cfe48bba12eb4122f309f416adb4015b5b069c9
Opcode Fuzzy Hash: a9b7423518da54449bc4f1e1462d538a9a11a5a5380053049cd784f51db04791
Instruction Fuzzy Hash: D9C012382103048BCB04A768D51DB29779A67C5704F85C865804DAB351DA75EC40CA80

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to elicit sensitive information and/or gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.
Tactics:	Initial Access
Data Sources:	DNS records, Detonation chamber, Email gateway, Mail server, Packet capture, SSL/TLS inspection, Web proxy
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Cancellation_418406_Dec23.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Qbot Downloader

Yara Signatures

Initial Sample

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\39c14c1f4b086971_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\3a4ae3940784292a_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6267ed4d4a13f54b_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0

Windows Analysis Report
Cancellation_418406_Dec23.pdf